Privacy Policy

Account information

• Your email address, and whether it's been verified.
• A display name, if you set one.
• Which sign-in method you used, and the account identifier your provider (Google or Apple) gives us. We never receive your provider password.
• Sign-in sessions. The session token in your browser is stored on our side only as a hash — we can invalidate a session, but we can't read the token back.

Technical and anti-abuse information

• Your IP address — the most recent one on your account, and the one recorded with each design you generate.
• A browser fingerprint hash: a one-way hash of characteristics your browser reports. We use it to catch one person farming free credits across many accounts. It isn't reversible and we don't use it to track you across other websites.
• Standard server logs, including request identifiers and timestamps.

What you create

• The prompts you write, including the normalized version we run moderation against.
• Any template you customized and the values you filled into it, plus any style option you picked.
• Artwork you upload. Uploads land in a quarantined location, are re-encoded into a clean image file, and the original bytes you sent are discarded.
• The generated and processed images themselves, in private storage.
• The moderation record for each generation: which checks ran, what they decided, and — if something was refused — which rule it hit.
• Operational details of each generation: which model ran, what it cost us, and whether it succeeded.

Orders

• What you ordered, the amount, and the order's status and history.
• Your shipping address and contact details, which we pass to our print partner so they can ship to you.
• Payment confirmations from Stripe. Card numbers are entered on Stripe's own checkout page and never reach our servers.

Preferences and marketing

• Optional preferences: default size and color, a favorite team name, and prompts you save.
• Whether you opted in to marketing email. This is off unless you turn it on.
• How you first arrived at the site (campaign tags in the link you clicked), recorded once when you sign up so we know which channels work.

• To run the service: sign you in, generate designs, show previews, and keep your work available on your account.
• To fulfil orders: take payment, get your item printed and shipped, and handle support.
• To enforce our design rules and the law: screening prompts and images, and reviewing every purchased design before printing.
• To prevent abuse and fraud: rate limiting, spend limits, detecting duplicate accounts created for free credits, and defending payment disputes. This is what the IP address and fingerprint hash are for.
• To understand how the site performs in aggregate — how many people reach each step of the flow.
• To send you marketing email, only if you explicitly opted in.

We use a small number of cookies, and none of them are advertising cookies.

• A session cookie that keeps you signed in. It's HTTP-only, so scripts on the page can't read it, and it lasts 30 days.
• A short-lived cookie used during the sign-in handshake with Google or Apple.
• A campaign cookie recording how you first arrived, kept for 30 days and read once if you create an account.
• Cloudflare sets cookies to protect the site from bots and abuse, including when a challenge is shown.

For analytics we use a self-hosted copy of Umami. It counts views of public pages (the homepage, designs, the shop, the generator and upload pages, the blog) without advertising cookies and without following you onto other websites. It does not record account, checkout, order, login, or admin pages, and it does not keep order IDs, design IDs, or advertising click IDs from the URL. Campaign tags in a link you clicked (utm source / medium / campaign) are kept so we know which channels work. Country is recorded; city is not. We don't use Google Analytics, advertising pixels, or third-party ad networks, and we don't put sponsor placements on the site.

Do Not Track signals

If your browser sends a Do Not Track signal, Umami does not record a page view. Sign-in and security cookies still work — the site cannot run without them — and Cloudflare may still set cookies used to block bots. We don't follow you across other websites whether you send the signal or not.

We also have to tell you whether third parties can collect personal information about your activity across different websites when you use our site. They can't. The third parties we work with (listed in the next section) receive only what they need to do their specific job — take a payment, print an order, generate an image — and none of them track you across other sites on our behalf.

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We do rely on service providers to run the business, and they only get what they need to do their job:

• fal.ai — runs the image generation, background removal, and upscaling. Receives your prompt and, where relevant, your image.
• Anthropic — runs the classifier that routes your prompt to the right model and assists moderation. Receives your prompt text.
• Stripe — payment processing. Handles your card details directly under its own privacy policy.
• Printify and its print providers — printing and shipping. Receives your finished design and your shipping address. Orders ship blind, under our brand.
• Amazon Web Services — hosting, private image storage, and the email we send you.
• Cloudflare — sits in front of the site for security, bot protection, and delivery.

We may also disclose information if we're legally required to, to respond to a valid legal request, to enforce our Terms, or to protect someone's safety. If the business is ever sold or merged, account data may transfer with it — you'd be told before that changed anything about this policy.

• Account information: for as long as your account is open, and a short period afterwards.
• Generation records — prompt, moderation verdicts, IP, fingerprint hash — for at least one year. These are audit records: they're how we answer an intellectual-property complaint or a payment dispute months after the fact, so they outlive the design itself.
• Images: generated designs and uploads stay in private storage while your account is open, unless you delete them.
• Order and payment records: kept as long as tax, accounting, and chargeback rules require — typically seven years.
• Server logs: a short operational window, then discarded.

Whoever and wherever you are, you can:

• Ask for a copy of the personal information we hold about you.
• Ask us to correct anything that's wrong.
• Ask us to delete your account and your designs.
• Turn marketing email off at any time, from your account page or the unsubscribe link in any marketing email. Transactional email about an order isn't something you can opt out of while the order is live.

If you're in California, the CCPA/CPRA sets out rights to know, delete, correct, and to opt out of the sale or sharing of personal information. Those rules apply to businesses above certain size thresholds, and we're well below them — but we extend the same rights to you anyway, because the size of our company isn't a good reason for you to have less control over your own data.

We do not sell personal information, and we do not share it for cross-context behavioral advertising — so there is nothing for you to opt out of, though you're welcome to ask us to confirm that. We don't use or disclose sensitive personal information beyond what's needed to provide the service, and we won't treat you differently for exercising any of these rights.

To make a request, email support@boardsideapparel.com from the address on your account, or tell us which account it concerns so we can verify you. We'll respond within 45 days, and we'll say so if we need the extension the law allows. An authorized agent can make a request on your behalf with proof that you authorized them.

One limit worth being straight about: we can't delete records we're required to keep — completed order and payment records for tax purposes, and moderation records for a design that was refused. Everything else goes.

• There are no passwords on this site, so there's no password database to steal. Sign-in is handled by Google, Apple, or a one-time emailed link.
• Your images live in private storage that isn't publicly readable. Previews are served through short-lived links that expire.
• Traffic is encrypted in transit, and images are encrypted at rest.
• Session tokens are stored only as hashes, and you can sign out of other sessions from your account page.
• Administrative access requires a second factor.

No system is perfectly secure, but if a breach affects your personal information we'll notify you and the relevant regulators as the law requires.

This site isn't for children. You must be at least 16 to hold an account and 18 to place an order, and we don't knowingly collect information from children under 13. If you believe a child has given us personal information, email support@boardsideapparel.com and we'll delete it.

If we change what we collect or how we use it, we'll update this page and move the “last updated” date. Material changes get notice by email or on the site before they take effect.

Privacy questions and data requests go to support@boardsideapparel.com. You can also reach us through our contact page. This policy sits alongside our Terms of Service.