Privacy notice
bitio.ai · Effective October 19, 2026
Account and Google sign-in
bitio.ai uses your Google account identifier, email address, email-verification status and display name to create and authenticate your bitio account, protect access to your creations, and administer account benefits. We verify Google's identity credential on our server. Google sign-in requests basic identity only; it does not give bitio access to Gmail messages, Google Drive files, calendars or your Google password. You can also register with email and a password; password accounts store a password hash.
Your creative content
We store briefs, prompts, creative settings, drafts, uploaded files and generated results when you use account-saving or enabled creation features. Some drafts and reference images remain only in your browser until you explicitly upload or save them to your account. Community submissions are separate: artwork, your chosen public alias and the notes or prompts you choose to share can become public after review. Private studio files are not automatically published.
Feedback and support
When you submit feedback, we store its title, category, messages, status and timestamps with your account. Your conversation is visible to you and authorized support staff. Replies are shown in the feedback page. Please do not include passwords or full payment-card details.
Service providers and payments
We use hosting and database services to run bitio.ai and Cloudflare R2 for private file storage. When you submit a task to an enabled AI service, the task instructions and required media are sent to the model provider, MiniMax for image/video/text tasks and fal.ai (Sync 3) for lip sync. We use Resend to deliver account verification and transactional notifications. These include your email address and, as needed, a verification link, task or payment status, credit or payment amounts, record references, and event times. We do not include private prompts or generated files in these emails. Payment checkout is handled by Stripe; bitio stores order, subscription and credit records rather than full card numbers. Google handles its account-selection and sign-in screens. These providers process data under their respective policies and may process it in countries other than yours. Google identity data is used for account functions, not as creative input to AI tasks.
Browser storage, cookies and logs
An authentication token is stored in browser local storage. Device drafts and reference files can use local storage, session storage and IndexedDB. Google sign-in uses a short-lived, secure, HttpOnly challenge cookie to protect the login request. Server access logs contain request paths, IP addresses, timestamps and response status for operation and security. We use Google Analytics 4 to understand page visits, tool usage, successful sign-ins, creation submission/delivery, result exports and checkout conversions. Google may use analytics cookies and browser/device information. We send normalized page paths and limited event metadata; private URL queries/fragments, prompts, creative content, email addresses and account identifiers are excluded. Confirmed checkout events include the order reference, product and amount. Advertising personalization and Google signals are disabled in our tag. Optional Vercel Web Analytics is disabled by default; when enabled, private URL query strings and fragments are removed before analytics events are sent. Third-party login and payment pages may use their own cookies.
Retention and deletion
Account records and cloud creations remain stored until removed through available controls or a verified support request. You can delete supported drafts and creations in the app and clear device drafts using your browser or the relevant editor. Revoking bitio's access in your Google account stops future Google authorization; it does not itself delete existing bitio records. For account or Google-derived data deletion, contact us from your account email. We may verify account ownership before acting. Transaction records, security records and backups can require separate retention; we will explain any applicable limitations when handling your request. Physical file deletion may follow after access is revoked because deletion jobs can retry.
Security and your choices
Account data and private files are delivered through authenticated access, and the site uses HTTPS. No storage or transmission method can eliminate every risk. Avoid uploading information you do not want processed, and obtain permission for other people's images or other content you submit. You can use email sign-in instead of Google, sign out, clear browser storage, or ask support about access, correction and deletion of your account data.
Contact and changes
For privacy questions or account-data requests, contact beacyaen@gmail.com and identify the bitio.ai account concerned without sending passwords or payment-card details. We may update this notice as the service changes; the date above identifies the current version.