← Back to sign in

Privacy Policy

Last updated: 2026-08-29

1. Who we are

This policy covers the Cauldron studio at app.cauldron.studio and its public Community pages.

Cauldron is operated by Allness Brands LLC, a single-member limited liability company registered in California, at 1401 21st Street, STE R, Sacramento, CA 95811, United States. Allness Brands LLC is the controller of the personal data described here, and “we” throughout this page means Allness Brands LLC.

If you run your own install of the open-source project, your data sits in your own infrastructure and we never see it. The model providers you configure still receive the prompts and images you send them.

2. What we collect

  • Account. Your email address, name, and profile image. If you sign in with Google, the identifier Google gives us for your account. If you sign in with an emailed link, just the email address.
  • Profile and settings. The answers you gave during onboarding (your role, how much experience you have with AI tools, what you are here to do), your display name, notification preferences, and the dates you accepted these documents.
  • Community profile. If you set one up: your handle, bio, links, whether the profile is public or private, and which brands you opted into showing.
  • Your work. Files you upload and generate, plus the thumbnails and preview versions we derive from them; filenames; prompts and model settings; tags, ratings, and review history; collections; comments and threads on assets; and a numeric embedding of each image that makes search-by-image work.
  • Activity. Generations you ran and what they cost, your XP, level, Feats, streak, leaderboard position, and a feed of events inside your studio (uploaded, approved, published).
  • Studio. Studio and brand names, brand kits, who is a member, and invitations sent.
  • Billing. Which plan a studio is on, the credit ledger, and the identifiers Stripe gives us. Card details go straight to Stripe — we never see or store them.
  • Messages and support. Your conversations with the in-app assistant, threads on assets, and anything you email us.
  • Technical. Server logs kept by our host. IP addresses used to rate-limit public pages — held in memory for a few minutes and never written to the database. If you report an asset while signed out, we record the IP address with the report so we can spot abuse of the report button.

We do not run a third-party analytics or advertising tracker in the studio. There is no ad network here. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

3. What a public profile shows

If your profile is public, anyone on the internet — signed in or not — can see, at your profile URL:

  • your handle, display name, avatar, bio, and any links you added;
  • your level and title, your progress toward the next level, and your streak;
  • the Feats you have earned, and when you joined;
  • counts drawn from your activity — generations run, assets published here, tools used, your most-used model, and this month’s leaderboard rank; for people who mostly upload and review, uploads, approvals, team size, and brands run instead;
  • every asset you have published, each with its model, tool, and dimensions; and
  • the brands you opted into listing.

These pages are open to search engines and can appear in search results. Pasting the link anywhere generates a preview with your name and an image. Work you publish may also be used to promote Cauldron — see section 4 of the Terms for exactly what that covers and what unpublishing does and does not undo.

What a public profile never shows: your email address, your prompts, seeds, or generation parameters, anything in your library you did not publish, who else is in your studio, and anything about credits or billing. There is no contact button and no public email address.

4. Public or private, and how to change it

  • Accounts that existed before Community launched start private. We did not make anyone public retroactively.
  • New accounts start public — but nothing of yours is reachable until you claim a handle, and nothing of your work appears until you publish it.
  • The switch is in Profile settings. Setting your profile to private hides your profile page, your stats, every asset you have published, and your entries on leaderboards and brand pages — immediately, on the next page load. Nothing is deleted; switching back restores all of it.

5. Who else processes your data

These companies handle data on our behalf so the product works. We keep the list current; if it changes we update this page.

  • Vercel — hosts and serves the app, and keeps request logs.
  • Neon — the Postgres database holding everything in section 2 except the files themselves.
  • Cloudflare R2 — object storage for your files, thumbnails, and previews.
  • Trigger.dev — runs long background jobs (bulk imports, embedding, reframing, delivery), so it handles file contents and metadata.
  • Resend — sends account, billing, and onboarding email; receives your email address and the contents of those messages.
  • Stripe — processes payments and holds your card details.
  • Google — only if you sign in with Google.
  • Slack — only if your studio connects it. Review notifications post the asset image into your channel, and we store the Slack identity you link to your account (never a Slack token).

Model providers. When you run a generation or a tool, your prompt and any input images go to the provider behind the model you picked, for that request only: OpenAI, Google (Gemini and Veo), xAI, fal.ai, Replicate, Recraft, Ideogram, Luma Labs, MiniMax, Runway, and RunPod. The in-app assistant runs on a model from Google, OpenAI, Anthropic, or DeepSeek depending on how it is configured, and receives the messages in that conversation. The content check that runs when you publish to Community sends the image to Replicate.

We also query the public model catalogues at Civitai and Hugging Face when you search for a model or a LoRA. Those requests carry your search term, not your work.

We do not control what a model provider logs or how long it keeps it — its own policy governs that. We never send your work to anyone for model training. We may also disclose data when the law requires it, and to a buyer if the business is ever sold, in which case we will say so here first.

6. Cookies

A session cookie so you stay signed in, and the cookies Stripe sets during checkout. Your theme, colour scheme, and interface preferences live in your browser’s local storage and are never sent to us. There are no advertising or cross-site tracking cookies. Public Community pages can be read without signing in and without a session cookie.

7. How long we keep it

  • Your files and library stay until you delete them or close your account.
  • Generation history, XP, and the activity feed stay for as long as the account exists.
  • The credit ledger and billing records are financial records. We keep them after an account closes for as long as tax and accounting rules require.
  • Reports and takedown records are kept after the fact — otherwise a taken-down asset could simply be published again.
  • Rate-limit IP addresses live in memory for minutes and are never stored.
  • Point-in-time database history is kept for about six hours, then rolls off.

8. Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete your account and everything in it. Email hello@cauldron.studio. There is no self-serve delete button — a person handles the request. We will ask you to confirm you control the account, and we respond within 30 days.

Deleting your account removes your public profile and every asset you published. What we keep after that is listed in section 7.

If you are in the UK or the EEA (GDPR)

The EU General Data Protection Regulation (GDPR), and the UK GDPR if you are in the United Kingdom, give you the right to access your data, correct it, delete it, receive it in a portable format, restrict how we process it, and object to processing. You can also complain to your local data protection authority.

Our lawful bases for processing under the GDPR are:

  • Contract — running the studio for you: storing your work, processing your generations, billing your plan.
  • Consent — publishing to Community, and optional integrations such as Slack. You can withdraw it at any time by unpublishing or disconnecting the integration.
  • Legitimate interests — keeping the service secure, preventing abuse, and enforcing our terms.
  • Legal obligation — keeping financial records, and responding to lawful requests.

If you are in California

Under the CCPA and CPRA you have the right to know what personal information we collect and why, to get a copy of it, to have it deleted, to correct it, and to limit the use of sensitive personal information. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We will not treat you differently for exercising any of these rights.

Requests under either set of rules go to hello@cauldron.studio.

9. Where your data is

Our database, storage, and hosting are in the United States. Model providers run in their own regions. If you are outside the United States, using Cauldron means your data is processed there.

For transfers out of the UK and the EEA we rely on the standard contractual clauses included in our providers’ data processing terms.

10. Age

Cauldron is an 18+ service. You must be 18 or older to create an account, and we do not offer Cauldron to anyone under 18. We do not knowingly collect personal information from minors. If you believe someone under 18 has an account, email us and we will close it and delete the data.

11. Changes and contact

We will update this policy as the product changes, and the date at the top always says when it last changed. For material changes we will give notice in the app or by email before they take effect.

Questions, requests, or a privacy complaint: hello@cauldron.studio. Legal notices: hello@cauldron.studio. By post: Allness Brands LLC, 1401 21st Street, STE R, Sacramento, CA 95811, United States.