Privacy and photo handling.

This prelaunch preview

This notice describes EPG account functions, optional public-page analytics and the payment records used for the approved one-time pack. Photo uploads and image-provider execution remain closed pending separate processing approval and a funded generation budget. Checkout may also remain paused during verification.

Private, manually reviewed support is available after signing in. Account controls, including sign-out and deletion, remain available from Account settings. No public support or privacy mailbox is configured.

Account and sign-in information

For email sign-in we store your email address, a password hash, verification status, account identifiers and the versions of the account terms you accept. Verification and recovery links are single-use and expire.

If you choose Google, we request only openid, email and profile. We use your Google identifier, verified email, basic profile name and profile image URL to establish and display your EPG identity. We do not request Gmail, Drive, contacts or calendar access. Google data is not sent to an image-generation provider, sold, or used for advertising or model training.

Account sessions include a session identifier, expiry and security information such as IP address and browser user agent. An HTTP-only session cookie keeps you signed in; access, authentication limits and deletion records help prevent misuse.

Services used for account access

The preview runs on a Tencent Cloud server in Frankfurt, Germany. Account records and private application files are stored there. Encrypted backup copies are also kept outside the application server for recovery.

Google handles Google sign-in. Resend handles account verification and recovery email; it receives the recipient address and the email content needed to deliver the link. The EPG sending configuration uses Resend’s US East region and disables open and click tracking. These providers handle their own service records under their policies; EPG does not promise a deletion deadline for their independent records.

Passwords are stored as hashes. OAuth tokens, queued email content and backup archives use application encryption. Access to an account requires authentication; no security system can eliminate every risk.

Account retention and deletion

Account information remains while your account is active. Account deletion revokes sessions, removes sign-in credentials and replaces the account’s profile and email with a deleted-account placeholder. It also blocks access to associated private photos and queues file cleanup.

Deletion and content-free audit markers can remain to enforce removals and preserve record integrity. Encrypted application backups have a seven-day retention target. A restored backup must replay later deletion records before account or photo access resumes. Backup expiry and an isolated production restore were tested; an offsite copy on the owner’s Mac updates only while that Mac is awake and connected. Deletion does not promise immediate removal from every backup copy.

Deleting EPG does not delete your Google account. You can also remove Engagement Photo Guide access in your Google account’s third-party connections settings.

Before real photo processing

The planned reference-photo period is 24 hours and the planned generated-portrait period is seven days. These are the EPG storage settings, not a verified promise about an image provider’s systems.

No image provider is approved for real photo processing in this preview. Its identity, purpose and retention boundary must be confirmed and disclosed before uploads or generation open. Acceptance of this account notice is not permission to process photos.

Private support messages

We store the subject, category, message, optional owned order or generation reference, and the support reply to investigate your request. Only your account and authorized EPG operations staff can read this correspondence. Messages are not sent to an image provider or an email service.

Support message content remains while the account is active. Account deletion removes message and reply text and linked references from the application; a removal marker and content-free audit can remain. Encrypted backups follow the seven-day retention target, and later account deletions must be replayed when restoring backups.

Optional public-page analytics

With your permission, Google Analytics measures visits to our seven public information pages. It receives the public page path and fixed page title, referring site origin, browser/device information and network information used by Google Analytics. Query strings, fragments, account identifiers, order details, private photo addresses and image prompts are excluded from EPG analytics events.

Analytics is off until you choose Allow analytics. Advertising storage, advertising personalization and Google signals are disabled. Account, payment, creation, job, result and administration pages do not load analytics. Enhanced automatic measurement is disabled for this website data stream.

Your analytics choice is stored on your device for up to 180 days. You can change it using Analytics choices in the footer. Rejecting analytics does not affect account or photo features. Google handles the analytics data under its own privacy policy.

Payments and financial records

Dodo Payments handles checkout as merchant of record and collects the billing and payment details needed for the transaction. EPG does not ask you to enter card details into EPG forms. EPG and its independent collection service store order identifiers, amounts, currencies, payment and refund status, receipt references and provider event information needed to reconcile purchases. Provider records can contain a customer name, email and billing information supplied by Dodo.

Payment records and financial audit markers can remain after account deletion for reconciliation and record integrity. Deleting photos or releasing a reserved generation credit does not erase or refund a payment. Payment information is not sent to the image provider or included in EPG public-page analytics. Dodo maintains its own records under its policies; EPG does not promise a deletion deadline for Dodo’s independent systems.

Photo retention

Configured EPG photo retention: reference photos expire 1 day after upload, and generated portraits expire 7 days after they are saved. Download portraits you want to keep before they expire.

Deleting a photo revokes account access immediately and queues private file cleanup. Restored backups must replay later deletion records before access can resume.

The encrypted backup retention target is 7 days. Production backup scheduling and offsite expiry have not yet been verified. The image provider’s own retention has not yet been confirmed; real photo processing remains unavailable until its handling is verified.