Privacy Policy

Account information

We store your email, display name, linked login provider and sessions to provide account access. Your password is stored as a secure hash. Registration verifies your email with a short-lived code. Later sign-ins use your email and password.

Photos and videos

A submitted reference photo is stored in private R2 storage and supplied to the configured generation provider only for your request. Uploads are retained for up to 24 hours. Completed videos are retained for up to 30 days unless deleted sooner.

Do not select photos without the subject’s permission. Spooky Season does not use submitted photos to train models; provider processing is limited to delivering the generation request under the provider’s terms.

Payments and records

Checkout is provided by Waffo. We store order identifiers, credit balances and refund records needed to operate your account. We do not store payment-card details.

Cookies and analytics

Essential cookies maintain your signed-in session. Browser storage preserves your draft within the current tab and remembers your theme preference.

We use Plausible, Google Analytics and Microsoft Clarity, when configured, to understand page usage and improve the service. Upload controls and account fields are masked from session recordings. We do not send photo names, passwords, verification codes or uploaded content as analytics events.

Your data rights

You may ask to access your personal data, receive a copy in a commonly used electronic format, correct inaccurate or incomplete information, or delete your personal data and close your account. Depending on applicable law, you may also request restriction of processing, object to processing, withdraw consent for future consent-based processing, and complain to your local data protection authority.

Email customer support using the Data rights request link below, preferably from the email address on your account. Tell us which right you want to exercise and provide any relevant task or order ID. We may ask for proportionate information to verify your identity; do not send a password, sign-in code or full payment-card details.

We respond within 30 calendar days, or within the period required by applicable law. If a lawful extension is needed, we explain the reason and expected response date. Withdrawing consent does not affect processing that was lawful before withdrawal.

You can delete completed video files from My videos. To remove uploaded photos sooner, correct account details, obtain your account data, or close your account, contact support. Signing out clears the current browser draft; you may also clear this site’s browser storage.

Deletion is subject to legal retention requirements. We may retain the minimum transaction, fraud-prevention, enforcement or dispute records required by law or needed to establish, exercise or defend legal claims. We explain any applicable exception when responding; retained records are not used to continue generating content for a closed account.

Safety and support records

We record the content-policy version and confirmation time when you submit a generation request. We may also retain the task identifiers, provider rejection outcomes and account enforcement decisions needed to investigate abuse, handle appeals and protect the service. Reports and data-rights requests are handled by the operator through the published support email; share only information needed to investigate your request.