Privacy Policy
This Privacy Policy explains what information we collect, how we use it, and your choices when using our services.
Last updated: October 22, 2026
Information We Collect
We may collect account details, profile information, usage data, and technical data such as device type, browser, and IP address. If you sign in with Google, Google shares your name, email address and profile picture with us (we request only the basic email, profile and openid permissions). We use them to create and sign in to your account; we never receive your Google password. Google processes your sign-in under its own privacy policy (policies.google.com/privacy).
How We Use Information
We use information to provide and improve the service, authenticate users, process billing, communicate updates, and prevent abuse.
Information Sharing
We do not sell personal information. Prompts are sent to Replicate to generate images, while Cloudflare provides database, compute, and image storage services. These processors receive data only as needed to operate the service. We use tawk.to for the live chat bubble (not shown on sign-in pages). When you are signed in, we pass your name and email address to tawk.to so we can reply to you. tawk.to receives your chat messages and technical information such as IP address, browser type, language, approximate location, referring page and visit times, uses cookies to run the chat, and processes this data on our behalf under its privacy policy (tawk.to/privacy-policy). Please do not send photos or payment details in the chat.
Data Retention
We retain personal data for as long as needed to provide services, meet legal obligations, resolve disputes, and enforce agreements.
Security
We apply reasonable technical and organizational safeguards to protect your data, but no system can guarantee absolute security.
Cookies and Similar Technologies
We use cookies and similar technologies to keep you signed in, remember preferences, analyze traffic, and improve product performance.
Your Rights and Choices
Depending on your region, you may request access, correction, deletion, portability, or restriction of your personal information.
Contact Us
If you have privacy questions or requests, contact us at support@thedreamyy2k.com.
Prompts and generated content
We process prompts, selected styles, generation settings, generated images, and related identifiers to provide the service, maintain history, prevent abuse, resolve support issues, and improve reliability. Completed images are private by default and are available only to the signed-in account owner. Images and their saved prompts remain in the account until the user deletes the creation or deletes the account.
Uploaded photos
In photo mode, your photo is resized in your browser and sent to our server only for that request. It is screened by the Meta Llama Guard 4 safety model on Replicate and sent to Replicate as input to the Google Nano Banana model to create your image. Dreamy Y2K does not save the original photo in its storage or database; safety records keep only a cryptographic hash. Replicate processes the photo under its own retention practices. If you choose a photo before signing in, it stays only in your browser's local storage for up to 30 minutes so it can be used after sign-in, and it is removed when the studio opens.
AI and infrastructure providers
Prompts and generation settings are sent to Replicate, which operates the Google Nano Banana model for us. Raw prompts are also sent to Creem for pre-generation safety review. Before an image is stored or displayed, its temporary Replicate URL is evaluated by the Meta Llama Guard 4 safety model hosted on Replicate. These providers process data on our behalf under their own security and retention practices.
Payments
When payments are enabled, our payment provider or merchant of record processes payment details. We receive transaction identifiers, status, amount, and limited billing information needed to fulfill purchases and handle support; we do not store full card numbers.
Safety records
We retain moderation decisions, provider references, policy versions, category labels, and cryptographic hashes of reviewed prompts or images for abuse prevention, appeals, legal compliance, and payment-provider review. We do not duplicate rejected images in our application storage. Access is limited to people and providers who need it for those purposes.
