Privacy Policy

1. Scope and who we are

This Privacy Policy applies to PicJSON, an image-to-structured-prompt app operated under moneybond.app, including the PicJSON iOS app, related analysis services, and the PicJSON product website. In this policy, “PicJSON,” “we,” “us,” and “our” refer to the PicJSON service operator.

PicJSON lets you choose a reference image, create an editable visual blueprint, and compile that blueprint into structured JSON for image and video models or workflows. PicJSON does not itself publish your reference image publicly.

2. Information we process

We process only the categories needed to provide, secure and support PicJSON. The exact information depends on the features you use.

The PicJSON website does not include advertising cookies, cross-site tracking pixels or third-party analytics scripts. A hosting or network provider may process ordinary request information, such as IP address, user agent and request time, to deliver and secure the website.

3. How and why we use information

We use the information described above to:

• provide the analysis, blueprint, editing, export and library features you request;
• create and maintain anonymous or Sign in with Apple accounts;
• process credits, subscriptions, purchases and purchase restoration;
• protect the service through rate limiting, attestation, moderation and abuse prevention;
• maintain reliability, investigate errors and respond to support requests;
• comply with law and enforce applicable terms.

Where data-protection law requires a legal basis, we rely on performance of our contract with you to provide PicJSON, our legitimate interests in securing and improving the service, consent where required, and compliance with legal obligations. PicJSON does not make legal, employment, credit or similarly significant automated decisions about you.

4. Reference images and AI processing

When you request an analysis, PicJSON prepares the selected image on your device, uploads it to protected private storage, and makes it available to our server-side analysis route. The app does not contain an OpenAI secret or a Supabase service-role key.

Our service sends the reference image and the minimum instructions needed for the requested analysis to OpenAI through its business/API services. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer explicitly opts in. Under OpenAI’s default API controls, abuse-monitoring logs may be retained for up to 30 days; particular endpoints or approved data-control configurations may differ.

Important: PicJSON removes the reference from its own temporary private image storage after processing. That deletion does not override a processor’s separate, limited security or legal retention described in its policy.

Generated blueprint data may be retained to provide your PicJSON library, edits and exports. You should only submit an image you are permitted to process. Avoid uploading highly sensitive images when they are not necessary for your creative task.

5. Anonymous use and Sign in with Apple

PicJSON can create a pseudonymous anonymous session so you can begin using the app without providing an email address. An anonymous session is tied to the local app installation and may not be recoverable after deletion, reset or device loss.

If you choose Sign in with Apple, Apple provides PicJSON with a stable account identifier and, only when you elect to share them, a name or email address. Apple may provide a private relay address instead of your personal email. We use this information to maintain your account, protect permanent purchases and support restoration across compatible devices.

6. Purchases, subscriptions and credits

Apple processes App Store payments. PicJSON uses RevenueCat to validate purchases, maintain entitlement status and support purchase restoration. RevenueCat may receive a PicJSON app-user identifier and purchase history such as product, transaction, renewal and entitlement events. PicJSON does not receive or store your full credit-card number.

Some transaction and credit-ledger records must be retained for accounting, fraud prevention, refund handling, idempotency and legal compliance even after other account data is deleted. You can manage or cancel Apple subscriptions through your Apple ID subscription settings.

7. Service providers and disclosures

We disclose information to processors only as needed to operate PicJSON, or when required by law. Core providers include:

• SupabaseAuthentication, database, private storage and server-side functions. Privacy
• OpenAIReference-image analysis and structured blueprint generation through API services. Privacy
• RevenueCatApp Store entitlement and purchase validation. Privacy
• AppleApp distribution, payment, Sign in with Apple and App Attest. Privacy

We may also disclose information to professional advisers, authorities or a successor entity when reasonably necessary for legal compliance, protection of rights, a corporate transaction or service security. We do not sell personal information and do not share it for cross-context behavioral advertising.

8. Retention and deletion

Reference images

Reference images in PicJSON’s private temporary storage are deleted after the requested processing finishes. A temporary item may remain briefly if deletion needs to be retried after an infrastructure failure. Processor security retention may apply as described in Section 4.

Blueprints and local projects

Local projects remain on your device until you delete them or remove the app. Blueprint and job records held for account/library features remain until you delete the relevant item or account, subject to backups, security needs and legal retention.

Accounts, security and transactions

Account and entitlement information is retained while your account remains active. Short-lived security and rate-limit data is kept only as long as operationally necessary; transaction, fraud-prevention and compliance records may be retained longer where required. Backup copies are isolated and expire through normal backup rotation.

Deleting the app from a device does not by itself delete server-side account or purchase records. To request account and server-data deletion, use the contact process below.

9. Security and international processing

PicJSON uses private object storage, access controls, row-level authorization, transport encryption, server-side secrets, App Attest, moderation, rate limiting and idempotency safeguards. Access is restricted to the functions and providers needed to deliver the service. No online system is perfectly secure, so we cannot guarantee absolute security.

Our providers may process information in countries other than the one where you live. Where required, we and our providers use appropriate contractual or legal transfer safeguards. Provider locations and safeguards may change as their infrastructure evolves.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent, and complain to a data-protection authority. These rights can be subject to lawful exceptions.

• Delete individual local blueprints or projects inside PicJSON where that control is available.
• Manage Sign in with Apple access from your Apple ID settings.
• Manage or cancel subscriptions from Apple’s subscription settings.
• Request access, correction, account deletion or another privacy action through support.moneybond.app.

We may need to verify the request using your account or purchase information. We will respond within the period required by applicable law. If you are unhappy with our response, you may contact your local privacy regulator.

11. Children’s privacy

PicJSON is a creative productivity tool and is not directed to children under 13 or the minimum age required by local law. We do not knowingly collect personal information from a child below that age. If you believe a child submitted personal information, contact us so we can investigate and delete it where appropriate.

12. Changes to this policy

We may update this policy when PicJSON, our providers or legal requirements change. We will publish the revised policy here, update the “last updated” date, and provide additional notice in the app when a change is material and the law requires it.

13. Contact and privacy requests