Privacy Policy

Last updated 2026-10-23.

Who is accountable

GUINEA PIG SOFTWARE DEVELOPMENT INC. (Ontario, Canada) is accountable for the personal information described here, under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Contact our privacy point of contact: support@ogmake.com.

What we collect

• Account: the email address you sign in with, your plan, and, if you subscribe, your Paddle customer id (Paddle handles your payment details directly — see "Billing" below).
• Referral source: if you arrive via a link with a `?ref=` tag, we store that tag (a short code identifying the channel, up to 32 characters) in a cookie for up to 90 days and save it once against your account when you sign up. Visits without a `?ref=` tag store the landing page path and the referring site's domain (never the full referring URL) in the same cookie for up to 90 days, saved once against your account at signup.
• Sign-in: a magic-link sign-in sends a one-time link to your email address and creates a session for your browser. We do not store your IP address with that session; your browser's user-agent string is stored with it.
• Brand logo: if you upload a logo to brand your rendered cards, we store the PNG file itself in our storage on our server, under a key scoped to your account. Uploading a new logo replaces it. It is kept for as long as your account is active, deleted immediately when you remove it from the dashboard, and deleted along with the rest of your account data when you ask us to delete your account (see "Questions or requests" below).
• API keys: we store a hash of each key (not the key itself) and its signing secret in encrypted form, plus a label you give it, whether it (or its public-URL access) has been revoked, and when it was created and last used. A key you mark for public URL access also stores the template names you allowed for it.
• Usage: how many renders your account has made in the current billing period, so we can enforce your plan's quota, plus a daily and monthly count of unsigned public-URL renders for keys you've made public.
• Generator and API requests: the title, description, template, and other parameters you supply are processed to render your image. We do not log these parameters. The free generator's rendered image is not stored — it is cached in our server's memory for up to 7 days, then evicted. A rendered image made through the editor or the API while on the free plan is stored and automatically deleted after 30 days; a rendered image made on a paid plan is kept in storage indefinitely (deleted only if you ask us to delete it, including as part of an account deletion request).
• Template image uploads: an image you upload while building a template in the editor is stored in our storage on our server under a key scoped to your account, and is kept until you delete your account.
• Your IP address is used as a rate-limiting key on the image-generation routes and, together with your browser's user-agent string, to compute the daily visitor id described under "Site visits" below. The IP address itself is not stored.
• Server-side counters record event names and counts (for example, "a render happened"). These counters carry no identifier for uses of the free, unauthenticated generator or for signups; those uses are also stored as site-visit records, with the daily visitor id and the details listed under "Site visits" below. A render made through an API key — the editor, a free- or paid-plan key, or a public /p URL embedded on someone else's page — is also counted alongside that API key id or an account-linked identifier, plus the template used and the render's timing and size — never your email address, IP address, or the field values you entered, and never shown to anyone but us.
• Site visits: when you open a public page of this site, our server stores the page path, the referring site's domain (never the full referring URL), any UTM tags and ref tag in the address, a device class (mobile, tablet or desktop), a browser family (for example Chrome or Safari), whether you are signed in, and a visitor id. The visitor id is a hash of your IP address and your browser's user-agent string, made with a key that changes every UTC day, so the same browser gets a different id each day; your IP address itself is not stored. Uses of the free tools, sign-in links sent and signups are stored with the same daily id. A small script from this site reports to our own server that the page loaded and when you copy a generated snippet; it sends only the action and the page path. Page views by known bots are stored separately with only the bot's name and the page path. This uses no cookies, and nothing is sent to a third party. These records are deleted from our live database after 90 days; copies of them stay in our nightly database backups for up to 35 more days and in our hosting provider's daily server backup for up to 7 days beyond that (see "Retention" below). They are visible only to us.
• AI design prompts: the text you type to generate an AI design is sent to Google (Gemini API), which processes it to produce the image. With "Design from my site", we fetch the page you give us and send the site's host, title, tagline and font names to Gemini with your prompt, plus the site's brand colours (when you give none) and whether the site has a logo; the site's logo is stored as an asset in your account.
• AI page reading (paid plans): when you fill in "What should AI look for?" or attach a screenshot, or send a hint or screenshot through the API, we send that text, the screenshot (with its metadata removed), the page's address, the page's text when we could read it, and the page's title, description and price to Google (Gemini API), which reads them to fill in your image's fields. We keep only hashes of the hint and the screenshot and the fields Gemini returned, not the text or the screenshot.

Why we collect it

To operate accounts, authenticate sign-ins, generate the images you request, meter and enforce plan quotas, bill subscriptions, respond to support requests, protect the service from abuse (rate limiting), and understand aggregate site usage.

Billing

Paddle.com is the Merchant of Record for our paid plans: when you subscribe, you are contracting with Paddle for the purchase, and Paddle collects and processes your payment details directly — we never see or store your card number. Paddle shares back the subscription status and a customer id we use to apply your plan.

Where it is processed

ogmake runs on a server we rent from Hetzner Online GmbH in Nuremberg, Germany, and we use Paddle for billing, Resend for outbound email (sign-in links and account notices), and Firecrawl to read a web page you ask us to read when that site blocks our own request. These providers may process and route information through jurisdictions outside Canada, including the United States. While information is outside Canada, it may be accessed by the courts, law enforcement, or national security authorities of that jurisdiction under its laws.

Who processes it

• Hetzner Online GmbH — hosting, database, storage, rendering, usage counters, backups.
• Paddle — billing, payment processing, Merchant of Record.
• Resend — outbound transactional email (sign-in links, notices).
• Firecrawl (SideGuide Technologies, Inc.) — reads a web page you ask us to read when that site blocks our own request; it receives the page's address.

For customer content we process for you as a processor, see our Data Processing Addendum and sub-processors.

Retention

Account and billing records are kept for as long as your account is active, and afterwards as needed to meet accounting and tax obligations. Render request parameters are not logged. The free generator's rendered image is never stored, only cached in our server's memory for up to 7 days. A rendered image made through the editor or the API on the free plan is stored and automatically deleted after 30 days; on a paid plan it is kept in storage indefinitely, for as long as your account is active, so it can keep serving instantly on repeat requests — we delete it if you ask us to, including as part of an account deletion request. Your uploaded brand logo and any template image uploads are kept for as long as your account is active, and deleted along with the rest of your account data if you ask us to delete your account (a removed brand logo is also deleted immediately). We take a nightly backup of our whole database, which holds every record described on this page that we keep in it (including account, auth, key, quota, subscription, Paddle event, brand-logo and site-visit data), kept for 35 days on a rolling basis on the same server, so a record deleted from the live database can remain in these backups for up to 35 days. Our hosting provider also takes a daily backup of the whole server, kept for 7 days.

Questions or requests

To ask about, access, or request deletion of your information, write to support@ogmake.com. There is no self-serve "delete my account" button today: we delete it by hand from that email address once we've confirmed it's you, removing your account, API keys, usage records, stored logo, and stored rendered images, and canceling any active subscription. We aim to complete a deletion request within 30 days.