Privacy Policy | MossImage

Last updated: October 20, 2026

This Privacy Policy explains what personal data MossImage collects, why we collect it, how we store and share it, and the choices you have.

1. Who we are

MossImage is an online AI image generator and knowledge base available at mossimage.pro. The service is operated by the MossImage team. The legal entity responsible for your personal data (the "data controller") is [Company legal name]. In this policy, "MossImage", "we" and "us" refer to that entity and the team that runs the service.

MossImage is an independent product. It is not affiliated with OpenMOSS, the organisation behind the open-source MOSS-Image model.

2. What data we collect

Depending on how you use MossImage, we collect:

Account data. When you sign up with email and password, we store your email address, a hashed version of your password, a display name if you set one, and the date your account was created. If you sign in with Google, we receive your name, email address and profile picture from Google. We never see your Google password.

Generation data. The text prompts you enter, the settings you choose, any reference images you upload, and the images that are generated. These are saved to your account history so you can find them again.

Payment data. When you buy a credit pack we record the pack purchased, the amount, the currency, the date and a transaction reference. Card details are entered directly into our payment processor (Stripe or another PCI-compliant processor). MossImage never receives or stores your card number.

Usage and technical data. Server logs that include your IP address, browser type, requested pages, timestamps and error messages. We use these to keep the service running, prevent abuse and debug problems.

Support and communications. Messages you send to the support email, through the contact page, or through the optional support chat. If you opt in to our newsletter, we store your email address and the date you opted in.

Preferences. Your language, theme and privacy settings, including whether you have opted out of prompt-based product improvement.

3. How we use your data

We use your data to:

create and secure your account and let you sign in;
generate images from your prompts and show them in your history;
process credit-pack purchases, issue refunds and keep accounting records;
send transactional emails such as receipts, password resets and account notices;
send the newsletter, only if you opted in, with an unsubscribe link in every message;
answer support requests;
measure how the service is used so we can improve it;
detect and prevent abuse, fraud and violations of our Terms of Service;
comply with legal obligations.

Improving the product with prompts. We may use anonymised prompts, with account identifiers removed, to improve prompt suggestions, safety filters and the knowledge base. We only do this if you have not opted out. You can opt out at any time in your account settings; the change applies to prompts you enter from that point on.

We do not sell your personal data, and we do not use your data for third-party advertising.

4. AI generation and third-party model providers

MossImage does not run every AI model itself. When you request an image, your prompt, your chosen settings and any reference image you uploaded are sent to a third-party model provider to produce the result. Currently that provider is Google image models accessed through the Kie.ai API. We may add other providers in the future, including a self-hosted deployment of the open-source MOSS-Image model, and we will update this policy when we do.

Providers may keep your inputs and the generated outputs for a limited time for operational reasons. For example, Kie.ai keeps result files for up to 14 days. We send providers only what is needed to produce the image, never your name, email address or payment details.

Generated images are copied to our own storage (Cloudflare R2) and shown in your account history. Images you move to the trash are permanently deleted after 30 days.

We share personal data only with service providers who help us run MossImage, and only to the extent needed for their role:

Cloudflare hosts the application (Workers), stores account and generation records (D1), stores generated images and uploads (R2), caches data (KV) and serves optimised images (Images).
AI model providers, as described in section 4.
Stripe or another PCI-compliant processor handles payments.
Resend or Cloudflare Email delivers transactional email. Resend or Beehiiv may deliver the newsletter if you opted in.
Crisp may provide the optional support chat.
Analytics providers, as described in section 6.

We may also disclose data if required by law, to protect the rights and safety of users or the public, or as part of a merger or acquisition, in which case we will tell you first.

6. Cookies and analytics

We use a small number of strictly necessary cookies to keep you signed in and remember your language and theme. We may use analytics tools such as Plausible (cookieless), Google Analytics, Umami or Microsoft Clarity to understand how the service is used. We do not use advertising cookies. Details of each cookie and how to control them are in our Cookie Policy.

7. How long we keep data

Account data: for as long as your account exists. When you delete your account from settings, your profile data and generated images are removed within 30 days.
Generated images: until you delete them. Trashed items are purged after 30 days.
Payment records: for as long as tax and accounting law requires, even after you delete your account. These records do not include card numbers.
Server logs: for the short period needed for security monitoring and debugging.
Support messages: for as long as needed to resolve your request and keep a record of it.
Newsletter data: until you unsubscribe.

8. Your rights

Depending on where you live (for example under the GDPR in the EEA and UK, or the CCPA in California), you have the right to:

access the personal data we hold about you;
correct inaccurate data;
delete your data (you can do this yourself from account settings);
receive a copy of your data in a portable format;
object to or restrict certain processing, including the use of your prompts for product improvement;
withdraw consent where processing is based on consent, such as the newsletter;
not be discriminated against for exercising these rights.

To exercise any of these rights, email support@mossimage.pro from the address linked to your account. We will respond within the time required by law. We do not sell or "share" personal data for cross-context advertising as those terms are defined by the CCPA. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

9. Children

MossImage is not intended for children. You must be at least 13 years old to use the service, or at least 16 if you live in the EEA or the UK. If you are under 18, you need a parent's or guardian's permission. If we learn that we have collected data from a child below the minimum age, we will delete it.

10. Security

We protect your data with industry-standard measures: encrypted connections (HTTPS), hashed passwords, access controls on our infrastructure and limited staff access. Payment details are handled entirely by our payment processor. No system is perfectly secure, so please use a strong, unique password and tell us right away if you suspect unauthorised access.

11. International transfers

Our infrastructure and service providers operate globally, so your data may be processed in countries other than your own, including the United States. Where required, we rely on safeguards such as standard contractual clauses to protect transferred data.

12. Changes to this policy

We may update this policy as the service changes. We will post the new version here and update the "Last updated" date. For significant changes we will notify you by email or with a notice in the app before they take effect.

13. Contact

Questions, requests or complaints about privacy: email support@mossimage.pro or use the contact page.