Privacy Policy

Last updated: July 4, 2026

What we collect

Account: your email address (used for sign-in and account messages) and plan tier.
Usage: a record of each image generation (when, what kind) to enforce your plan's monthly allowance.
Content you provide: logos and photos you upload, the text you enter (team names, scores, headlines), and the graphics you generate — stored so your library, history, and re-editing work.
Technical basics: standard web server logs (IP address, request path) kept for security and debugging.
Anonymous analytics: page visits, referral source, device/browser type, country-level location, and product interactions used to understand and improve the service.

We do not run third-party advertising, and we don't sell your data.

How content is processed

To generate a graphic, the inputs you provide (logos, text, settings) are sent to the AI image providers we use — currently OpenAI and Google — under their API terms. Sign-in and usage records are stored with Supabase (hosted Postgres). Anonymous website and product analytics are processed by Plausible Analytics. Account emails are delivered via Amazon SES. If you start a paid plan, payments are processed by Stripe; we never see your card number.

Student names and youth sports

Graphics often include student-athlete names, jersey numbers, and photos that you choose to include. You are responsible for having permission to use them (school media policies vary). We don't knowingly collect accounts from children under 13; if you believe a child has created an account, contact us and we'll remove it.

Cookies

We use only the cookies needed to keep you signed in (session cookies). Plausible Analytics does not use analytics cookies, and we use no advertising cookies.

Retention & deletion

Saved graphics and favorites are kept while your account is active (with per-account caps; the oldest items are pruned automatically). Working session files are deleted automatically after about 48 hours. To delete your account and stored content, use the contact form or email projects@teampostkit.com — we'll complete deletion within 30 days.

Security

Traffic is encrypted (HTTPS), sign-in is handled securely, API keys for the AI providers stay server-side, and access to stored data is restricted. No system is perfectly secure; we'll notify affected users of any breach as required by law.

Changes & contact

We'll update this page when practices change and note the date above. Questions or requests: contact form or projects@teampostkit.com. Service operated by Team Post Kit, Utah, USA.