Privacy Policy

Last updated: October 20, 2026 · Version 3.14

1. Who we are

This policy explains how the operator of ForgeScene (“we”, “us”) uses your personal data. We are responsible for your data. Contact us about anything in this policy at support@forgescene.com or through Support.

2. What we collect

Account: email address, username, display name, sign-in method, two-factor settings, avatar, and a password hash only if you add a password. If you sign in with Google or Discord, we receive your email and account ID from them.
What you upload and create: images, videos, prompts and settings, and when you made them.
Usage and device: IP address, device and browser type, pages used, and timestamps. We also use the country of your connection, from a list kept on our own servers, to suggest a language.
Referral and ad links: if you arrive through an affiliate’s link or one of our ads, what that link carries and records (see section 9).
Where your visit came from: the address of the website or app that sent you (never the page or what you searched), the tags in the link (such as utm_source), whether the link had a click tag from a platform such as Facebook or Google (never its value), and the first page you opened (see section 9).
Payments: plan, amount, time, payment method type and transaction ID. We never receive full card numbers or wallet keys.
If you are an affiliate: your application, payout details, and a record of the affiliate terms you were offered and accepted: when, which version, the IP address and browser you accepted from, and a fingerprint of the exact text you saw. We keep this as proof of our agreement.
Support and reports: what you send us through Support or the content-removal form.
Answers to short questions: if you answer one of our short questions in the app, such as how you found us or what stopped a payment, your answer and any words you add.
Safety records: results of safety checks on uploads and created content.
Fair-use records: to notice when one person uses several accounts for free credits, we keep one-way codes, never the originals, of the network you sign up and sign in from, of your email address, and of a random security cookie in your browser, with the dates they were used.

3. Sensitive data

ForgeScene is an adult service. Your prompts, uploads and creations can reveal your sexual preferences. This is sensitive data under data protection law. We use it only to run the Service for you (including suggestions that fit you, see section 4) and to keep it safe, and only with your explicit consent, which you give before your first session. You can withdraw it at any time by deleting your account. We never use it for advertising and never sell it.

4. Why we use your data, and on what legal basis

Running your account and creating your images and videos: to provide the Service you asked for (GDPR Art. 6(1)(b)), and your explicit consent for sensitive data (Art. 9(2)(a)).
Payments and receipts: to provide the Service (Art. 6(1)(b)) and to meet legal record-keeping duties (Art. 6(1)(c)).
Safety checks, stopping illegal content and fraud, keeping the Service secure: our legitimate interest in a safe and lawful service (Art. 6(1)(f)), and legal duties (Art. 6(1)(c)).
Account and service emails: to provide the Service (Art. 6(1)(b)).
Optional news emails: only with your consent (Art. 6(1)(a)). You can unsubscribe in any email.
Improving the Service: our legitimate interest (Art. 6(1)(f)), using statistics that do not identify you.
Suggestions that fit you: we look at what you create and choose and how you use the Service (such as your plan and what you bought), never your email or how you pay, to suggest ideas, settings and a language that suit you. Our legitimate interest (Art. 6(1)(f)), and your explicit consent for sensitive data (Art. 9(2)(a)). Notes we make this way are kept for up to 30 days. You can object at any time (see section 8).
Fixing faults: to find out why a creation or a try came out wrong, staff may look at it with the photos and clips it was made from, its prompt, the text our AI wrote from it and its settings for up to 30 days after it is made, while you keep it. If you delete a creation within 24 hours of making it, staff can still see it, with the photos and clips it was made from, until those 24 hours are over: our legitimate interest in a working Service (Art. 6(1)(f)), and your explicit consent for sensitive data (Art. 9(2)(a)).
Fair use of free credits: our legitimate interest in giving free credits once per person and preventing misuse (Art. 6(1)(f)). This is decided automatically and only ever affects free credits, never your account, your purchases or what you bought.
Counting sign-ups from referral and ad links, and paying affiliates: our legitimate interest in knowing which partners and ads bring customers, and in paying affiliates correctly (Art. 6(1)(f)).
Knowing where visitors come from: our legitimate interest in knowing which websites, apps and links bring visitors and customers (Art. 6(1)(f)).
Short questions: our legitimate interest in learning how people find us and what gets in their way (Art. 6(1)(f)). Answering is always up to you.

5. Who we share data with

We use trusted service providers who process data only on our instructions:

Payment providers (card, crypto and Telegram Stars, as shown at checkout): payment and transaction data.
Image safety service: uploaded and created images, checked for illegal content. Images are not kept after the check.
Sign-in providers (Google, Discord), only if you choose them.
Cloud storage: your uploads, videos and images.
Cloud computing: creates your videos and images. It receives only what each request needs.
AI text service: the words of your wishes, the choices you made and a short summary of how you use the Service (such as your plan and what you made), to write descriptions and suggestions. Never your email, name, IP address, payment method or transaction IDs.
IP check service: only the IP address you sign up from, to learn whether it belongs to a VPN, proxy or data center. Nothing else about you is sent.
Email delivery, error monitoring, and network and security providers: what each needs to send emails, find errors and block attacks.
Ad tracking service: only if you came from one of our ads: the ad’s click ID, an account reference, and when you confirm your email and make your first purchase (with its amount and a payment reference).

If you came through an affiliate’s link, that affiliate sees totals for their link (visits, sign-ups, confirmed emails and phone numbers, checkouts, purchases and amounts). Under a customer number made only for that affiliate, they also see the day you signed up, whether you confirmed an email and a phone number, and what you bought and for how much. That number is random: it is not your account number and means nothing anywhere else. If the affiliate set up a postback, their tracking service is told when you confirm your email (and, if they ask for it, a phone number) and when you buy, with the reference their own link carried, that customer number and the amount. They never see your email address, your phone number, your name or anything you make.

We share data with authorities only when the law requires it, for example to report child sexual abuse material. We do not sell or rent your data.

6. Data outside your country

Some providers are in other countries, including the United States. When data leaves the EU, we rely on a European Commission decision that the country protects data adequately (such as for the United Kingdom), on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. You can ask us for details.

7. How long we keep data

Sessions and created content: as long as your plan keeps them (see Pricing), then deleted for good.
Account data: while your account is open, and up to 30 days after you delete it.
Fault notes: the prompt, the text our AI wrote from it and the settings of each creation, and of a try that was refused before it started (never the image or video), for up to 30 days.
Creations you delete soon after making them: if you delete pictures, a video or its session within 24 hours of making them, we keep a private copy of them and of the photos and clips they were made from until 24 hours after they were made. After that, the copy is no longer offered for viewing in our staff review pages and waits privately for a staff member to approve permanent deletion. Nothing a safety check stopped or flagged is kept, and deleting your account deletes the copy at once.
Photos you enhance: when you use Enhance image, we keep a private copy of your photo and of the enhanced photo for 24 hours, so staff can find out why one came out wrong. After that, the copy is no longer offered for viewing in our staff review pages and waits privately for a staff member to approve permanent deletion. Nothing a safety check stopped or flagged is kept, and deleting your account deletes the copy at once.
Photos from a picture edit that couldn’t start: if a picture edit can’t start for a reason that isn’t about safety, for example not enough credits, we keep a private copy of its photos for 24 hours so support can help. After that, the copy is no longer offered for viewing in our staff review pages and waits privately for a staff member to approve permanent deletion. Nothing a safety check stopped is kept, and deleting your account deletes the copy at once.
Copies of your tries: when we accept a Create press, we keep an encrypted copy of what you sent (your prompt, settings and the photos or clips it uses), of what was made from it, and of your account details at that moment (such as your email, username, plan and credits) in separate private storage. These copies have no fixed end date and are kept even after you delete your account. We don’t keep a try that a check turned down before it started, or a result that a check refused.
Review of an age-score refusal: an uploaded photo refused by an ordinary age-estimation check may be kept encrypted in a separate private staff-review archive, with its check record. A staff member must confirm a qualifying strike; the score alone does not add one. This review copy has no automatic deletion deadline, including after 24 hours, and permanent deletion requires an explicit staff decision. It may remain after account deletion. Known-abuse evidence is handled separately under our safety-record rules.
Safety records: at least 12 months, longer if needed for a report to authorities.
Fair-use records: up to 12 months after they were last used, also after an account is deleted, so that deleting an account and signing up again still counts as the same person.
Payment records: as long as tax and accounting law requires.
Support and report messages: up to 24 months after the case is closed.
Answers to short questions: until you delete your account; answers about a payment for up to 12 months.
Referral and ad-link records: while we need them to count sign-ups and to pay and check affiliate commissions.
Where your visit came from: if you sign up, with your account until you delete it. If you don’t, only for that visit; the visit is just added to a daily count that holds nothing about who you are.

8. Your rights

You can ask to see, correct, delete, restrict or move your data, and you can object to uses based on our legitimate interest. Where we rely on your consent, you can withdraw it at any time. You can delete your account yourself in Settings. For anything else, contact Support. We answer within one month.

You also have the right to complain to the data protection authority in the country where you live or work.

9. Cookies

We only use cookies and local storage needed to sign you in, keep you safe, and remember your settings (such as the 18+ confirmation and theme), plus one partner-link cookie when you arrive through an affiliate’s link (below). We do not use advertising or measurement cookies. One of the security cookies holds only a random code: it lets us notice when one browser is used for several accounts (see section 2), and it is never shared.

Referrals and ad links

If you arrive through an affiliate’s link, we record the visit: your IP address, browser, the page that sent you and the page you landed on. We also keep the link’s code, with the references the link carried, in a cookie for 30 days (it holds nothing about who you are). If you sign up in that time in the same browser, the account counts for that affiliate. A newer affiliate link replaces the older one, and the cookie is removed when you sign up or sign in.

If you arrive from one of our ads, we note the ad’s click ID and the campaign details in the link. That has no cookie of its own: it stays only with that visit, in the session cookie that ends when you close your browser. If you sign up or sign in during that visit, we save it with your account. A later visit without the ad’s link doesn’t count.

For an ad, we then tell our ad tracking service when you confirm your email and when you make your first purchase (see section 5). For an affiliate, the affiliate earns a commission on plans you buy within 5 months of your first purchase. Under a customer number made only for them, they see the day you signed up, whether you confirmed an email and a phone number, and what you bought and for how much, plus daily totals for their link. If they set up a postback, we tell their tracking service the same steps, with the reference their link carried and that number (see section 5). They never see your email address, your phone number or your name.

Where visits come from

On the first page of a visit, we note where it came from: the website or app that sent you (only its address, never the page there or what you searched), the tags in the link (such as utm_source and utm_campaign), whether the link had a click tag from a platform such as Facebook or Google (never its value), the page you landed on and when. That has no cookie of its own: it stays only with that visit, in the session cookie that ends when you close your browser. We don’t keep your IP address or browser for it. If you sign up during that visit, we keep it with your account until you delete it. If you don’t, the visit is only added to a daily count of visits per source and page, which holds nothing about who you are.

10. Security

We use encrypted connections, short-lived single-use sign-in codes, optional two-factor sign-in, hashed passwords and limited staff access. No system is perfectly secure, so please keep your sign-in details safe.

11. Adults only

ForgeScene is only for adults 18 and older. If we learn that a minor has an account, we close it and delete its data, except records we must keep by law.

12. Changes

We will tell registered users about important changes by email or in the app. The date at the top shows the latest version.

13. Contact

Privacy questions: support@forgescene.com or Support. Safety reports: content-removal form.

Back to home