1. About this policy
This policy describes how My Rap Duo handles data when you use the website, your account and its AI tools. Read it together with our Terms of Service.
2. Information we keep
- Account: your name, email address and avatar, and — if you sign in with Google or GitHub — the identifier that links that account. With email sign-in we store a salted password hash, never the password itself.
- Usage content: prompts, uploaded reference images, generated images and conversation text needed to show you your history.
- Billing: your plan, order references, amounts and credit history. Card details are collected by the payment provider (Stripe, Creem or Waffo) on its own checkout page; we never see them.
- Acquisition: on your first visit we record the campaign source, medium and name from UTM parameters, the referring website's domain (not the full URL) and the landing page, to understand how people find us.
- Security data: session records (time, IP address, browser) that keep you signed in and protect your account.
- Feedback: messages you send through the feedback box and our replies.
3. AI requests
Prompts and reference images are sent to the AI model provider that serves the request (through Vercel AI Gateway). Avoid including personal information that the task does not need. The provider's own terms also apply to that processing.
4. Service providers
We use Cloudflare for hosting, database and file storage, Resend for transactional email, Vercel AI Gateway for AI models, and Stripe, Creem or Waffo for payments. Each receives only the data needed for its part of the service. We may also disclose records where the law requires it.
If the operator enables payment notifications (for example to a Feishu group), the account email, plan, amount, order time, billing country and acquisition information of each payment are sent there for reconciliation. Card details and payment credentials are never included.
5. Cookies
- Session cookie — keeps you signed in.
- Preference cookies — your theme and language.
- First-visit cookie — a signed record of how you first arrived (see section 2), kept for up to 90 days and saved to your account when you sign up. Where no source was captured it is recorded as unknown.
We use privacy-friendly, cookie-less analytics where analytics are enabled at all.
6. Retention and deletion
We keep your data while your account exists. Hiding an image in your library only hides it from that view. Deleting your account from account settings removes your profile, content and credit history; payment records required for tax or accounting are kept for as long as the law requires.
7. Your rights
You can view and edit your profile, download all of your data as a JSON file and delete your account at any time. For correction, restriction or other requests, contact us — we may need to verify your identity first.
8. Security
Private files are only served to the signed-in owner. Secrets are stored encrypted or as platform secrets. No system is perfectly secure; please report suspected unauthorized access promptly.
9. Children
The service is intended for people who can lawfully hold an account and agree to its terms. Contact us if you believe a child has provided information.
10. Changes and contact
The date above identifies this version. For privacy questions: support@myrapduo.com.
Photos and generated videos
You must have permission from everyone shown in your photos. Do not upload photos of minors, celebrities, or anyone who has not consented. Videos are AI-generated and use original music. We are not affiliated with Migos, Quavo, Takeoff, COLORS or any artist. Original uploaded photos are deleted after 30 days; our generation provider may retain approved reference assets to perform generation. Photos and videos are private to their owner, except temporary signed image links that expire within one hour. You may delete videos or close your account. Contact support@myrapduo.com.
Product analytics uses a first-party visitor ID cookie named vid, valid for one year. We record page paths and actions such as choosing photos, generating, viewing offers and confirmed purchases. Analytics payloads do not contain your photos, lyrics or topic text. Events associated with your account are included in account export and deleted when your account is deleted.