Privacy Policy

Last updated 21 October 2026

The images and video you work on never leave your device — unless you use an AI feature. Everything else runs in your own browser, on your own hardware, and nothing is uploaded. The two AI features — the AI Generate effect, and generating a source image — are the only exceptions. Both run only when you press Generate, and both are described in full below.

We hold your email address, a record that you paid, and a profile photo if you choose to add one. That is the whole list. There are no analytics, no trackers and no advertising. The only third-party script the site ever loads is Google's sign-in code, and it is used for signing in and nothing else.

What we do not collect

This section is longer than the next one, which is the point.

Your images and video. Decimation Lab is a browser application. When you open a file, it is read into your browser's memory and rendered on your own graphics hardware. We never receive it, never store it and never see it. Exports are written by your browser straight to your disk. The single exception is the AI Generate effect, which you have to add and then run deliberately — see AI effects.
Your work, in any form. No thumbnails, no previews, no "anonymized samples", no telemetry about what you made.
Analytics. There is no Google Analytics, no Plausible, no PostHog, no Mixpanel, no session recording, no heatmaps and no error-reporting SDK.
Advertising or tracking identifiers. None, and we do not sell, rent or share personal information with anyone for advertising.
Third-party scripts and fonts. Every font is served from our own domain. No Google Fonts, no CDN, no embedded widgets. The one exception is Google's sign-in code. On a computer it loads when you press "Continue with Google". On phones and in Safari, Google's sign-in library loads it when the app opens, so that the Google sign-in window is not blocked when you ask for it. Either way it is used only to sign you in, and it never receives your images or video.

This is enforced by the application's Content Security Policy, not merely intended: the browser is instructed to block any connection except to our own domain, to Google's sign-in and database services, and to the AI providers listed under AI effects. A tracker could not phone home even if one were added by mistake.

What we do collect

What	Why	Where it lives
Your email address, an account identifier, whether the address is verified, and which sign-in method you used (password or Google)	To sign you in, to prove your license is yours, and to reach you about your purchase	Google Firebase Authentication
A purchase record: the Stripe identifiers for your payment, the amounts, the currency, and when it happened	To know that you bought it, to support a refund, and for our own accounts and tax	Google Cloud Firestore
A license record: whether your access is active, and if it ended, why	To unlock the editor for you, and to explain it if access stops	Google Cloud Firestore
Your profile photo, only if you add one: a 256-pixel copy of the part you chose in the crop window	To show it in the account circle on every computer you sign in on	Google Cloud Firestore
Ordinary server logs from our host, which include IP addresses	Security, abuse prevention and diagnosing faults. We do not use them to build a profile of you	Vercel

If you sign in with Google, we receive your email address and basic profile information from Google. We do not receive your Google password, contacts, or anything from your Google account.

AI effects

Decimation Lab has two optional AI features, and they are the only parts of the application that transmit your work:

The AI Generate effect, which works on an image or video already open in the editor: it remakes the frame at that point, makes a video clip from it, or restyles the In–Out section of a video. You add it to a stack, supply your own API key, and press Generate.
Generating a source image or video, offered alongside "Browse Files" when no document is open. This creates a starting picture or clip either from a written prompt alone — in which case no image of yours is sent, only your words — or from a picture you choose, which is sent: a reference picture for an image, or a first frame (and, if you add one, a last frame) for a video.

Neither runs on its own. Nothing is sent before you press Generate, and nothing of your work is sent in the background, ever.

Local AI. You can pair Decimation Lab with the Local AI Engine, a program you run yourself, on your own computer or on another computer on your own network. Once you have paired one, your browser checks whether it is running: when you open the app, every few seconds while the AI providers settings are open, and when you ask it to. Those checks go only to the address you paired, carry that engine's pairing code and no picture, and never reach us or anyone else. Until you pair an engine, the app never looks for one. The pairing code is kept in your browser like an API key, and Forget all keys removes it.

When you press Generate, the frame at that point in your stack is sent to the provider you selected, together with your prompt. If you attach reference pictures — some providers accept extra images to steer the style, or to keep a subject recognizable — those are sent as well, including when you are generating from a prompt alone and there is no other image involved. When the effect sends a video to edit, restyle, extend or take the motion from (the In–Out section of a video as it looks at that point in your stack, or a video file you choose), it is made into a short video file in your browser and uploaded to the provider's storage (fal.ai's or Higgsfield's), from where their model reads it. A sound you give a clip to follow, to speak or to lip-sync (a sound file you choose, or the sound of the In–Out section) is made into a sound file in your browser and uploaded the same way; words you type for a provider's voice to speak are sent to that provider with your prompt. What happens to it then is governed by that provider's privacy policy and terms, not ours — including whether they retain it, and whether they use it to train their models. You should read their terms before sending work you care about. We have no visibility into, and no control over, what a provider does with what you send it.

For images, four of the six providers can be reached directly from your browser. Two cannot, because their servers refuse requests that originate in a web page, so those requests are passed through a server we operate. The difference is shown on the effect card next to each provider, and it is this:

Google Gemini, OpenAI, fal.ai and MiniMax — direct. Your browser talks to them. Your image and your API key never touch our servers at all. fal.ai hosts image models made by many different developers; which one receives your request depends on the model you pick in its list. MiniMax only makes images from a prompt, so it receives your words and, if you attach one, a character reference picture, but never the frame you are editing.
Leonardo — partly relayed. Their image-upload endpoint blocks browsers, so the image passes through our server on its way to them. Your Leonardo API key does not: that upload authorizes itself with a short-lived signature, so the key stays in your browser.
Ideogram — fully relayed. Ideogram blocks browser requests entirely, so every image in the request — the frame you are editing and any reference pictures you attached — passes through our server, along with your Ideogram API key, in order to reach them.
Higgsfield — relayed. Higgsfield blocks browser requests, so your Higgsfield API key and your prompt pass through our server to reach it. Pictures, clips and sounds are put straight into Higgsfield's own storage by your browser and the result is downloaded straight from Higgsfield, except where Higgsfield's storage or file host refuses your browser: then the picture (never a clip or a sound) passes through our server too.

Video is direct, except on Higgsfield. Video is generated by Google Gemini (Veo), Leonardo, fal.ai, MiniMax or Higgsfield. The first four are reached directly from your browser: your prompt, any first or last frame, any section or file of video to restyle, any sound or spoken words, and your API key go only to the provider you picked and never touch our servers, Leonardo included: its video service accepts frames without the upload that its image service relays. On Higgsfield, your API key and prompt (with what you write for each shot of a shot list) pass through our server as described above, and so do the style you pick, the ids of any Kling elements you pick, and Higgsfield's list of styles, while any frames, any video you send to edit, restyle, extend or take the motion from, any pictures of characters or of objects to swap in, any reference pictures, clips and sounds you attach, and any sound you give the clip to follow are put straight into Higgsfield's storage by your browser.

For every relayed provider: we do not store, cache, log or inspect any image or the API key. They exist on our server only for the moment it takes to pass them on, and are gone when the request finishes. Our logs record that a request happened, its size, and which account made it — never its contents.

Your API keys are yours. They are stored in your own browser's local storage, on your device, and are sent only to the provider they belong to (via our relay for the three above). We cannot read them. You can delete them at any time in the effect card, and clearing your browser data deletes them too. Any charge for a generation is billed by the provider to your account with them; we are not party to it.

Generated images and videos stay on your device. What comes back is held in your browser for that session and is never uploaded anywhere by us. It is not saved with presets and does not survive a reload. Some providers keep their own copy for a while (Google keeps Veo videos for two days); that is covered by their terms.

A video can take minutes, so while one is being made your browser keeps a note of the provider's job number for it, with your prompt to label it by — never your API key or any picture or video — in its local storage for your account. If the page is closed or reloaded before it finishes, the app uses that note to collect the video the next time you open it, and deletes the note once the video arrives or the provider says it failed.

Payment information

We never see your card. Payment is handled entirely by Stripe on Stripe's own pages; card numbers are typed into Stripe, not into Decimation Lab, and never touch our servers.

Stripe sends us back only what we need to recognize the payment: identifiers, amounts, currency, and whether it succeeded. Stripe processes your payment details as an independent controller under its own privacy policy.

What stays in your browser

Some things are stored on your own device and are never sent to us:

Your saved presets and settings, in your browser's local storage, kept separately for each account that signs in on that browser. They stay on that browser, on that device, and are not copied to your account. Clearing your browser data deletes them, and we cannot recover them.
Your sign-in session, kept by Firebase in your browser's storage so you are not asked to sign in on every visit.

We set no cookies. Nothing here is used to track you, so there is no cookie banner to click. If you use "Continue with Google", Google's sign-in window works under Google's own cookies and privacy policy, as it does on any site offering Google sign-in.

Who we share it with

Nobody, except the three services that make the product work:

Google (Firebase Authentication and Cloud Firestore) - sign-in and the license database.
Stripe - payments.
Vercel - hosting.

If you choose to use an AI effect, the image you generate from — and any reference pictures you attach to it — also reaches the AI provider you picked — Google, OpenAI, Leonardo, Ideogram, fal.ai, MiniMax or Higgsfield. We do not send it on your behalf as a matter of course; it goes only when you press Generate, only to the provider you selected, and it is then covered by that provider's own privacy policy rather than this one.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. If we were ever legally compelled to disclose information, we would - but the list above is the entirety of what we would have to give.

Where your data is held

These services store data in the United States. If you are outside the US, using Decimation Lab means your account and purchase details are handled there.

How long we keep it

Account and license records - for as long as you have an account, so that your license keeps working.
Purchase records - for as long as tax and accounting law requires us to keep them, which is typically seven years. These survive account deletion, because we are required to keep them; they are kept as a payment record and not used for anything else.
Profile photo - until you remove it in Settings, Account, or your account is deleted.
Server logs - for the limited period our host retains them.

Your rights

Wherever you live, you can ask us to:

Show you what we hold about you.
Correct it if it is wrong.
Delete your account and the personal data attached to it, subject to the purchase records we are required to keep.
Export it in a portable form.

Email neuromindart@gmail.com and we'll do it. There is no form and no fee, and we will not make it difficult. If you are in the UK, EU, California or another place with its own privacy law, you have those rights under that law too, including the right to complain to your data protection authority.

Deleting your account ends your license. If you paid within the last 14 days, ask for a refund at the same time and you'll get one.

Children

Decimation Lab is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, email us and we will delete it.

Security

Sign-in is handled by Google's identity service; we never see or store your password. The license database denies all access by default, and each account can read only its own records. Payment identifiers are the only financial data we hold, and they are useless on their own.

The strongest security property here is the one at the top of this page: we do not have the images you work on, so no breach of ours can expose them.

Changes to this policy

If we change what we collect, we will update this page and change the date at the top. If a change is significant - collecting something new, or sharing with someone new - we will email account holders before it takes effect.

Contact

Neuromind, Idaho, United States - neuromindart@gmail.com.