MuseFrame Privacy Policy

1. Who this policy covers and who is responsible

MuseFrame is operated by Lenscript (光子方程), an independent developer team ("we", "us"). We are the controller of the personal information described in this policy. Contact: donaldkuke@gmail.com.

This policy applies to the MuseFrame web app (museframe.lenscript.cn/app), the MuseFrame Android app and the website museframe.lenscript.cn. By using these services you confirm that you have read and understood it; the rules for using the service are in the terms of service.

2. What we collect

• Account: email address; a hash of each one-time code (invalid after use); sign-in session records (time, device identifier and device type). If you sign in with a Google or Apple account, also the account identifier and email address that provider returns.
• Device identifier: the Android app reads the system-provided device identifier (Android ID) and sends it with sign-in and generation requests for session management and to stop abuse of free credits. It is not an advertising ID and is never used for ads or cross-app tracking.
• Free-credit abuse records: when the sign-up credits are granted we record the request IP address to spot repeated claims from the same source.
• Photos you upload: uploaded only when you pick a photo and tap Generate. The app re-encodes the photo as JPEG on your device and removes location (GPS), camera model and other metadata before upload; in the web app your browser does this.
• Artworks and projects: the generated images, the exhibition and style you chose, and your intensity, likeness and composition settings. Stored in your account space, visible only to you.
• Credits and orders: grants and consumption of free credits, packs and subscriptions; order IDs and purchase tokens for app-store purchases; for web purchases paid through Waffo Pancake, the order ID, product, amount, currency, checkout email and payment status; records of manual top-ups.
• In-app events and technical logs: in-app actions (opening a screen, starting a generation, a purchase outcome) are recorded linked to your account, together with the app version, per-job technical logs (stage, duration, error codes — never photo content) and request IP addresses. They go only to our own server, are used for troubleshooting, product improvement and abuse prevention, and are kept for 90 days. This version has no separate opt-out switch; if you do not want these records kept, write to us and ask for the records we already hold to be deleted.

We do not collect: your contacts, precise location, the rest of your photo library (only the single photo you pick in the system picker), or card numbers.

3. How a photo is processed

1. The photo is re-encoded and stripped of metadata on your device, then uploaded to our server over an encrypted (HTTPS) connection.
2. The server sends the photo and your chosen style specification through the API to OpenAI GPT Image 2 (gpt-image-2), which generates or edits the final image and returns it to us. Some designed styles use OpenAI GPT-5.4 mini (gpt-5.4-mini) to compile style instructions; it does not generate the final image. If the model or provider changes, we update this policy and the Acceptable Use Policy.
3. The platform applies content and style constraints and relies on OpenAI model and API safety systems; requests rejected for safety or policy reasons are not generated and cost no credits.
4. Generated images carry a visible “AI-generated” label and embed synthetic-content identification in the file metadata (per GB 45438-2025); you can see the label inside the app.

The whole pipeline is automated. Staff do not browse user photos; access happens only when handling a report, an appeal or a security incident. We never use your photos or artworks to train models, build facial-recognition databases, or sell them to anyone.

4. Purposes and legal bases

Purpose	Data involved	Basis
Fulfilling the generation you requested; storing and syncing artworks	Photos, artworks, projects, account	Performance of our contract with you
Sign-in and account security	Email, codes, session records	Contract; legitimate interest in preventing abuse
Granting credits, taking payment, bookkeeping	Credit and order records	Contract; legal obligation (tax and transaction records)
Content-safety enforcement and handling reports	Photos, artworks, technical logs	Legal obligation; legitimate interest in protecting users and others
Troubleshooting and defending against attacks	Technical logs, IP addresses	Legitimate interest
Service notices (codes, security incidents)	Email	Contract

We send no marketing email, build no advertising profiles and share nothing with data brokers.

5. Whom we share with

• OpenAI: receives the metadata-stripped photo and style parameters for GPT Image 2 to generate or edit the final image; GPT-5.4 mini compiles instructions for some designed styles. If the model, provider or processing location changes, we update this policy.
• Google Play: paid items inside the Android app are bought through Google Play Billing, and Google Play handles the payment under its own policy. See the next section.
• Waffo Pancake (payment processor): collects payment for web-app credit packs and subscriptions as Merchant of Record and handles your payment instrument. It receives the email address and billing country/region you enter at checkout and the payment instrument (card, Apple Pay, Google Pay or WeChat Pay); we receive only the order ID, product, amount, currency, email and payment status. Its processing is governed by Waffo Pancake's own privacy policy. See the next section.
• Google / Apple (sign-in): if you choose to sign in with a Google or Apple account, the system sign-in component authenticates you with that provider and all we receive back is the account identifier and email address; the provider's own privacy policy governs its handling.
• Cloudflare: provides CDN and security for the site and the app, processing IP addresses and request headers in transit.
• Our email delivery service (Brevo): delivers codes and service notices and sees only your email address and the message.
• Legal requirements: we disclose data when the law or a competent authority requires it, and tell you where we are allowed to.

Beyond these cases we share your personal information with no one.

6. Purchases and payment information

In the Android app: credit packs and subscriptions are bought through Google Play Billing. Your card and billing details are handled by Google Play; we receive only the order ID, product, purchase token and status needed to verify the purchase and grant credits. The iOS app is not released yet, so there is no App Store in-app purchase.

Web app: credit packs and subscriptions are collected by the third-party payment processor Waffo Pancake (Merchant of Record) on a checkout page it hosts. Waffo Pancake receives: the email address and billing country/region you enter, and the payment instrument (card, Apple Pay, Google Pay or WeChat Pay), which it handles under PCI-DSS. We receive: the order ID, product, amount, currency, email and payment status, and, where Waffo Pancake provides it, the last four digits of the card so you can match the charge on your statement — never the full card number. Card data never passes through, and is never stored on, our servers. For manual top-ups still arranged through the QQ group or by email, we keep only the top-up record (product, amount, time, account).

Order and transaction records are kept for the period the law requires (tax and dispute handling), stored separately from your photos and artworks, and de-identified when the account is deleted. Cancellation, our no-refund policy and billing disputes are described in the terms of service, section “Cancellation and Refund Policy”.

7. Retention and deletion

Data	Kept for
Original photos you upload and generated artworks	Kept on our servers for the life of the account. Deleting a project in "Projects" removes it from your list at once; its image files are not purged automatically — to have them removed from the server too, email us naming the project and we handle it manually and write back when it is done (no fixed turnaround)
Email and account profile	Life of the account
Sign-in session records	90 days
Credit consumption records	Life of the account
Order and transaction records	The statutory bookkeeping period, separated from content and de-identified
In-app events and technical logs	90 days
Free-credit abuse records (IP)	Life of the account; removed with the account
Website access logs	At most 30 days

Deleting your account: start it from "Profile → Delete account" in the app — after you confirm, the app opens a pre-filled deletion email, and sending that email submits the request. You can also write from your registered address to donaldkuke@gmail.com with “MuseFrame account deletion” in the subject; the steps are on the account deletion page.

Once we have verified that the address is yours, we process the request manually: sign-in is disabled and your account record, projects, the photos you uploaded, the artworks generated from them and the free-credit anti-abuse record are removed. We write back when it is done. There is no self-service deletion flow today and we do not promise a fixed completion time; reply to the same email thread if you need an update. Transaction records we must keep by law are separated from your other data and de-identified. Deletion cannot be undone and remaining credits are forfeited, so export the artworks you want first.

8. App permissions and local storage

• Network: uploading photos, fetching results and syncing your account. This is the only permission the Android app declares.
• Choosing a photo: handled by the system file picker, which hands the app only the image you select — so no photo-library or camera permission is requested.
• Account credentials: handled by the system sign-in component when you use a Google or Apple account.

The web app keeps your sign-in state and interface language in browser local storage. Neither the app nor the website uses third-party tracking cookies or any third-party advertising or analytics SDK. The website pages do carry our own first-party page-view counter (GoatCounter), which sets no cookie, creates no device identifier and never reads page content; see the next section.

9. What the website (museframe.lenscript.cn) collects

No account is needed to browse this site. It is a static website and collects only:

• Server access logs: IP address, time, request path, browser User-Agent and referrer, used to troubleshoot and to defend against attacks. Logs rotate by size and are kept for at most 30 days before being overwritten.
• Content delivery: the site is served through Cloudflare for CDN and security. Cloudflare processes your IP address and request headers in transit; see its privacy policy.
• Scripts Cloudflare may inject: we place no third-party analytics, advertising or social plugins on these pages and set no tracking cookies. The site is, however, delivered through the Cloudflare CDN, and Cloudflare may inject scripts of its own at the edge — its email-address obfuscation script (/cdn-cgi/scripts/…/email-decode.min.js) is one you can see today, and when automatic injection is switched on for its Web Analytics it also adds a performance-measurement script (static.cloudflareinsights.com/beacon.min.js). That script is not configured by us, sets no cookie and is not used for advertising or cross-site tracking; it reports page performance and page views to Cloudflare, and Cloudflare’s own privacy policy governs it. A content-blocking browser extension will stop it.
• Page-view counting: pages report "which path was opened", the page title and the referrer to our self-hosted counter (markstats.lenscript.cn, GoatCounter). It is first-party, sets no cookie, creates no device identifier and never reads page content. To opt out permanently run localStorage.setItem('lens_telemetry','0') in your browser console.
• Emails you send us: the "register your email" and "buy by email" buttons simply open your own mail app; what we receive is the message you send, used only to reply and for the purpose you asked for.

10. Your rights

Under China's Personal Information Protection Law and any law that applies where you live (such as the GDPR or CCPA) you can:

• access and copy the personal information we hold about you;
• correct inaccurate or incomplete information;
• delete your information or delete your account (where one exists);
• withdraw consent and restrict or object to certain processing (for example turn off anonymous statistics);
• receive a copy of your data in a common machine-readable format (portability);
• complain to the supervisory authority where you live.

To exercise a right, email donaldkuke@gmail.com and include your registered email or another way for us to identify you. We reply within 15 business days; to protect your data we may first verify your identity. Requests are free unless they are clearly repetitive or unfounded.

11. Security and security incidents

All traffic to our servers is encrypted with HTTPS; only the necessary ports are exposed to the public internet, administrative endpoints are authenticated and rate-limited, and secrets live only in the server environment, never in code or logs. Photos and artworks are stored in access-controlled server directories, and the credentials for the generation provider live only in server environment variables.

If a security incident is likely to put your personal information at risk, we notify you within 72 hours of confirming it, by the email you gave us or on this page, and report it to the authorities as the law requires.

12. Children

MuseFrame is intended for users aged 14 and over (or the minimum age required where you live) and is not designed for children. We do not knowingly collect personal information from children under 14; if you are a parent or guardian and believe a child has given us information, contact donaldkuke@gmail.com and we will delete it promptly.

13. Where data is stored and international transfers

Our servers are located in mainland China. Processing outside China happens in these cases: Cloudflare's global network handles your requests in transit; payment providers and app stores may process payment data where they are established; and any other provider named in the relevant section of this policy. We send each provider only the minimum needed for its task and require protection equivalent to this policy.

14. Changes to this policy

We update this policy on this page and revise the date at the top. For material changes to what we collect, why, or with whom we share it, we give at least 15 days' notice on this page, in the app or by email. Previous versions are available on request. The current version lives at https://museframe.lenscript.cn/en/privacy/.

15. Contact

Privacy questions, rights requests, data export or deletion: donaldkuke@gmail.com (this mailbox is monitored). Chinese-speaking users can also reach us in QQ group 824558022. We reply within 15 business days.