Privacy Policy

This policy explains what VidStar ("we", "us") collects when you use vidstar.app, why, who helps us process it, and the choices you have. VidStar is run by an independent developer. Questions: support@vidstar.app.

VidStar is an unofficial tool. It is not affiliated with, endorsed by or connected to the artists, creators, record labels or platforms behind any trend.

AI models and services we use

To make a new video, we use:

SeeAPI, which checks your uploaded photo and generated video for nudity and sexual content;
Kie.ai, which runs Kling O3 to place the subject from your photo into the trend's fixed reference clip;
fal.ai, which runs Kling O3 in the same way if Kie.ai can't process your video for a technical reason;
Cloudflare, which hosts the processing that attaches the template soundtrack before the video is stored for delivery.

These providers process your photo only to provide their service to us. We don’t use your photos or videos to train AI models, and we don’t let providers do so on our behalf where we can control it.

What we collect

When you create an account

You can sign up with your email address and a password, or with Google. With email, we store your name, email address and a securely hashed password (never the password itself), and send you a verification link.

With Google

Google shares your name, email address, profile picture and Google account ID with us, and we store the sign-in tokens it issues so you stay signed in. We never see your Google password.

Photos you upload

Your photo is resized in your browser, then stored on our servers only so the AI and moderation providers can fetch it. It is deleted automatically within 24 hours.
Before anything is generated, the photo is checked by SeeAPI for nudity and sexual content, and the AI models apply their own safety filters. Photos that fail are deleted right away. The finished video is checked again before delivery; a video that fails is not delivered.
Only upload photos of yourself, or of people (and pets) whose owner has agreed.

Videos you make

We store each video you generate, so you can watch and download them again in My videos.
We keep a record of each generation: quality, credits used, status, the provider's cost and the time.
We keep a moderation record for each check (which stage, pass or blocked, the labels returned, and the time) for up to 1 year, to enforce our Acceptable Use Policy and answer appeals. It doesn’t contain the image itself.

Payments

Payments are handled by Waffo.com Limited ("Waffo"), which sells our credit packs to you as merchant of record and handles tax. Waffo's privacy policy applies to the details you enter at checkout. We receive your order ID, pack and payment status. We never receive or store your card details.

Launch-list emails

If you joined our launch list, we stored your email address to tell you once when the generator went live.

Technical data

Cloudflare Turnstile checks that a real person is using the generator and forms. It evaluates signals from your browser and device; see Cloudflare's privacy policy.
Our hosting provider keeps short-term server logs (such as IP address, requested page and time) for security and troubleshooting.
For simple traffic statistics we record each page visit's referring site, country (from Cloudflare), page and time for up to 180 days. We don't store your IP address or set cookies for this. For search-engine and AI crawlers we check their IP address against the operator's published list when they visit, without storing it.

Product analytics

We use PostHog to understand how people use the site, for example how many visitors make a video or buy credits, and which sites they came from. It records the pages you view, the actions you take in the generator and checkout (such as choosing a photo, starting a video or buying a pack, never the photo itself), the referring site, your browser and device type, and an approximate location derived from your IP address. Once you sign in, these events are linked to your account ID. We don't record your screen or sessions. If you're in Europe, analytics cookies are only set after you accept them; until then PostHog counts visits without cookies. Analytics data is kept for up to 1 year.

We also run our own copy of Umami for basic visit statistics: the page viewed, referring site, browser, operating system, device type, screen size, language and country (derived from your IP address). Umami doesn't set cookies, doesn't store your IP address and doesn't link visits to your account. The data stays on our own server and isn't shared with the Umami project or anyone else. It is kept for up to 1 year.

How we use it

To make your videos and keep them available to you.
To check uploads for prohibited content and prevent abuse.
To sell and track credit packs, and handle billing questions.
To answer your messages, and to email launch-list members once.
To meet legal obligations.

We don't sell your personal information, and we don't use your photos or videos to train AI models.

If you are in the EEA or UK, we rely on contract (making the videos you ask for), our legitimate interests (security, abuse prevention), your consent (the launch email) and legal obligation as our legal bases.

Who processes your data

Provider	What for	Data involved
Cloudflare	Hosting, database, file storage, soundtrack merging, video resizing, bot check (Turnstile), email	Account data, photos (≤24 h), videos, template soundtrack, IP address, server logs
Google	Sign-in	Name, email, profile picture, Google account ID
Kie.ai, running Kling O3	AI video editing using the fixed reference clip	Your photo, reference clip and generated video
fal.ai, running Kling O3	Backup AI video editing when Kie.ai fails for a technical reason	Your photo, reference clip and generated video
PostHog	Product analytics	Pages viewed, actions in the generator and checkout, referrer, device, approximate location, account ID
SeeAPI	Checking photos and videos for prohibited content	Your photo and generated video
Waffo (merchant of record)	Payments, tax and refunds	Billing and payment details

These providers may process data in the United States and other countries. Where the law requires it, transfers are covered by appropriate safeguards such as Standard Contractual Clauses. AI and moderation providers may keep their own temporary copies of inputs and results for a limited time under their policies.

We may also disclose information if required by law, or to protect the rights and safety of our users or others.

How long we keep it

Uploaded photos: deleted within 24 hours.
Videos: until you delete your account.
Account and generation records: until you delete your account.
Payment records: as long as tax and accounting law requires.
Launch-list emails: deleted within 30 days of the launch email.
Server logs: kept briefly by our hosting provider.

Your choices and rights

Delete your account any time in Settings → Security. This deletes your account, credits, generation history and videos.
Leave the launch list, or access, correct or export your data, by emailing support@vidstar.app.
Depending on where you live (for example the EEA, UK or California), you may have further rights, such as to access, correct, delete or export your data, to object to processing, and to complain to your local data protection authority.