Privacy Policy

Effective: September 13, 2026

This policy explains what Alpha Entropy Labs LLC collects when you use Realmatize™, and why.

What we collect

Account data — your email address (from signup or Google sign-in), a salted hash of your password (never the password itself), optional two-factor secrets, and your preferences.
Content you submit — room photos, item photos and text requests are processed to produce your design. They are kept in memory for the run; they are stored only if you save a plan to a project.
Saved projects — plans you save (image + shopping list) are stored until you delete them or your account, and are private to your account.
Billing — subscriptions are processed by Stripe; we store your tier, subscription status and Stripe customer id, never card numbers.
Usage & logs — credit counters, rate-limit counters, and standard server logs (IP address, user agent, timestamps) kept for security and abuse prevention and retained for up to 12 months.

How your content is processed

To generate a plan, your photo and request are sent to our AI and search processors: Google (Gemini image generation — the default engine), OpenAI (optional image engine, content moderation), Anthropic (image understanding), and DataForSEO and/or SerpApi plus retailer websites (product search). Payments are processed by Stripe; emails are delivered via Amazon Web Services, which also hosts the Service. We additionally use PostHog (product analytics — which features are used, associated with your account) and Sentry (error reporting) to operate and improve the Service. These providers process data on our behalf under their own terms. We do not sell your personal data, and we do not use your photos to train models.

Cookies

Essential cookies. We use a first-party session cookie to keep you signed in. Stripe and Cloudflare set their own cookies where their widgets are used (checkout, bot protection). These are necessary for the Service to function and are not subject to the consent choice described below.

Analytics, session replay and error tracking. With your consent, PostHog sets first-party analytics cookies and local-storage identifiers so we can see which features are used and how often, associated with your account. This includes page views and clicks, errors that occur in the page or on our servers while you use the Service, and session recordings: a replay of how the page was used (clicks, scrolling, mouse movement and the page's content, which may include the photos you upload). Everything you type into a form field is masked before it leaves your browser, so passwords, email addresses and payment details are never recorded. We use these recordings only to understand and fix problems with the Service. We do not use PostHog or any other tool to sell your data.

Affiliate cookies. Some retailer links are monetized through Skimlinks and Sovrn Commerce (VigLink), whose scripts may set cookies or similar identifiers to attribute qualifying purchases to Realmatize (see our Affiliate Disclosure). These are optional and are covered by the same consent choice as analytics cookies; declining them does not change the products you see or the price you pay.

Advertising cookies. With your consent, the Pinterest Tag and the Meta Pixel (Facebook and Instagram ads) set cookies and similar identifiers so we can measure whether our Pinterest, Facebook and Instagram ads lead to visits and sign-ups and improve how those ads are delivered. If you are signed in, a hashed (unreadable) form of your email address may be shared with Pinterest for the same measurement (“enhanced match”). These cookies are optional and covered by the same consent choice as analytics cookies.

Your choices. Wherever you are located, we ask for your consent through a cookie banner on your first visit before setting any analytics, affiliate or advertising cookies; none of them is set until you accept. You can change your choice at any time via the Cookie settings link in the page footer, and you can block or delete cookies in your browser settings — though the Service may not function correctly without the session cookie. Page fonts are loaded from Google Fonts, which receives your IP address when a page loads.

Retention and deletion

Account data and saved projects are kept until you delete them. Deleting your account (Account → Delete account) immediately removes your projects, saved plans, sessions and billing profile from our systems; backups age out on a rolling schedule. You can also request deletion or a copy of your data at the address below.

Your rights

Depending on where you live (e.g. GDPR, CCPA), you may have rights to access, correct, export or delete your personal data, and to object to certain processing. Contact us and we'll honor applicable requests. We don't discriminate for exercising them.

Security

Traffic is encrypted in transit (TLS); passwords are salted and hashed (PBKDF2); sessions expire server-side; optional two-factor authentication is available on every account. No system is perfectly secure — report concerns to the address below.

Changes & contact

We'll post material changes here and update the date above.
Alpha Entropy Labs LLC · support@realmatize.com