Privacy policy

Last updated 21 July 2026

This page describes what Saga Studio stores about you, why, and what happens to it. The short version: we store what the studio needs to work — your account, your prompts, your renders, and your credit ledger — and nothing else. No advertising, no sale of personal data, no third-party analytics.

1. What we collect

Account: your email address and a salted hash of your password. We never store the password itself. If you sign in with Google, we store the email address Google verifies for you; we never see your Google password.
Your work: the prompts you write, reference media you upload, the images and video you generate, and the settings used to generate them — so the studio can show your library back to you.
Billing: a ledger of credit top-ups and render charges. Card details go directly to Stripe and never touch our servers; we see only the amount and a payment reference.
Operational logs: standard server logs (requests, errors, IP addresses) kept for security and debugging, and rotated out routinely.

2. How we use it

Only to operate the service: authenticating you, producing the renders you request, showing your library, maintaining your balance, and sending the transactional email the service needs (for example a password-reset link — we don't send marketing email). We do not use your prompts or media to train models, and we do not sell or share personal data for advertising.

3. Who else touches your data

Model providers: when you render, your prompt and any reference media are sent to the model you selected (for example OpenAI, ByteDance, Kuaishou, or Google models, routed through OpenRouter). That is the service working as described; their handling is governed by their terms.
Stripe processes payments.
Google verifies your identity only if you choose "Continue with Google".
Resend delivers transactional email such as password resets.

These processors receive only what their job requires. Nobody else gets your data unless the law compels it.

4. Cookies and local storage

Your session token lives in your own browser's local storage, and one first-party cookie remembers that you're signed in. That's all — no tracking cookies, no third-party analytics scripts.

5. Retention and deletion

Your prompts, media, and account data are kept while your account exists. When your account is closed, they are deleted; payment records are retained only as long as accounting law requires. You can request account closure at any time (section 8).

6. Security

Passwords are hashed with scrypt and a per-account salt. All traffic is encrypted in transit (HTTPS). Balances and charges live in an append-only ledger, and the database is backed up to separate machines so your library and balance survive hardware failure.

7. Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live (for example under the GDPR or similar laws), these are legal rights; we honour them for everyone regardless. Contact us as described below and we'll reply to your account email.

8. Contact

Privacy questions, data requests, or account closure: use the feedback form in the studio, and we'll reply to your account email.

9. Changes

If this policy changes materially, we'll announce it in the studio before the change takes effect. The "Last updated" date above always reflects the current version. See also the terms of use.