Privacy
What we store, where it goes, how long it stays, and how you delete it. This page lists the actual columns and files, not a category.
Last updated 2026-10-15
Wardrobe Gone Wild is a service operated by Maestrale Capital Corporation, a Washington corporation ("we", "us"). This policy explains what personal data we hold, why, who receives it, how long we keep it, and your rights. The terms of service set the contractual rules.
What we store
| Data | Why | How long |
|---|---|---|
| Email address | Sign-in, password reset, billing receipts | Until you delete the account |
| Username | Shown to you in the studio | Until you delete the account |
| Password, hashed | Sign-in. We never hold the password itself. | Until you delete the account |
| Plan, credits used, billing period | Enforcing the monthly allowance | Until you delete the account |
| Your prompts and run settings | Rendering the run and showing your history | Until you delete the run or the account |
| Rendered images | Delivering the pictures back to you | 7 days, then deleted automatically |
| Reference images you upload | Used as the starting picture for an edit or an enlargement | 7 days, with the run |
| Style files you upload | Applying your custom style to your renders | Until you delete the style or the account |
| Payment records | Billing a subscription: the payment processor's customer and subscription identifiers, the plan, the payment status and the dates of each period. We never receive or store a card number. | Until you delete the account; payment records that tax and accounting law requires are kept for the period that law sets |
| Device and network details | Preventing abuse of the free allowance and enforcing bans: at sign-up and sign-in, the IP address, the approximate place and the network provider derived from it, the browser and its version, the languages, the time zone, and a summary of the screen and hardware the browser reports | Until you delete the account |
| Consent confirmations | Your confirmation, for each edit of an uploaded picture, that the person shown is you or authorized the change, with the run it belongs to | With the run's moderation record |
| Age screen results | The age estimates of the automated check for each uploaded picture and each rendered picture, and every refusal with its estimate | With the run's moderation record; refusals stay with the account |
| Removal requests | Handling a request to remove intimate imagery: the name, email address and phone number of the requester, the request text, what we removed and when, and a fingerprint (hash) of each removed file, so an identical copy can be found and refused later | The request for as long as we need it to handle the request and as the law requires; the file fingerprints are kept |
| Feedback and support messages | Answering the report. They carry your message, the page address and the browser identification string. | Kept after account deletion, with the link to your account removed |
| Sign-in and reset tokens, hashed | Verifying an email address, resetting a password | Until they expire |
| Server logs | Finding faults. They carry request paths, timings and account ids. | A short time, then overwritten |
| Age confirmation and cookie consent | Proof that you confirmed you are 18 or older and accepted the cookie notice: the date, the text version, your IP address and browser identification string | Until you delete the account |
| Advertising click | When you arrive from an advertisement: the network, its click identifier, your IP address, browser identification string and the referring page, so the network can be told that its click led to a sign-up | 30 days in your browser; the record of the click and the sign-up stays with the account |
| Moderation records | The prompt, settings and review notes of each run, for the terms-compliance review and for handling reports | Kept after you delete the run or the account; the images are not kept |
| Device identifier and browser fingerprint | A random identifier kept in your browser, and a hash of your browser's hardware and settings, recorded at sign-up and sign-in. They tie an account to the device, so one free allowance is not taken many times from one device. | Until you delete the account |
| Record of a deleted account | When you delete your account, one row stays: a hash of the email address, the device identifier and fingerprint, the address prefix, how much of the free allowance the account had used in the running month, and whether it was closed under the terms. A new account you create continues that allowance instead of starting over. No name, prompt or picture stays. | Kept |
| Ban records | For an account closed under the terms: the account, the reason and the IP address prefixes it used, so the ban holds | While the ban stands |
What we do not do
- We do not train models on your prompts or your images.
- We do not sell your data. When you arrive from an advertisement, we tell that network that its click led to a sign-up or a first purchase, by the click identifier it gave us and the amount paid. It never receives your email address, your prompts or your pictures.
- We run no advertising tracker and no third-party analytics script on this site.
- We do not read your images except when a fault report names a specific run, or when a run is reviewed for compliance with the terms. Our moderators receive a notice of each run with its prompt, and review runs in a moderation panel that shows the prompt, the settings, the reference pictures and the results.
Who else sees anything
- Amazon Web Services stores your images and delivers this site and your images to your browser. On every page or image request, it receives your IP address, your browser identification string and the requested address, as any host does.
- SendGrid delivers account email — verification and password reset. It receives your email address and the message.
- Stripe handles card payment on its own hosted checkout page. Stripe receives your email address and your card details directly; we never hold a card number. Stripe sends us the customer identifier, the subscription identifier and the payment status, which we store so the plan can be looked up.
- Vast.ai provides rented computing capacity that renders beside our own. During a render it receives your prompt, your reference pictures and your run settings, and returns the pictures. It also runs the automated age check described below. We do not keep account data there.
- ip-api.com receives an IP address used to sign in, and returns the network provider for it, when a moderator opens the account details. The approximate place is read from a database on our own machine, with no network call.
- Authorities. We disclose data when the law requires it, and we report apparent child sexual abuse material to the National Center for Missing & Exploited Children, as the law requires.
- The advertising network that showed you an advertisement, today TrafficStars or Reddit, receives the click identifier it gave us when you sign up and when you first pay, with the amount, as described above.
Rendering happens on computing capacity we operate and on the rented capacity named above. Your prompt does not reach any other model provider.
AI processing
Every picture the service returns is generated by AI image models running on our own machines. A reference image you upload is processed by the same AI models to produce the edit or the enlargement you asked for. Before delivery, an automated repair pass may re-render small regions of a picture, such as eyes, with the same models. No person takes part in this processing; see "What we do not do" for when a person may look at an image.
Cookies
We set a small number of cookies, none for tracking: one holds your sign-in session, and signing out clears it; the others let your browser fetch your own images and expire on their own within a day. No script on the page can read them. There is no advertising cookie and no cross-site tracker to consent to.
Prompt screening
Prompts are screened before rendering, to enforce section 5 of the terms. The screen runs on our own machines, and the prompt is not sent anywhere to be screened. A refusal appears in the server log with the request, in the same way as any other refused request. We keep no separate list of refused prompts.
Your rights
- See it. Your prompts, settings and seeds are in your run history in the studio. For anything else, ask.
- Delete it. Delete a single run from the studio, or the whole account from the account page. Account deletion removes your runs, your images, your uploads, and your style files. Feedback messages stay for triage, with the link to your account removed.
- Take it. Download any run as one zip from the studio.
- Correct it. The studio has no field for changing an email address or a username yet. Write to us and we change it for you.
To exercise a right this page does not cover, write to support@wardrobegw.com, or open "Send feedback" in the studio account menu — it files a ticket we read. We answer within 30 days.
Where your data is processed
We are in the United States, and our own machines are there. The providers named above process data in the United States and, for rented computing capacity, in the other countries where that capacity runs. If you use the service from outside the United States, your data is transferred to the United States and to those countries.
Rights under state privacy laws
If you live in a U.S. state with a consumer privacy law, such as California, Colorado, Connecticut, Oregon, Texas, Utah or Virginia, you may have the right to know what personal data we hold, to get a copy, to correct it, to delete it, and to opt out of the sale of personal data, targeted advertising and profiling. We do not sell personal data, and we do not use it for profiling. When you arrive from an advertisement, we report the sign-up and the first payment to that network by its click identifier, which some state laws treat as sharing for advertising; write to us and we stop reporting yours. Send any request to support@wardrobegw.com. We confirm who you are from your account email before we act, we answer within 45 days, and we do not treat you differently for using a right. If we decline a request, reply to our answer to appeal; we decide the appeal within 60 days.
Children
The service is for adults only. We do not knowingly collect data from anyone under 18; an account that declares it is under 18 is closed to access.
Image screening
Every picture you upload and every picture the service renders is checked by an automated AI model, which estimates the age of each person shown. A picture in which a person appears to be under 18 is refused: a refused upload is not stored, and a refused render is not delivered. The estimate and the refusal are recorded with the account for the terms review. An uploaded picture of a person who appears to be under 18 is a strike; the third strike closes the account permanently. A file removed after a removal request is recorded by its fingerprint, and an upload of an identical file is refused.
Security
- Every connection to this site is encrypted, and so is the connection between our systems and the rented computing capacity.
- Your sign-in session is protected so that no script on a page can read it.
- Your images are stored privately and are delivered only to your own signed-in browser.
- Passwords are stored in a form that cannot be read back, and are never sent by email.
- Staff access to runs is limited to named administrator accounts.
- A delivered picture carries no embedded prompt.
- A request for a run that is not yours is refused as if the run did not exist.
Changes
If we change what we collect or who receives it, the date at the top of this page changes and the change appears on this page.