Privacy Policy

1. Who we are

UNKRE is an adult AI image studio operated by the UNKRE team. The operator of UNKRE is the controller of the personal data described in this policy. You can contact us at [email protected].

UNKRE is for adults only. We do not knowingly collect personal data from anyone under 18.

2. Data we collect

Account and sign-in data

• Google: the Google account identifier, verified email address, name and profile language, if you sign in with Google.
• Telegram: your Telegram user ID, username, first and last name, language code and profile photo URL, if you sign in with Telegram or the MiniApp.
• Account data: referral code, credit balance, account status, registration and last-activity timestamps.
• Authentication data: one-time login challenges, hashed refresh tokens and session cookies. We do not store your Google or Telegram password.

Generations and content

• Prompts and settings: the prompt, negative prompt, selected model or workflow, LoRA names and strengths, seed, aspect ratio and other generation settings.
• Reference photos: images you upload for a reference-based workflow. They are sent to the processing service to create the requested image.
• Generation records: status, timestamps, error messages, credit cost and the provider job identifier.
• Generated images: a temporary copy may be cached on our infrastructure so your browser can retrieve it. The cache is short-lived by design.
• Presets and library data: presets you save, including any preset you choose to make public, favorites and images stored in your browser’s local library.

Payments and credits

• Payment records: provider, purchased credits, amount, currency, status, invoice and transaction identifiers, and timestamps.
• Crypto payments: asset and blockchain codes, asset amount and fee, blockchain transaction hash and, where provided by the payment processor, the sender address.
• Telegram Stars: the Telegram payer identifier and Telegram payment charge identifier.
• Ledger: credit purchases, spends, refunds, adjustments and before/after balances. These records are needed to keep the balance correct and to meet accounting obligations.

Card payments through Telegram are handled by Telegram. We do not receive or store full card numbers. Crypto checkout is handled by ATLOS.

Analytics and technical data

Our first-party analytics records aggregate product events such as page views, CTA clicks, sign-up completion, generation start/completion and Core Web Vitals. The payload is deliberately limited to an event name, placement or preset identifier, a broad page path, device class, referral channel and, for Web Vitals, a metric value. It does not include prompts, images, user IDs, cookies or query strings. We respect the browser’s Do Not Track signal for these events.

Like most services, our servers and security layer may process IP address, user agent, request path, timestamps, response status and similar technical data for security, rate limiting, abuse prevention and troubleshooting.

3. Cookies and local storage

We use a small set of essential cookies. We do not use advertising cookies or third-party behavioral tracking cookies.

• cl_access_token — an HttpOnly session cookie used to authenticate your account. It is short-lived.
• cl_refresh_token — an HttpOnly cookie used to renew your session. It can last up to 30 days and is rotated when used.
• csrf_token — a readable security cookie used to protect state-changing requests against cross-site request forgery.
• Admin cookies — separate cookies for the local-only administration panel. They are not issued to normal visitors.

We also use browser storage for product functionality: a referral code may be kept in sessionStorage; drafts, display preferences and saved workspace data may be kept in localStorage; and completed images may be kept in IndexedDB so you can view them without downloading them again. The unkre.adult.v1 key records your 18+ confirmation, and unkre.reference-consent.v1 records that you accepted the reference-photo consent statement. This browser data stays on your device until you clear it or the site removes it. It is not sent to us unless you use a feature that requires it.

4. Why we use data

• To provide the service: authenticate you, generate images, keep your balance, show your history and deliver the features you request.
• To process payments: create invoices, confirm payments, credit your wallet, handle refunds and keep accounting records.
• To keep the service safe: rate-limit abuse, detect fraud or credential attacks, investigate reports and enforce our acceptable use policy.
• To improve the product: understand aggregate usage and performance without profiling you for advertising.
• To comply with law: respond to valid legal requests, tax and accounting rules, and enforce our Terms of Service.

Where data protection law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating and securing the service, compliance with legal obligations and, where required, your consent. You can withdraw consent at any time, without affecting processing that already happened.

5. Who processes data

We share only what is needed for the relevant service, with providers that are bound by their own terms and, where required, data processing agreements:

• Google — sign-in and account identity verification.
• Telegram — sign-in, MiniApp launch, the bot and Telegram Stars payments.
• ATLOS — crypto checkout and payment confirmation.
• Runpod — GPU processing of prompts and reference images to create the requested output.
• Our hosting, storage and security providers — running the site, the short-lived image cache, backups, email and network protection.
• Professional advisers and authorities — where necessary for legal, tax, accounting, fraud prevention or a valid legal request.

We do not sell personal data. We do not share it for cross-context behavioral advertising. If we are involved in a merger, acquisition or transfer of the service, data may be transferred as part of that transaction, subject to this policy and applicable law.

6. International transfers

Our providers may process data in countries other than yours. Where required, we use appropriate safeguards for those transfers, such as contractual protections or an equivalent legal mechanism. You can ask us for more information about the safeguards that apply to your data.

7. How long we keep data

• Account data: while your account is active. After a verified deletion request, we delete or anonymize it within a reasonable period, unless we must keep it for legal, accounting, fraud-prevention or dispute reasons.
• Generation records: until you delete the generation or your account, or for as long as needed for the service and abuse prevention. Deleting a generation also removes its temporary image cache where available.
• Temporary image cache: up to 24 hours by default. The exact period can be shorter. Your browser may keep its own copy until you clear the site’s storage.
• Payment and ledger records: for as long as tax, accounting, anti-fraud or financial rules require. These records may outlive your account.
• Authentication and security data: one-time challenges are short-lived; refresh tokens are rotated and stored as hashes; security logs are kept for a limited period and then deleted or aggregated.
• Analytics: aggregate events may be retained for product reporting. They are designed not to identify you.
• Support messages: for as long as needed to resolve your request and keep a record of the outcome.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data; to receive a portable copy; to withdraw consent; and to complain to your local data protection authority. You can also ask us not to use your data for direct marketing — we do not run direct marketing.

To exercise a right, email [email protected] with the subject [Privacy]. We may need to verify that you control the account. We aim to respond within 30 days, and we will tell you if we need more time. Deleting your account may not remove records we must keep for tax, accounting, fraud prevention or legal reasons, or content already saved in your browser.

9. Security

We use HTTPS in production, HttpOnly and SameSite cookies, hashed authentication tokens, access controls, rate limiting and short-lived image caching. No online service is completely secure. Use a strong, unique sign-in method, protect your Telegram and Google accounts, and contact us if you suspect unauthorized access.

10. Adult content and sensitive data

UNKRE is an adult service. Do not upload government identity documents, financial credentials, medical records or images of anyone under 18. Reference photos may depict an adult only if you have the right and consent to use them. We process them to create your requested image, not to build a public profile. See the acceptable use policy for the content rules.

11. Automated decisions

We may use automated checks for rate limiting, fraud prevention and abuse detection. These can temporarily block a request or account. We do not make solely automated decisions that produce legal or similarly significant effects without a way to contact us and ask for review.

12. Changes to this policy

We may update this policy as the product, providers or law change. The “last updated” date at the top shows the current version. If a change materially affects how we use personal data, we will take reasonable steps to make it visible before it applies.

13. Contact

Privacy questions and requests: [email protected]. General support and legal notices use the same address. You can also use the contact page.