Privacy

What is stored about you

• Your account. Email address, a bcrypt hash of your password (never the password), and the display name you give. Signing in with Google instead stores the Google account id and the profile name and picture Google returns.
• What you make. Pack names, the briefs you write, every generated icon and each saved version of it, where you place icons on the board, and the chats you have with the AI editor, including its replies.
• Credits and purchases. A ledger row for every credit granted, spent or refunded. If you buy credits, Stripe handles the payment and we keep the Stripe identifiers, the amount, the currency and the status. Card numbers never reach this service.
• Usage events. Named events such as “pack generated” or “export”, with your user id and a few non-sensitive properties. On this deployment they are stored in this application's own database and are not sent anywhere else.
• A session cookie. One signed, HTTP-only cookie that keeps you signed in. There are no advertising or third-party tracking cookies.

Who else sees it

Your icon briefs, the icons you ask to edit and your editing instructions are sent to the AI provider configured for this deployment (currently anthropic), which processes them under its own terms. Payments are processed by Stripe. Everything else stays in this application's database and object storage, which Salem Shadfan operating as Iconnzi operates.

Your packs are private to your account. Nothing you make is published or shown to other users by this software.

Deleting your data

Settings → Delete account removes your user record, and with it your packs, icons, every stored version, your chats, your credit ledger and your payment records. The SVG files in object storage are deleted first. Usage events are kept but detached from you — the user id on them is set to null, so they survive only as anonymous counts.

Deletion is immediate and cannot be undone. Export anything you want to keep before you do it.

Security

Passwords are hashed with bcrypt. Every API request is checked against the signed-in session, and every database read and write is scoped to the account that owns the record. Sign-in attempts, AI operations and the rest of the API are rate limited. No system is perfect: if you find a problem, please report it to legal@iconzzi.com.

Questions

For anything about your data, including a copy of it, write to legal@iconzzi.com.