Privacy Policy
Effective: November 6, 2026 · FunMix
This Privacy Policy explains how (TBD) ("we", "us") collects, uses, and shares personal information when you use FunMix (the "Service"), and the choices and rights you have.
1. Information we collect
| Category | What | Why | How long we keep it |
|---|---|---|---|
| Account | Google account ID, email address, and name and profile photo if Google provides them | Sign-in, identifying your account, support | Until you delete your account |
| Service records | Credit balance and history; record of your agreement to these policies (version, date, age confirmation) | Running credits, proving consent | Until you delete your account |
| Purchases | Order ID, credit pack, amount, currency, dates, and Stripe payment reference. Card details go directly to Stripe — we never see them. | Payments, refunds, taxes, fraud and dispute handling | 7 years, including after account deletion (tax and accounting law) |
| Abuse prevention | A one-way keyed hash of your email (not the email itself) | Preventing repeat sign-up bonuses | 1 year from the bonus |
| Invitations | The email address of someone we invite, with when it was sent and whether they signed up | Sending a one-time invitation email and letting the invited person create an account | 90 days from the last invitation email |
| AI inputs | Furniture you select, preferences and text you enter, and photos you upload | Generating ideas, guides, and product recognition | Not stored on our servers. Sent to our AI provider to produce a response (see §3). |
| Technical | IP address, browser and device information | Rate limiting, security, troubleshooting | IP addresses for rate limiting are held in memory for about a minute; hosting logs follow our host's retention |
Please keep faces and personal details out of photos. We don't try to identify people in photos.
2. How we use information
- To provide the Service, including sign-in, credits, purchases, and refunds
- To keep the Service secure and prevent fraud and abuse
- To meet legal, tax, and accounting obligations
- To respond to your requests and support questions
We don't sell your personal information or share it for cross-context behavioral advertising. We don't show ads, use tracking cookies, or make decisions about you that have legal or similarly significant effects based solely on automated processing. We don't use your inputs to train AI models.
3. Service providers
We share information only with providers that process it on our behalf under contract:
| Provider | Purpose | Information |
|---|---|---|
| Google LLC — Firebase | Sign-in and database | Account, service records, purchases |
| Google LLC — Gemini API | Generating AI Output | AI inputs, including photos. Under Google's paid API terms, inputs aren't used to improve Google's products and may be kept briefly for abuse monitoring. |
| Stripe, Inc. | Payments, refunds, tax calculation | Order ID and amount; Stripe collects your payment details directly |
| Resend (Plus Five Five, Inc.) | Sending invitation emails | Invited email address and the invitation message |
| Vercel Inc. | Website hosting | Technical information |
We may also disclose information if required by law, or to protect the rights and safety of users or the public.
4. Where information is stored
Our database is located in the United States. Our other providers process information in the United States and other countries where they operate. Information stored outside your country may be accessible to courts and authorities there under local law. By using the Service, you understand your information will be transferred to and processed in these locations.
5. Your rights and choices
- See and delete: your credits and purchases are shown on your account page, and you can delete your account there at any time.
- Access, correction, deletion, portability: email (TBD). We'll verify your identity and respond within the time required by law (generally 30–45 days).
- Withdraw consent: you can stop using the Service and delete your account. We'll keep only what the law requires (such as payment records).
- No discrimination: we won't treat you differently for exercising your rights.
- Authorized agents: where the law allows, you can have an agent make a request on your behalf.
6. California residents
In the past 12 months we collected these categories under the CCPA/CPRA: identifiers (account ID, email, IP address); commercial information (purchases); internet activity (technical information); and visual information (photos you choose to upload, which we don't store). Sources are you, your device, Google sign-in, and Stripe. We use them for the purposes in §2 and disclose them only to the service providers in §3. We don't sell or share personal information and don't use or disclose sensitive personal information for purposes that require a right to limit. Because we don't sell or share, there is nothing to opt out of; we also treat Global Privacy Control signals as a request not to sell or share. You have the rights to know, delete, and correct, as described in §5.
7. Canadian residents
We handle personal information under PIPEDA and applicable provincial laws, including Québec's Law 25. Our person in charge of the protection of personal information is (TBD), reachable at (TBD). If you're not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Québec, the Commission d'accès à l'information (cai.gouv.qc.ca).
8. Other U.S. states
Depending on where you live, you may have similar rights to access, correct, delete, and port your information, and to appeal our decision on a request. Email (TBD) to make a request or appeal.
9. Children
The Service is only for people 18 and older. We don't knowingly collect information from children. If you believe a child has given us information, contact us and we'll delete it.
10. Cookies and local storage
We don't use advertising or analytics cookies. Your browser stores your sign-in session (Firebase) and the ideas you save on your device. Stripe's checkout page may use its own cookies for fraud prevention. You can clear this data in your browser settings.
11. Security
We use encryption in transit (HTTPS), server-only database access, and least-privilege access to keys and credentials. No system is perfectly secure, and we'll notify you and regulators of a breach where the law requires.
12. Changes
We'll post updates here. For material changes we'll notify you in advance and ask you to review the updated policy before you continue using the Service.
13. Contact
(TBD) · (TBD) · (TBD)
Version 2026-11-10-invites