Privacy Policy — outstandingtiny.com

Last updated: 2026-10-29

Who we are

outstandingtiny.com (“we”) is operated under the personal brand outstandingtiny. Contact: support@outstandingtiny.com.

What we collect

Account and login: name, email, profile image if provided, account and session identifiers, session IP address and browser information, and a password hash for email/password accounts. If you choose Google sign-in, we receive your Google account identifier, authorized name, email and profile image, and store the authentication tokens needed for that connection. We do not receive your Google password or access to your Gmail inbox through sign-in.
Photos you upload: the face photos you submit to make a video, together with file type, size, and role assignments (lead singer, sax, or bandmate). Photo selection first creates a local browser draft; choosing files alone does not upload them to us.
What you create: generation request and job identifiers, settings, status, generated audio/video, provider task references, and credit usage.
Payments: Waffo Pancake processes payment details. We receive order/payment identifiers, the selected pack, amount, currency, payment/refund status, and credit records, not your full card number.
Safety and support: moderation results and review decisions, deletion-request references, and the emails, attachments, reports, or appeals you send to support. To limit repeated introductory offers, we retain a hash derived from your normalized email with the offer-use date and reference; this is still personal data, not anonymous data.
Technical / usage data: device and browser information, IP addresses, request and error logs, and Cloudflare traffic/performance measurements needed to run, deliver, and secure the site. We also use Plausible for pageview, referral, campaign, device, and approximate-location statistics. pvuv.ai and our application’s aggregate analytics are currently disabled.

How we use it

To render your videos: your photos and role settings are sent to our AI providers to generate audio and video.
To run your account: credits, orders, and support.
To keep the service safe: preventing abuse, fraud, and misuse of other people’s photos.
To maintain the site: Cloudflare traffic and performance information and Plausible visit statistics help us understand site usage, reliability, load times, and abuse. We do not use it for third-party advertising.

We do not sell your personal data. We do not use your photos to train foundation AI models. Sample faces and demo videos on the site are AI-generated sample people, not user uploads.

Who processes your data

Generation — Kie AI and ByteDance Seedance 2.0: Kie AI receives reference photos, role settings, and the fixed generation instructions so Seedance 2.0 can generate the audio and video. We do not run a separate lyrics model or send your account password or payment-card details to the generation service.
Content screening — SeeAPI: SeeAPI receives access to the input images and generated video needed for automated safety screening. We keep task references and screening results for review and deletion follow-up.
Payments — Waffo Pancake: handles checkout and payment-card information and sends us order/payment/refund confirmations. It may retain its own transaction records for payment, fraud prevention, disputes, and legal obligations.
Hosting, storage, delivery, and measurements — Cloudflare: Cloudflare runs our website and database, stores private media, delivers content, and processes network, security, traffic, and performance data through its hosting and analytics services.
Website analytics — Plausible: Plausible measures visits without cookies or persistent browser identifiers. IP addresses and browser information are processed transiently; raw IP addresses and User-Agent strings are not stored.
Optional sign-in — Google: Google authenticates you when you choose Google sign-in and shares only the authorized account/profile data described above.
Email and support — Cloudflare and Google Gmail: Cloudflare sends service emails and routes mail sent to support@outstandingtiny.com to our support Gmail mailbox. Google Gmail stores the support correspondence and attachments we receive there. Google sign-in does not give us access to your personal Gmail mailbox.

The generation and screening data flows apply when you submit a generation and that service is available. pvuv.ai is not an active recipient of site visitor data.

Each processor only receives what it needs for its job. This Privacy Policy lives on outstandingtiny.com only.

Audio & video: ByteDance Seedance 2.0 (via Kie AI) · Photos: your uploads

How long we keep it

Different records have different purposes and deletion schedules:

Data	Retention and deletion
Browser photo drafts	Expire 24 hours after the last save. Expired drafts are removed when the app next reads or writes draft storage; a closed browser cannot run cleanup. You can clear site data sooner.
Uploaded input photos and temporary review media in our storage	Input photos are removed after a job succeeds or fails. Temporary photos and unreleased review media become eligible for cleanup after 24 hours from upload, even if a job has not completed. Scheduled cleanup runs every 5 minutes and retries through its queue; the 24-hour cutoff is not a promise that every provider copy is erased at that instant.
Successful videos	Kept while your account is active so you can download them, until you delete the video or close your account. A video-deletion request immediately hides the result and attempts media deletion; failed cleanup is retried. We aim to complete verified media/account deletion requests within 30 calendar days. Download anything you want to keep before deletion.
Account, linked login, and session records	Kept while the account is active. Login sessions expire after 7 days. When account deletion completes, profile, login, session, and account-linked job records are removed from the active database; the separately retained limited records below are exceptions.
Our order, credit, refund, and account-linked moderation records	Kept while your account is active; removed from our active database when account deletion completes. Waffo’s separate merchant-of-record records follow its applicable payment, dispute, and statutory retention requirements. Contact us about any outstanding refund before closing the account.
Introductory-offer prevention hash and offer-use reference	Kept with the associated active-account billing record. After account deletion, the detached reference is eligible for scheduled deletion once 365 days have passed since the first paid use; if that period already passed, it is eligible immediately. It is used to prevent repeated introductory offers, not for advertising.
External deletion follow-up references	Kept while a processor deletion request is unresolved. Once marked completed, references older than 90 days from creation are eligible for scheduled deletion. A pending request is not treated as proof of deletion.
Support conversations, reports, and privacy requests	Kept while the case is open, then deleted within 12 months after closure through our support-mailbox review process, unless the limited hold below applies.
Operational and infrastructure logs	Application operational alerts expire after 90 days. Cloudflare Workers diagnostic logs are retained for up to 7 days under the current service limits. Application aggregate analytics is currently disabled.
Database recovery and release backups	Cloudflare D1 recovery history can retain older copies for up to 30 days. Our exported release database backups are removed within 30 days through the backup review process. Backups are restricted to recovery, not ordinary use; deletions must be reapplied if a backup is restored.

These are our operating periods, not a claim that every jurisdiction requires the same period. A specific legal preservation obligation or active dispute may require a limited record to be held longer; we restrict the record to that purpose and explain the reason when responding to a request, unless prohibited by law.

Copies held by providers

Deleting a file from our storage does not instantly delete copies already processed elsewhere. Kie AI’s published file/log policy currently states 14 days for media files and 2 months for task logs. SeeAPI’s privacy policy does not specify a fixed media-retention period; we track requests for deletion of its task data and do not mark them completed without confirmation. For a verified deletion request, we contact the relevant generation or screening provider as needed and explain any outstanding provider copy or mandatory retention. Payment and email providers may also keep records under their own policies and applicable obligations.

Your privacy rights and requests

Depending on the laws that apply to you, you may:

Be informed about how we collect, use, share, and retain your data.
Access your personal data and receive a copy.
Correct inaccurate or incomplete data.
Request deletion of your data, photos, videos, or account, subject to applicable exceptions.
Restrict processing in applicable circumstances.
Request portability of eligible data in a commonly used, machine-readable format.
Object to processing where the applicable law provides that right.
Withdraw consent for consent-based processing, without affecting the lawfulness of processing before withdrawal. Withdrawal may prevent us from continuing a feature that needs the data.

Email support@outstandingtiny.com with the request, your account email if applicable, and any relevant job or order ID. We may ask for proportionate information to confirm that you are entitled to the data; do not send identity documents unless we specifically explain why they are needed. This request check does not add a verification requirement to registration or checkout.

We aim to acknowledge requests within 2 business days and respond substantively within 30 calendar days. If applicable law allows more time for a complex request, we will explain the reason and the revised deadline within the initial period; any shorter mandatory deadline takes precedence. If we cannot fulfill all or part of a request, we will explain the applicable reason and available review route. You may ask us to reconsider or complain to your competent data protection authority. We do not deny service merely because you exercise an applicable privacy right.

Photos of other people

Only upload photos of people who agreed to be in your video. If someone used your photo without permission, email support@outstandingtiny.com with the link and we will remove it when we can verify the request.

Children

outstandingtiny.com is for adults. Do not upload photos of anyone under 18. We do not knowingly collect data from children.

Cookies and local storage

Essential cookies and browser storage keep login sessions, preferences, and local photo drafts working. Cloudflare supplies site traffic and performance measurements through its network and browser measurement script. Plausible does not use cookies or local storage for analytics. We currently do not load pvuv.ai or set its visitor cookies or local-storage identifiers. You can clear cookies and other site data through your browser settings; doing so may sign you out and remove saved drafts.