Privacy Policy
Last updated: July 28, 2026
Overview
ctr.so works without accounts. This policy explains exactly what data we handle when you generate thumbnails or buy credits, and what we never touch. Short version: no account, one essential cookie, payments handled by Stripe, images generated by fal.ai, nothing sold to anyone.
What we process
When you run a generation, your prompt and any reference images you attach are sent to our server and forwarded to fal.ai (our AI processing provider) to produce the image. We do not use your prompts or images to train models. Your IP address is processed transiently for rate limiting and abuse prevention; we do not build profiles from it. Generation history and generated images live in your browser's local storage. Clearing site data removes them, and we cannot recover them.
The credit wallet cookie
We set one strictly necessary cookie ("ctr_wallet") that stores your signed credit balance. It contains no personal information, no identifier used for tracking, and is required for the service to function, which is why it does not require a consent banner. It expires after one year. We set no analytics or advertising cookies.
Payments
Credit purchases are processed by Stripe, Inc. Your card details go directly to Stripe and never reach our servers; we receive only confirmation that a checkout was paid, the pack purchased, and Stripe's transaction identifiers, which we retain as required for tax and accounting. Stripe's own privacy policy applies to the payment itself.
Service providers
We share data only with the processors needed to run the service: fal.ai (image generation), Stripe (payments), our hosting provider (request handling), and, if you use the YouTube import feature, the YouTube Data API, whose queries are subject to Google's privacy policy. We do not sell personal information and never have.
Email signups
If you leave your email on our landing page, we use it only to contact you about ctr.so. Every message includes a way to opt out, and you can request access or deletion at any time.
Your rights
Depending on where you live (including under GDPR and CCPA/CPRA), you may have the right to access, correct, delete, or port personal data we hold, and to lodge a complaint with your supervisory authority. Because we keep almost nothing server-side, most requests are satisfied by clearing your browser data, but email us and we will handle whatever remains (e.g., purchase records) within 30 days.
Contact
Privacy questions and requests: hi@ineedleads.ca