Privacy Policy

This notice explains how NOXIRA handles information when you visit our website, create an account, use Google sign-in, make images, or contact us. For privacy requests or questions, email [email protected].

Information we collect

Account and sign-in: your email address, account identifier, sign-in provider, authentication and session information. If you register with a password, we store a password hash rather than the plain-text password.

Content: images you upload, prompts and settings you submit, generated images, job status and related records. We retain your submitted prompts and a proportionally resized copy of each uploaded input image (at most 1024 × 1024 pixels) with the corresponding job. Images can contain sensitive or identifying details, so only submit material you have permission to use.

Purchases and support: order identifiers, price, payment status, diamond balances and transactions, feedback, and information you send to support. Our hosted payment provider collects and processes payment details; NOXIRA receives transaction and status information.

Device and usage: browser and device signals, cookies, session and visitor identifiers, trial usage, pages and actions, referral and campaign information, and technical or security logs. Browser-derived identifiers help enforce trial limits and prevent abuse.

Google sign-in: access, purpose and storage

Google sign-in is optional. When you choose it, Google and our authentication provider process the authorization and may provide basic profile information such as your name, profile image, verified email address and provider identifier. Our application uses the verified email and authentication provider’s identifier to create or link your NOXIRA account, sign you in, preserve eligible trial access and prevent unauthorized account linking. We do not ask for or receive your Google password, and do not request access to Gmail messages, Google Drive files or contacts for sign-in.

Our authentication provider processes and stores authentication and identity data for the sign-in service; NOXIRA stores the account email and an association to the authentication provider’s user identifier in its database. Temporary authentication cookies support the sign-in flow. We share sign-in data with service providers as needed to operate and secure authentication and hosting. See Google's Privacy Policy for Google's handling of data.

How Google data is shared and protected

Google provides sign-in information to our identity provider. Our application backend receives the verified identity and records the email and account association in our database. Google sign-in information is not published in a public profile or gallery.

The application uses Google sign-in information for account authentication, account linking, trial attribution and access control. It does not use Google profile data as an image-generation input or to train AI models. NOXIRA does not request Google Workspace content or use Google Workspace APIs to develop or train AI models. Our advertising-event integration does not include Google name, email, profile image or provider identifiers in its event payloads. We do not sell Google sign-in data or supply it to data brokers.

Our production sign-in flow uses HTTPS and a code-verification flow to exchange a short-lived authorization code. Authentication context is signed, and authentication cookies are marked HttpOnly and Secure in production. The callback verifies the identity with our authentication provider before linking an account. Protected account, image and administration endpoints check access permissions on the server. These measures reduce unauthorized access but cannot guarantee that a service is immune to security incidents.

Other information: purposes and recipients

We use your information to sign you in, generate and store images, manage trials and diamonds, process payments, provide support and protect the service. Authentication and database providers process account information; hosting, storage and image-processing providers handle the content needed to run the service; payment providers handle checkout. When enabled, prompts are screened through a third-party API for sexual content involving minors. Providers may process information outside your country.

We use cookies and local or session storage for sign-in, security, trial eligibility, referral attribution and site operation. When configured, Meta Pixel receives page-view and purchase-event information, including transaction value and currency, for advertising measurement. Meta may also collect browser and device information through its pixel. Payment providers and other services have their own privacy practices.

Image processing and safety

Generation uses images you select and prompts you enter or that are supplied by the selected template. It does not import photos from your Google account. Generation infrastructure receives this content to run the requested image workflow. Stored content is subject to the access controls and retention practices described in this policy.

When enabled, a third-party API checks prompts for sexual content involving minors. It does not verify a depicted person's age, identity or consent and does not establish that an image is safe. Non-consensual intimate imagery and images of minors are prohibited. To report abuse or request removal without signing in, email the contact address in this policy with the relevant URL or creation ID and a description. Do not send intimate images or identity documents in the initial email.

Retention and deletion

Generated images are deleted from your gallery 72 hours after completion. You can delete eligible completed creations in the app or contact us to request deletion.

Temporary upload access expires after 24 hours; storage cleanup may occur later. Deleting a creation also removes its archived input images and prompts when cleanup completes. Account, payment, security and backup records are handled separately as described below.

Account and Google sign-in associations are retained while needed to provide the account and for security, dispute resolution and legal obligations. Transaction, support and security records may be retained as needed for those purposes. Backups and provider records may persist for their applicable retention periods. To request access, correction, export or deletion of your account and associated Google sign-in data, email [email protected]. We may need to verify your identity, and some records may need to be retained for legal or operational reasons. You can also revoke NOXIRA's Google access in your Google Account settings; revoking access does not by itself delete your NOXIRA account.

Rights, security and contact

Depending on where you live, you may have rights to access, correct, delete, obtain a copy of, object to or restrict processing of your personal data, withdraw consent where processing relies on it, and complain to a relevant privacy authority. Contact us using the email above to exercise your rights. We use access controls and other safeguards, but no online service can guarantee absolute security.

Adults and changes

NOXIRA is intended for adults aged 18 or older and is unavailable in mainland China. If you believe a minor has provided information, please contact us. We will update this page and its revision date when practices change. If Google data would be used for an additional purpose, we will disclose the change and obtain any required authorization before that use. See our Terms of Service.