Private photos. Sharing by choice.

Account and creation information

Sign-in processes your email or identity information returned by Google and uses necessary session cookies. Drafts store the template, parameters, quote and photo checks. Submitting a photo processes private inputs, generation prompts and results. Orders, point entries and feedback support delivery, reconciliation and issue handling.

Local previews and cloud storage

A photo chosen before you sign in is previewed on your device only and is not uploaded. Local copies can restore a photo within 10 minutes; expired copies are removed on your next visit, and you can remove them yourself. Uploaded photos are orientation-corrected, stripped of metadata and converted to static images. The hair and look advisor measures your face on your device with MediaPipe (face proportions, head angle, light) and crops the photo to head and shoulders there; only the cropped photo and those numbers are uploaded, never the original. The professional headshot set likewise measures your face on your device and crops the photo to your upper body before uploading it.

Uploaded photos expire 7 days after upload (a Listing Kit's product photo and cut-out product, 30 days), after which they cannot be accessed. Temporary uploads use a one-day cleanup threshold. Finished work, meaning every page, composite page, PDF and image of a complete set or set and every single-style result, is kept until you delete that work; closing your account deletes all of its work with it. Watermarked free previews and images made for unpaid drafts are kept for 7 days. Calendars, wedding stationery and editorial posters can have their words changed free for 30 days after delivery, and baby birthday kits for 90; the words submitted for a change are kept with the task until you delete it. The hair and look advisor keeps the photo of a free analysis for 1 day and the analysis (neutral notes such as face shape and hair type, and the suggested directions) for 30 days. An effect photo that fails the check before delivery is never delivered; it is kept privately for 7 days only so a person can review whether the check was right, and goes when you delete the work; the professional headshot set treats a headshot that fails its check the same way. Access ends at expiry; physical deletion runs in batches and may occur later.

Service providers

Cloudflare provides runtime, storage and image processing. Generation sends the processed photo and prompt to OpenAI. Safety checks also send these inputs and the generated result to OpenAI. The hair and look advisor’s free analysis and its check before delivery, and the professional headshot set’s and the baby birthday party kit’s upload checks and checks before delivery, send your photo (and, for the checks before delivery, the result) to OpenAI. The portrait calendar’s upload check sends your photo to OpenAI. The Listing Kit cuts the product out of your product photo with Cloudflare Images and sends the product photo (and, for its checks, the finished images) to OpenAI for the upload check, the images, the scene, close-up and copy checks; a translation draft sends your title and selling points to OpenAI. Resend delivers verification and opted-in notification emails. Google sign-in and available WeChat payments involve those providers when you use them.

Providers handle data under their own rules. Picfork file-cleanup periods do not specify third-party retention. We do not infer zero retention or a particular processing region from our own cleanup policy.

Underlying AI models

Generation and safety checks call OpenAI models: OpenAI GPT Image · gpt-image-1.5; OpenAI GPT Image · gpt-image-2.5-sunburst for image generation, OpenAI Omni Moderation · omni-moderation-2024-09-26 for content safety checks and OpenAI GPT-5.6 Sol · gpt-5.6-sol to recognize the pet in an uploaded photo, to draft a story book's words, to analyze a photo for the hair and look advisor and check its results before delivery, to check the professional headshot set's, the baby birthday party kit's and the Listing Kit's photos at upload and their results before delivery, to check the portrait calendar's photo at upload, and to draft the Listing Kit's copy in another language. These are the full model names used in our calls, not shortened.

Create and the template catalog label the model each template actually uses. Beyond those models, we do not send your photo, prompt or generated result to any other model provider.

Children's photos (Baby Birthday Party Kit)

The Baby Birthday Party Kit is the only part of the site that takes a child's photo, and only of a child aged 0–3. Only a parent or other guardian may upload it: before uploading you confirm, separately, that you are the child's guardian and agree to how the photo is handled as set out here. If you do not agree, you simply cannot use this kit; nothing else changes. We record when you confirmed, in which language and which version of the text, and nothing more.

We take one photo and the words you enter for the layout (name, date, place and so on). We accept only photos of one clothed child; others are declined and nothing is charged. Your device measures the size of the faces in the photo with MediaPipe, and that never leaves your device; we do not extract or keep face features on our servers.

The photo is used only to make this kit: it is sent to OpenAI (United States) for the safety check, the upload check, the drawings and the check before delivery. It is never public, cannot be shared or sent as a gift link, is never used as a sample, and we do not use it to train models. The photo is deleted after 7 days; the finished kit is kept until you delete it, and its words can be changed free for 90 days after delivery. You can delete it at any time from the result page, and access ends at once.

You can ask to see, correct or delete your child's information, or withdraw your consent, at the contact address below; after a withdrawal we delete the photo and kit if they still exist. Photos are stored with Cloudflare, encrypted at rest.

Photos of people (portrait calendar)

The portrait calendar paints the one or two adults in a photo into every month. Before uploading you confirm, separately, that everyone in the photo agrees to your using it for the calendar; we record when you confirmed, in which language and which version of the text, and nothing more.

After upload we check that the photo shows the number of people you chose, that every face is clear and that everyone is an adult; other photos are declined and nothing is charged. The photo is sent to OpenAI (United States) for this check, the safety check and the drawings; we do not extract or keep face features on our servers, and we do not use the photo to train models.

The photo and the calendar are private by default; the photo is deleted after 7 days and the calendar is kept until you delete it. Others see the calendar only if you publish a share or create a gift link; do so only if the people in it agree too. Anyone in the photo can ask for deletion at the contact address below; once verified, we delete the photo and calendar if they still exist.

Brand characters (brand character design)

Your brand name, brief and English name are safety-checked first, then sent to OpenAI (United States) to plan the character; an attached logo, sketch or product photo, the candidate you pick and every image drawn are sent to OpenAI for safety review, drawing and the checks before delivery (the same character, the title spelled right). None of it is used to train models. Photos of real people are not accepted.

A brand character is a lasting asset: your pick, master image, kit sheets, palette and character description stay until you delete the character in My characters or close your account. Deleting makes them unavailable at once and removes the files; it cannot be undone.

Your brief and attachments are used only for that character; candidates and content images are private by default and kept until you delete them, like other work.

Sharing and deletion

Photos and results are private by default. Publishing a share creates a separate watermarked copy accessible to anyone with the link. Published copies remain accessible while shared. Revoke shares you no longer want public.

A whole book can be given as a gift link: once you confirm, we keep a web-resolution copy of every page (no watermark, including the photos and words in the book) that anyone with the link can view without signing in. These copies are kept until you close the link or delete the book; we record only how many times and when the link was opened, never who opened it.

Revocation or task deletion immediately ends the corresponding access; background cleanup removes files. Task deletion also clears personal inputs and prompt snapshots, while necessary order, points, dispute and audit records remain. Downloaded copies and third-party caches cannot be recalled.

Content safety records

Photos and prompts are checked before generation; results are checked before delivery. Records contain the task reference, content hashes, model and policy versions, verdicts and scores, request identifiers and timestamps, without extra photo or prompt copies. Records are cleaned in batches after 30 days and removed when the task is deleted. Blocked results cannot be downloaded or shared and are cleaned up in the background after task failure.

Automated checks can make mistakes and cannot establish copyright or likeness permissions or detect every impersonation. Use the email below with a task ID, public link and explanation to request review or report abuse. Do not include passwords, verification codes or unnecessary original photos.

Public image review records

Public watermarked images are sent to OpenAI for periodic safety review. This review does not read private originals or prompts. Records contain task references, image hashes, share versions, model and policy versions, decisions, request identifiers and timestamps; no extra image copies are stored.

General review records are cleaned in batches after 30 days. Evidence for a current sharing restriction remains until the restriction is lifted or the work is deleted. Task deletion erases the associated review records. After human restoration, the relevant image hash and policy version are kept to prevent repeat automated removal under the same policy; later reviews may update this marker and task deletion clears it.

Content reports and decisions

Reports store the reporting account reference, category, explanation, internal work reference and image hash, decision and necessary operation records. Reporters see their own reports and decisions; creators see sharing restrictions and their explanation. Internal review notes are not disclosed to other users. Do not include unnecessary personal information.

Sharing appeals separately retain the account and task references, the relevant restriction and original explanation, appeal details, decisions and necessary audit records. Creators see only their own appeals; internal evidence is not public. Closed appeals are retained for 30 days before batched cleanup; pending cases remain until resolved. Deleting a work does not immediately erase submitted appeals.

Pending reports remain until resolved. Closed reports are retained for 30 days and then cleaned up in batches. Revoking or deleting a work does not immediately erase submitted reports or restore removed links. Cleaning report records does not lift sharing restrictions; lifting requires appeal approval. Deleting the work clears its public decision text. Reporting does not create extra image copies.

Operational records and measurement

The service keeps necessary security, error and task-processing records and short-lived abuse-prevention markers. Optional visit and entry-event metrics collect fixed aggregate dimensions only when enabled, without visitor-tracking cookies. Those aggregates use 30-day retention with batched cleanup. Task-related business and financial records are stored separately.

Completion emails are off by default. Only an explicit subscription sends a result-page link to your linked, verified email.

Your requests and record retention

You can delete tasks and revoke shares yourself, or ask to see, correct or delete your information, or to close your account, at the contact address below. We first verify the request’s connection to the account.

Account details, orders, point entries and audit records are not subject to the 7-day photo expiry: they support delivery, reconciliation and disputes, and are kept while your account exists. When you close your account, we delete the personal information we can; order and financial records that law, tax rules or payment providers require us to keep are kept for that period and then deleted.