Privacy

Your store and your footage

Your song starts from your store link and your email, nothing else. We make your ad from what is public on your site and in the ads you run, and use it only for your ads. To make a shot you do not have, some of it goes to the AI providers that run the models (Google and fal). If you start a yes on a private page and never save a card, we keep only the lines you picked, nothing about you.

A photo for a one-photo video is deleted 24 hours after you upload it. Before anything is made, the photo is sent once to our AI provider (fal, running a Google Gemini model) to check it is a product and not a person or unsafe content; we keep only the yes or no.

Your ads

Finished ads stay on your song page or order page so you can download them again. Email us to have them deleted.

Your email

The email you give us, to send your song and tell you where it stands, and any email you send us, to answer it. We do not sell it or share it for marketing.

Your ad account

Making your ads never needs access to your ad account, store or passwords. Only the monthly plan, if you pick it later, asks for read-only partner access in Meta Business Manager, to read the results of the ads we made, and you can say no. To see which free songs from a private page are still running, we look in Meta’s public Ad Library, never in your account.

Payments

Stripe handles payment. We never see your card number. When you buy the full ad, Stripe keeps your card on file so the 3 more can be added with one tap; it is charged only when you tap and they arrive. When you say yes on a private page we made for your brand, Stripe saves your card the same way, and it is charged only as the terms say.

Usage

A random session id in a cookie that ends when you close the browser, the pages you reached, and which ad or link brought you. Never your photos, your email or your name. To stop abuse, we keep a one-way hash of your connection address for 24 hours (7 days when you use Ask, to count your free questions).

Store X-ray

When you X-ray a store, we read that store's public pages and its review app's public numbers the way a browser would, only where its robots.txt allows. We keep the store's address and a one-way hash of your connection address for two days, to limit how many X-rays one connection runs. If you ask us to email an X-ray, we keep that email with the store's address until 30 days after we send it, and use it for nothing else.

Ads we made for a brand

When we make a free ad for a brand, it plays on a private page just for that brand. The page records when it is opened, when the ad is played or watched to the end, and which button is pressed. No cookie, no address, nothing about who is looking.

Who helps us

Cloudflare hosts the site and stores files. Stripe takes payments. Google Workspace and Resend carry email. Google and fal run the AI models.

Deleting your data

Email hello@cracked.app and we delete your orders, your ads and anything we gathered for them.