Privacy Policy

This Policy applies to the Menace iOS and Android applications, menaceai.app, and related generation, account, purchase, support, and online services (collectively, the "Service"). It does not apply to third-party services you independently visit or use.

In this Policy, photos, videos, prompts, and selections submitted to the Service are "Inputs"; generated or modified results are "Outputs"; and Inputs and Outputs together are "User Content."

A "Menace Device ID" is a pseudonymous identifier used to associate device-based app access with the relevant account state. A "Support ID" is a limited Menace identifier shown to you or included in an editable support draft so we can locate the relevant account or app installation when you ask for help. Neither is your device's hardware serial number.

The data practices for a particular platform or feature may differ. For example, mobile versions may use a device-based identifier, the website may use a third-party sign-in provider, and web Outputs may be stored in Menace cloud storage while mobile Outputs are generally downloaded to the device.

The Android app also sends a one-way hashed value derived from the app package name and an Android system identifier. It is used only to help restore access to an existing Menace account on the same device. Menace receives the hashed value and not the underlying system identifier, and the value is not an advertising identifier and is not used for advertising.

You are not required to provide User Content, but generation cannot work without the Input you choose to submit. Please do not submit more personal information than needed.

We use personal information to:

• Provide, authenticate, personalize, and maintain the Service.
• Upload Inputs, create Outputs, deliver or recover results, and keep generation history where the feature supports it.
• Process purchases, maintain credits and access, prevent duplicate charges or credits, restore transactions, and handle refunds or chargebacks.
• Operate onboarding, paywalls, settings, support, and account or device-based access.
• Detect, block, investigate, and document fraud, security incidents, prohibited content, payment abuse, and violations of our Terms.
• Diagnose errors, measure reliability and feature performance, understand aggregated product use, and improve safety and usability.
• Measure campaign performance where an attribution feature is enabled and permitted.
• Respond to support, legal, privacy, deletion, and rights requests.
• Comply with law, valid legal process, app-store requirements, and protect the rights, safety, and property of users, Menace, and others.
• Establish, exercise, or defend legal claims and enforce our agreements.

We disclose personal information only for the purposes described below, subject to contracts, instructions, platform controls, or legal duties where applicable. The vendors we use may change as the Service evolves.

We may also disclose information at your direction, such as when you choose to share an Output using your device's share sheet. Sharing outside Menace is controlled by you and the receiving service's policy.

Menace does not exchange personal information for money and does not currently display third-party behavioral advertisements inside the Service. Some current or legacy mobile app versions may use an attribution provider for campaign measurement as described above. Newer mobile versions may remove particular attribution software, but users may remain on older versions and providers may retain information under their own policies. Depending on the jurisdiction and how its definitions apply, disclosing mobile device/app identifiers and limited onboarding, generation, sharing, checkout, trial, subscription, or purchase event data for that measurement may be considered "sale," "sharing," or targeted advertising even though no money is exchanged for the information. The website does not use this attribution technology.

You may opt out of covered sale, sharing, or targeted advertising through Privacy Choices, applicable device or platform tracking controls, or by emailing hey@menaceaiapp.com. We do not knowingly sell or share the personal information of users under 16. If we learn that covered processing involves a user under 16, we will take the steps required by law.

Platform privacy or tracking controls may limit future collection but do not necessarily delete information already processed.

The website uses cookies or similar browser storage that are necessary for sign-in, security, checkout, account access, and preferences. It may also use local storage for onboarding, active generation, credit, subscription, and history state. Blocking necessary storage can prevent parts of the website from working.

Where required, we will request consent before using non-essential analytics or advertising technologies. Menace does not currently display third-party behavioral ads or use website activity for cross-context behavioral advertising, so there is no such website processing for a browser opt-out signal to disable. Where applicable law requires us to treat a browser opt-out preference signal as a request, we will do so for covered website processing. You may also submit a request through the Privacy Choices page. Because there is no universal standard for other Do Not Track signals, we do not currently respond to them unless legally required.

We retain personal information only for as long as reasonably necessary for the purposes below, then delete, de-identify, or isolate it unless law permits or requires longer retention. Exact periods can vary by feature, account status, legal hold, safety issue, and processor.

Deletion from active systems may not immediately remove encrypted backups, provider processing queues, or information lawfully preserved for security or legal reasons. We restrict use of retained information to the reason it remains.

Platform-specific deletion instructions are at menaceai.app/delete-account. Use the authenticated Delete Account control when it is available. If the control is unavailable, fails, or does not confirm submission, email us using the instructions on that page. Clearing browser or app data, signing out, or uninstalling alone does not delete server-side data. After a verified request is accepted, deletion or de-identification from active systems, backups, and service providers may continue after local sign-out. Deleting an account does not cancel an app-store or web subscription.

A deletion request ordinarily covers eligible account/profile data and generation content in active systems. We may retain purchase, credit, transaction, fraud, security, abuse, deletion-request, and legal records as described above. We may ask for the Menace Device ID, account email, or other limited information to verify that the requester controls the relevant data.

We respond to verified requests and complete eligible first-party deletion steps within the period required by applicable law. Timing varies with the platform, verification, data location, service-provider or backup cycle, and any permitted legal, security, fraud, accounting, safety, or dispute exception. An in-product confirmation may confirm submission or local sign-out without guaranteeing that every processor or backup cycle has completed. Where we have a verified email or support channel, we provide status information as required or reasonably available.

Menace is not directed to children under 13. A person under 13 may not create an account, use the Service, or submit content. If we learn that a person under 13 has used the Service, we will take appropriate steps to suspend the account and delete personal information as required by law. A parent or guardian may contact hey@menaceaiapp.com.

Users aged 13 through the age of legal majority may use Menace only with parent or guardian permission and supervision where required. Some countries require a higher minimum age or parent or guardian authorization for online data processing. The higher local rule applies. Ordinary account creation does not request or store your date of birth. Eligibility relies on the age and guardian representations in our Terms, subject to any additional age assurance or parent or guardian consent required by law.

We do not knowingly use a minor's personal information for targeted advertising, sell it, or share it for cross-context behavioral advertising without the authorization required by law.

Depending on your location, you may have rights to access, know, correct, delete, or receive a portable copy of personal information; restrict or object to processing; withdraw consent; opt out of sale, sharing, targeted advertising, or certain profiling; and appeal a denied request.

Submit a request through Privacy Choices or email hey@menaceaiapp.com. Describe the right and identify the relevant account email or Menace Device ID. Do not send a password, full payment-card number, government ID, source photo, or Output unless we specifically and securely request it.

We will verify requests proportionately, respond within the period required by law, and explain any lawful limitation. You may use an authorized agent; we may request proof of authority and direct verification from you. We will not discriminate against you for exercising a privacy right, though deleting data needed for a feature can make that feature unavailable.

In the preceding 12 months, depending on the platforms and features used, we collected the categories described in Section 2: identifiers; customer/account records; commercial information; internet or electronic-network activity; approximate geolocation; audio, electronic, and visual information; and inferences about feature or purchase preferences. We collect these from you, your device, app stores, sign-in and payment providers, service providers, and our operations for the business and commercial purposes in Section 3.

We may disclose these categories to the recipient categories in Section 5. We do not sell personal information for money. Attribution disclosures may qualify as sale, sharing, or targeted advertising in some states; use Privacy Choices to opt out. We do not use or disclose sensitive personal information to infer characteristics beyond purposes permitted without a right to limit, unless we provide a separate notice.

We do not offer a financial incentive in exchange for selling personal information. Credits, referrals, discounts, or promotions are governed by their own terms and are not payment for a right to sell your data unless a separate notice expressly says otherwise.

We do not use automated decisionmaking technology to make legal or similarly significant decisions about you. Generation safety filters, purchase-risk checks, abuse controls, and entitlement checks may automatically allow, delay, reject, or limit a request for service, safety, fraud prevention, or legal compliance. If California or another state requires cybersecurity audits, risk assessments, or automated-decision disclosures for a specific Menace processing activity, we will maintain those records and provide the legally required notice or choice.

Where applicable, we rely on the legal bases below. Ordinary generation requests and the provider transfers needed to perform them are processed to provide the Service you request, not under an optional tracking consent.

• Contract: to authenticate you, process generation requests and the provider transfers needed to perform them, provide Outputs, maintain credits and access, and deliver requested support.
• Legitimate interests: to secure, diagnose, measure, and improve the Service; prevent fraud and abuse; protect users; and establish or defend claims, balanced against your rights.
• Consent: for optional tracking or another distinct feature where consent is required. You may withdraw consent prospectively.
• Legal obligation and vital interests: to comply with law, valid process, accounting, safety, and urgent protection duties.

You may object to legitimate-interest processing, request restriction, withdraw consent, and complain to your local data-protection authority. We do not use solely automated decisions that produce legal or similarly significant effects about you. Safety filters or purchase-risk checks may automatically allow, delay, or reject a request, but you may contact support.

Menace is operated from the United States and uses providers that process information in the United States and other countries. Those countries may have different privacy laws. Where required, we use contractual protections, adequacy decisions, approved transfer mechanisms, or another lawful basis. You may contact us for information about applicable safeguards.

Residents of Canada, Australia, New Zealand, Brazil, and other jurisdictions may have additional local access, correction, deletion, objection, withdrawal, complaint, or appeal rights. Rights, exceptions, legal bases, and response periods differ by location. Nothing in this Policy waives a non-waivable local right; if this Policy conflicts with mandatory local law, that law controls to the extent of the conflict.

We use administrative, technical, and organizational safeguards designed to protect information, including encrypted connections, access controls, authentication, checks designed to detect tampered app activity, restrictions on internal and provider access, media size and format checks, and monitoring. No service is perfectly secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur. Protect your device and credentials and contact us if you suspect compromise.

We may update this Policy to reflect new features, providers, laws, or practices. We will post the revised Policy with a new effective date and provide additional notice or obtain consent when required. Material changes will apply prospectively to the extent required by law.

Controller: OneClick Commerce LLC, a California limited liability company. Privacy contact: hey@menaceaiapp.com. Use Your Privacy Choices to exercise a right.