Privacy & photo handling

How this build handles information

The OpenAI API key is read from a server environment variable and is never sent to the browser. AI background requests send only the selected visual settings and optional visual note; the recipient name and birthday wish are not required for background generation.

A photo selected with “Use your own photo” stays inside the visitor’s browser. It is drawn directly onto the local canvas and is not uploaded to the application server or sent to the image-generation API.

Paid AI cards use Paddle Checkout. Payment card details are handled by Paddle, not stored by this application. The application stores an anonymous browser-session identifier, remaining AI card credits, and processed Paddle event/transaction IDs so paid access can be provisioned without duplicate credits.

AI-generated backgrounds are temporarily stored on the application server so the browser can load them. The included cleanup task can delete them automatically after the configured retention period.

Before public launch, replace this technical note with a jurisdiction-appropriate privacy policy and terms of service covering your business, hosting provider, analytics, payments, cookies, retention, and user rights.