How Retake Design handles data.

Google identity

Retake requests OpenID, email, and basic profile information for sign-in. It does not receive your Google password. The authentication service stores account links and server-managed sessions in Cloudflare D1.

Projects and browser storage

Project snapshots and workspace metadata are stored in Cloudflare D1 and accessed through account-scoped APIs. Image files are stored in Cloudflare R2. Browser storage caches designs and images for editing and recovery; keep the tab open until saving finishes to avoid losing unsynchronized changes.

Direct image links

Direct image URLs can be opened without signing in by anyone who has the link. An account-scoped project is not a guarantee that its image URLs are private. Avoid uploading sensitive material or sharing links you do not want others to access. Cached copies can remain available until their cache expires after the underlying file is deleted.

AI requests and usage

The server sends the prompt and image inputs needed for your selected AI action to the configured AI service providers. Provider and model identifiers, request IDs, token usage, cost, and Credit events are recorded for diagnostics and accounting. AI services process submitted inputs under their own data-handling terms. Do not include sensitive information that is unnecessary for your request.

Service emails

When transactional emails are enabled, Retake uses Resend to send account welcome messages and Credit purchase confirmations to your account email. These messages include the information needed for the notification, not your design prompts or image files. This does not subscribe you to marketing emails.

Payments

Checkout services process the payment and billing information you provide. Retake stores transaction references, subscription status, amounts, currency, and Credit records to manage access, reconcile payments, and handle support requests. Do not include payment-card details in design prompts or support messages.

Operational notifications

Retake may send registration and successful-payment summaries to a restricted operator-only Feishu group. These summaries use a masked email address and necessary transaction details such as amount, currency, and Credits granted. They do not include passwords, card details, design prompts, or image files. Notification delivery records support troubleshooting; message-body snapshots are removed from our delivery database after 30 days. Copies in the operator group are managed separately.

Product analytics

Google Analytics 4 uses advanced Consent Mode on production Public Site and Product routes. With Analytics storage denied, Google receives cookieless measurement signals for basic reporting and modeling; allowing Analytics storage enables first-party Analytics cookies. Page paths omit query parameters and replace private project identifiers with a route placeholder. Retake excludes Admin and does not attach prompts, files, project identifiers, card details, or direct identity to Analytics events.

Purchase measurement includes a de-identified transaction reference, a fixed plan or top-up identifier, currency and the confirmed amount. Test payments are recorded separately from real purchases.

Preferences and examples

The local build and automated tests do not send analytics events. Public Catalog examples are prepared product demonstrations, not customer uploads or testimonials.

Your choices and privacy requests

You can change optional storage preferences in Cookie settings, export designs from Canvas, and contact support about access, correction, or deletion of personal information. We may need to verify your account before handling a request. Clearing browser storage alone does not delete server-stored projects or billing records. Records needed for payment reconciliation, security, or legal obligations may need to be retained.

Contact

For support or questions about this notice, email support@retake.design. Never send passwords, verification codes, or full payment card details.