Privacy Policy
Effective 24 August 2026
We never train AI models on your content, we run no analytics or advertising trackers, and your provider API keys are encrypted and never leave our servers.
This policy describes what we collect, why, who else touches it, and what you can demand of us. It is written to be read rather than to be defensible, and we have tried to be specific where most policies are vague.
1Who we are
aBuck is operated by Accolade Imaging Incorporation, a company incorporated in Ontario, Canada, with its registered office at 9316–9580 Yonge Street, Richmond Hill, Ontario L4C 1V6, Canada. We are the organization accountable for the personal information described here.
Questions about this policy, or a request to exercise any right described below, go to the Privacy Officer at support@abuck.app.
2What we collect
We collect only what the product needs to function. There is no marketing pipeline behind it.
| Data | Why we hold it |
|---|---|
| Email address, name | To create your account, sign you in, and match a paid subscription to an invite. |
| Password | Stored only as a salted hash. We cannot read or recover your password. |
| IP address, browser user agent | Recorded against each session so you can be signed in securely and so we can investigate abuse. |
| Canvases, prompts, node settings | The documents you build are your work product. We store them so you can come back to them. |
| Uploaded and generated media | Images, video and audio you upload or generate, stored as files so the canvas can display them. |
| Provider API keys | Encrypted at rest. Used only to call the AI provider you connected, on your instruction. |
| Subscription status | Whether your subscription is active, so we know whether to grant access. Card details never reach us. |
3What we do not collect
We think the absence of things matters as much as the list above, so it is stated explicitly:
- No analytics. We run no Google Analytics, Amplitude, Mixpanel, PostHog or equivalent, and we do not know which pages you visit.
- No advertising or marketing pixels, no retargeting, no affiliate tracking, and no data brokers.
- No session recording, heatmaps or screen replay.
- No biometric information. We do not run face recognition, face matching or any biometric analysis over your uploads.
- No cross-site tracking cookies of any kind. See the Cookie Notice for the complete list of what is stored in your browser.
4We do not train AI models on your content
Your prompts, uploads and generated outputs are never used to train, fine-tune, evaluate or improve any machine learning model, ours or anyone else's. We do not operate model training infrastructure and we do not licence, sell or share your content with anyone who does.
We do not read your canvases. Staff access to your content happens only in the narrow cases described under Security below, and never for product development or dataset building.
This is a commitment about our own processing. Generation itself happens at the AI provider you connect, under your own account and their terms — see the next section.
5How your content reaches AI providers
aBuck is bring-your-own-key. You connect your own OpenRouter account, and generation is billed to you by them at their list price. We add no markup and we do not resell inference.
When you run a node, the prompt text and any input media for that node are transmitted to OpenRouter, which routes the request to the specific model provider you selected. That provider receives your input and returns the output. We pass it through and store the result against your canvas.
This means your content is also handled by OpenRouter and by the model provider you chose, under their privacy policies and data-retention practices, not ours. Those practices vary meaningfully between providers — some retain prompts for abuse monitoring, some train on API traffic unless you opt out. Your OpenRouter account settings control much of this. If a particular provider's retention matters to you, check it before selecting that model.
A small number of features call services using our key rather than yours: voice and music generation through ElevenLabs, and stock media search through Pexels. Those requests carry the text or search term you entered.
6How we use your information
Under Canadian law we rely on your consent, given when you create an account and use the features described. Where the GDPR applies, our legal bases are performance of our contract with you, our legitimate interests in securing the service, and compliance with legal obligations. We do not rely on legitimate interests for any form of tracking, because we do none.
- To operate the product: authenticate you, store and sync your canvases, serve your media, and run the generations you ask for.
- To take payment and manage your subscription through Stripe.
- To keep the service secure and available: rate limiting, bot mitigation, debugging errors, and investigating abuse or suspected fraud.
- To communicate with you about your account and to respond when you contact us.
- To meet our legal obligations, including tax and accounting records.
7Who else processes your information
We use a deliberately short list of service providers. Each acts on our instructions and receives only what it needs.
| Provider | Role | Data involved |
|---|---|---|
| Cloudflare | Hosting, database, media storage, CDN, bot mitigation | Everything in the product, including your account, canvases and media files. |
| OpenRouter | AI model routing, on your own key | Prompts and input media for the generations you run. |
| Model providers you select | Running the model, reached via OpenRouter | Prompts and input media for that specific request. |
| Stripe | Payments and receipts | Your email and payment details, which you give to Stripe directly. We receive only subscription status. |
| ElevenLabs | Voice and music generation | The text or prompt for that specific request. |
| Pexels | Stock media search | Your search term. |
8Disclosure for legal reasons
We may disclose personal information where we are legally required to, to comply with a valid legal process, to enforce our Terms, or to protect the rights, safety and property of our users, the public or us. If our business is sold or reorganised, information may transfer as part of that transaction, subject to this policy.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either.
9How long we keep it
- Canvases, projects and uploaded media: for as long as your account is open, until you delete them.
- Media that is no longer referenced by any canvas: deleted from storage after a grace period of 30 days.
- Uploads that were started but never completed: cleared after 24 hours.
- Sessions: expire automatically, and you can sign out to end one immediately.
- Provider API keys: held until you disconnect the provider or delete your account, whichever comes first.
- Account records: deleted when you delete your account. Your projects, canvases and asset records are removed at the same time, and the underlying media files are purged by the next scheduled cleanup.
- Billing and tax records: retained as long as Canadian law requires, independently of account deletion.
10Security
Provider API keys are encrypted before they are written to the database. Once saved, a key is never returned to your browser and never written to logs — only the last four characters are ever displayed, so you can tell which key is connected. Passwords are stored as salted hashes. All traffic runs over TLS.
Administrators can suspend an account and, for support purposes, sign in as a user. When that happens it is recorded against the session. We use it to resolve support problems, not to browse your work.
No system is perfectly secure. If a breach affects your personal information we will notify you and the relevant regulators as the law requires, including under PIPEDA's breach reporting obligations.
11Where your information is processed
We are based in Canada, but our infrastructure runs on Cloudflare's global network and our payment, AI and media providers are largely based in the United States. Your information will therefore be stored and processed outside Canada, including in the United States, where it may be accessible to courts, law enforcement and national security authorities under the laws of those jurisdictions.
Where personal information is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses or the UK Addendum, as applicable, together with Canada's adequacy status for commercial organizations.
12Your rights in Canada
Under PIPEDA you may ask for access to the personal information we hold about you, ask us to correct it if it is inaccurate, and withdraw your consent to our processing — noting that withdrawing consent for the essentials means we can no longer provide the service.
If you are in Quebec, Law 25 additionally gives you the right to receive your information in a structured, commonly used technological format, and the right to be informed of, and to object to, any decision based exclusively on automated processing. We make no automated decisions about you.
Write to support@abuck.app and we will respond within 30 days. If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada, or to the Commission d'accès à l'information du Québec if you are in Quebec.
13Your rights in Europe and the United Kingdom
If the GDPR or UK GDPR applies to you, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing. Where we rely on consent, you may withdraw it at any time. You may also lodge a complaint with your local supervisory authority.
To exercise any of these, write to support@abuck.app.
We do not currently appoint an Article 27 representative in the European Union or United Kingdom. If you are an EU or UK resident and need to reach us about your data, contact us directly at the address above and we will handle your request as though it had come through a representative.
14Your rights in the United States
Residents of California, Virginia, Colorado, Connecticut, Texas and other states with comprehensive privacy laws have the right to know what personal information we collect, to access and delete it, to correct inaccuracies, and to opt out of sale, targeted advertising and profiling.
We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use it for profiling or targeted advertising, so there is nothing to opt out of. We honour the Global Privacy Control signal by default, which costs us nothing because we set no advertising or analytics cookies at all.
We will not discriminate against you for exercising any of these rights.
15Children
aBuck is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.
16Changes to this policy
If we change how we handle personal information we will update this page and move the effective date. For any change that materially reduces your protections — and in particular any change to the commitment not to train models on your content — we will notify account holders before it takes effect.
17Contact
Privacy Officer — support@abuck.app
Accolade Imaging Incorporation, 9316–9580 Yonge Street, Richmond Hill, Ontario L4C 1V6, Canada