Privacy Policy

Last Updated: July 23, 2026

Welcome to Wondershot (the “App” or “we”). We understand the importance of your personal information and are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information, and how you can manage your information.

Please read and understand this Privacy Policy carefully before using the App.

1. Information We Collect

1.1 Information You Provide

• Account Information: When you sign in with Google or Apple, we receive the provider’s account identifier and the profile information you authorize it to share, such as your email address, display name, or avatar. We do not receive your provider password.
• User Content: Photos you upload for AI processing and the generated result images.
• Feedback Information: Information you provide when contacting us via email or community channels.

1.2 Information Collected Automatically

• Device Information: Device model, operating system version, unique device identifiers.
• Usage Data: App feature usage frequency, preference settings.
• Log Information: App crash logs, error reports (excluding personally identifiable information).

1.3 Information We Do Not Collect

• We do not collect your contacts, messages, or call history.
• We do not collect your precise geographic location.
• We do not access your photo library without your knowledge.

2. How We Use Your Information

We use the information we collect for the following purposes:

3. Data Storage and Security

3.1 Storage Location

We use cloud infrastructure, object storage, content delivery, and AI providers that may process data in multiple countries or regions. The processing location depends on provider routing and service availability and may differ from your country of residence. We do not currently promise that all data from mainland China users remains in mainland China.

3.2 Retention Period

We retain your personal information only for the minimum period necessary to fulfill the purposes described in this Policy and as required by applicable laws and regulations. Unless otherwise required by law, we generally follow these retention rules:

• Account Information: Retained while the account exists. Account deletion removes the active account immediately and starts cloud-object cleanup; cleanup is normally completed within 24 hours and no later than 30 days. We retain one pseudonymous, non-profile claim marker solely to prevent the same sign-in identity from repeatedly receiving a one-time welcome bonus. The marker contains no email, name, avatar, photos, credit balance, or provider token and is retained only while this anti-abuse rule remains necessary.
• Uploaded Photos and Generation Inputs: Stored in private cloud storage while needed to queue, process, retry, or recover a generation job, then released when the job finishes or is cleaned up. A short technical retry window may apply.
• Generated Images and Template Assets: May be stored in cloud object storage and delivered through a CDN so the Service can display and recover them. They remain until you delete the account or they are otherwise no longer needed for the Service. Deleting an on-device copy from the local library does not by itself delete a cloud copy.
• Product Analytics and Service Logs: Retained only while reasonably needed to operate, secure, debug, and improve the Service, or until account deletion where they are directly associated with the account, subject to legal exceptions.
• Order and Transaction Information: We retain necessary transaction information as required by law for purposes including contract performance, reconciliation, taxation, and dispute resolution. The retention of such information does not change the nature of credits and membership services as virtual usage entitlements rather than stored-value funds.

3.3 Security Measures

We implement the following measures to protect your data:

• Transport security for supported HTTPS connections.
• Encryption-at-rest and security controls provided by our cloud and storage providers, plus additional application-level protection for selected sensitive fields.
• Access controls intended to limit production data access to authorized purposes.
• Dependency, configuration, and vulnerability review as part of our release and maintenance process.

No security measure can eliminate every risk. If we become aware of a qualifying personal-data incident, we will respond and notify affected users or authorities as required by applicable law.

4. Information Sharing and Disclosure

We commit to never selling your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We may share only the information reasonably necessary for the Service with third-party service providers. Because AI model routing, availability, pricing, and safety requirements may change, we may use different providers from time to time. These providers act only for the purposes described below and are not permitted to use your information for their own independent purposes unless their own terms and applicable law allow it and you have separately agreed.

We review our service provider categories periodically and may replace or add providers when reasonably necessary to operate, secure, improve, or scale the Service. Material changes in how we use or share personal information will be handled as described in the “Changes to This Privacy Policy” section.

4.2 Legal Requirements

We may disclose your information when required by law, government investigation, or to protect our or others’ legitimate interests.

4.3 Business Transfers

In the event of a merger, acquisition, or asset sale, your information may be transferred as part of the transaction assets. We will notify you before any such transfer.

5. Your Rights

Under applicable data protection laws, including GDPR (for EU residents) and CCPA (for California residents), you have the following rights:

5.1 Right of Access

You may request access to personal information we hold about you by contacting us at the address below. We may need to verify your identity before responding.

5.2 Right to Rectification

If you find that information we hold is inaccurate, you have the right to request correction.

5.3 Right to Erasure

You have the right to request deletion of personal information, subject to applicable legal exceptions. You can delete individual local creations in the app, use Profile → Delete account, or follow our account deletion instructions without signing in.

5.4 Right to Withdraw Consent

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

5.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used format.

5.6 Right to Lodge a Complaint

If you believe our processing activities infringe your rights, you have the right to lodge a complaint with the relevant supervisory authority.

6. Cookies and Similar Technologies

This App does not use cookies. We may use the following technologies:

• Local Storage: To save your app settings and preferences.
• Device Identifiers: To prevent fraud and abuse.

7. Children’s Privacy

This App is not intended for children under 13 (or the higher age specified in your jurisdiction). We do not knowingly collect personal information from children. If you are a parent or guardian and discover that your child has provided us with personal information, please contact us, and we will promptly delete such information.

8. International Data Transfers

Your information may be transferred to or processed in countries other than the country where you live. Where required, we use contractual, consent-based, or other legally recognized transfer mechanisms and take reasonable steps to assess providers and limit data to what is needed. If local law requires a separate consent or assessment for a transfer, we will seek it or restrict the affected processing as required.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Updated policies will be posted in the App with the update date noted.

For significant changes, we will notify you in advance through in-app notifications or other appropriate means. Continued use of the App constitutes your acceptance of the updated Privacy Policy.

10. Contact Us

If you have any questions, comments, or complaints about this Privacy Policy, please contact us:

• Email: support@wondershot.art
• Response Time: We will respond to your request within 15 business days

For EU Residents

If you are located in the European Union and have concerns about our data processing practices, you may contact your local Data Protection Authority.

For California Residents

California residents have additional rights under the CCPA, including the right to know what personal information is collected and the right to opt-out of the sale of personal information. As stated above, we do not sell personal information.

Privacy Contact / Data Controller Contact: Shanghai Chenxing HuiKe Technology Co., Ltd.
Email: support@wondershot.art

This Privacy Policy is effective as of July 23, 2026.