Privacy Policy
Last updated: June 30, 2026
This Privacy Policy explains how TypeShirt ("TypeShirt," "we," "us," or "our") collects, uses, discloses, and protects personal information when you access or use the TypeShirt website, applications, AI image-generation tools, 3D garment editor, asset library, community gallery, Tech Pack tools, subscription services, and related features (collectively, the "Services").
TypeShirt is the controller of the personal information described in this Privacy Policy, except where a third party acts as an independent controller under its own privacy notice.
You can contact us about privacy at contact@typeshirt.app.
Please read this Privacy Policy before using the Services and contact us if you have questions about our privacy practices.
1. Scope
This Privacy Policy applies to personal information we process through the Services and through related support communications.
It does not govern third-party websites, applications, payment pages, AI providers, or other services that have their own privacy notices. When you use a third-party service through TypeShirt, that third party may process information under its own terms and privacy policy.
2. Information We Collect
2.1 Account and profile information
When you create or use an account, we may collect:
- your name, display name, email address, avatar, and account identifiers;
- authentication records, session identifiers, and account status;
- account creation date, last sign-in information, and security events; and
- preferences and settings associated with your account.
Authentication is currently provided through Supabase Auth. We do not receive or store your raw password in our application database.
2.2 User Content
We collect content you submit, upload, generate, edit, save, export, or publish through the Services ("User Content"), including:
- prompts, negative prompts, style selections, generation settings, and reference images;
- uploaded artwork, logos, garment images, photographs, background images, and other media;
- AI-generated images, variations, names, and related metadata;
- 2D canvas data, layers, positions, dimensions, colors, and editing history;
- 3D garment configurations, thumbnails, screenshots, and recorded previews;
- Tech Pack titles, measurements, fit selections, materials, printing methods, order quantities, website addresses, email addresses, and telephone numbers;
- asset titles, descriptions, visibility settings, and sharing status; and
- comments, support messages, feedback, and other information you choose to provide.
Please do not upload confidential information, sensitive personal information, or images of another person unless you have all permissions and lawful grounds necessary to do so.
In this Privacy Policy, "Private Content" means User Content that you have not intentionally published through a public-sharing feature. Private Content is not displayed in the Trending gallery, subject to the unlisted asset URL disclosure in Section 2.4.
2.3 Public community information
If you choose to publish an asset to the Trending gallery or another public area, we may make the following information publicly available:
- the published image or design;
- the asset title and selected style or category;
- your display name, brand name, or profile information;
- the prompt or other generation information shown by the sharing interface;
- likes, engagement counts, and publication time; and
- links or controls that allow other users to view or remix the disclosed prompt and settings.
Content is not published to the community merely because it is saved to your asset library. Publishing requires a sharing action or public visibility setting.
You should assume that information you publish can be copied, downloaded, indexed, cached, or reshared by others outside TypeShirt. Removing or unpublishing content may not remove copies already made by third parties.
2.4 Unlisted asset URLs
Private assets are not intentionally displayed in the public Trending gallery. However, some images used for browser rendering may be stored at unlisted, publicly addressable storage URLs. A person who obtains the exact URL may be able to access the corresponding file.
Do not use TypeShirt as the sole repository for trade secrets, embargoed campaigns, unreleased confidential artwork, or other material that requires strict access controls. We may introduce private storage and signed URLs in the future, in which case this section will be updated.
2.5 Subscription, transaction, and credit information
When you subscribe, purchase credits, or use paid features, we may collect:
- your plan, billing interval, subscription status, and renewal date;
- payment-provider customer and subscription identifiers;
- order numbers, transaction amounts, currency, tax status, and refund status;
- credit balance, credit grants, deductions, refunds, and transaction logs; and
- limited billing contact information made available to us by the payment provider.
Creem currently acts as the merchant of record for purchases made through the TypeShirt checkout. Creem collects and processes payment-card details and other checkout information under its own privacy notice. TypeShirt does not store complete payment-card numbers or card security codes.
2.6 Usage, device, and technical information
We may automatically collect:
- pages viewed, feature interactions, clicks, referrer information, and timestamps;
- browser type, operating system, device type, language, and approximate location derived from network information;
- IP address, request data, authentication events, and security logs;
- API usage, selected AI model, generation count, response status, latency, and error information; and
- diagnostic data needed to maintain performance, investigate failures, prevent fraud, and protect the Services.
We use Vercel Web Analytics and Speed Insights to understand aggregate traffic and performance. Vercel Web Analytics is designed to provide aggregated analytics without using third-party tracking cookies or creating a persistent cross-site profile.
2.7 Cookies and local storage
We use essential cookies and similar browser storage for authentication, security, preferences, and continuity of the Services. We may also use local storage to remember temporary design state, selected settings, theme preferences, pending uploads, and locally cached credit information.
These technologies are necessary for functions such as staying signed in, preserving work while navigating between pages, and protecting account access. Disabling them may prevent parts of the Services from working.
We do not currently use TypeShirt data for cross-context behavioral advertising or sell personal information to advertising networks. If we later introduce non-essential advertising or tracking technologies, we will update this Privacy Policy and provide consent or opt-out controls where required.
2.8 Information from other sources
We may receive information from:
- authentication, hosting, database, storage, analytics, AI, and payment providers;
- another user who publishes or sends content involving you;
- service providers helping us investigate abuse, fraud, or security incidents; and
- publicly available sources when reasonably necessary to investigate intellectual-property complaints or misuse.
3. How We Use Information
We use personal information for the following purposes:
| Purpose | Examples | Typical legal basis where GDPR applies |
|---|---|---|
| Provide the Services | Create accounts, authenticate users, generate and edit images, render 3D previews, save assets, export files, and create Tech Packs | Performance of a contract |
| Process subscriptions and credits | Administer plans, allocate and deduct credits, process renewals, cancellations, and refunds | Performance of a contract; legal obligation |
| Process AI requests | Send prompts, images, and settings to the selected AI or background-removal provider and return results | Performance of a contract |
| Operate community features | Publish content at your direction, display profiles and likes, and enable Trending and Remix features | Performance of a contract; consent or your affirmative publishing action |
| Maintain and improve the Services | Diagnose errors, measure aggregate performance, improve workflows, and develop features | Legitimate interests in operating and improving the Services |
| Protect TypeShirt and users | Prevent abuse, fraud, infringement, security incidents, and attempts to bypass plan or credit controls | Legitimate interests; legal obligation |
| Communicate with you | Send service messages, security notices, billing information, policy updates, and support responses | Performance of a contract; legitimate interests; legal obligation |
| Comply with law | Maintain required records and respond to valid legal requests | Legal obligation |
| Marketing | Send marketing communications where permitted and subject to available unsubscribe rights | Consent or legitimate interests, depending on applicable law |
Where we rely on legitimate interests, we consider whether our interests are reasonably necessary and balanced against your rights. Where we rely on consent, you may withdraw that consent at any time without affecting processing that occurred before withdrawal.
4. AI Processing
To provide AI features, we may transmit the following information to AI service providers:
- prompts and system instructions;
- uploaded garments, artwork, photographs, reference images, and style images;
- previous outputs selected for editing or remixing;
- requested model, aspect ratio, category, and generation settings; and
- technical request metadata.
Depending on the feature and model you select, these providers may include:
- OpenRouter, which routes requests to an underlying model provider;
- Google, for Gemini image-generation models;
- OpenAI, for GPT Image models; and
- fal.ai, including for background-removal processing.
Before an image-generation request is sent to an AI provider, TypeShirt sends the prompt text and a request identifier to Creem's Moderation API for content-safety screening. Creem returns an allow, flag, or deny decision. TypeShirt blocks flagged or denied prompts and temporarily blocks generation if moderation is unavailable.
The specific underlying model provider may change as models are added, removed, renamed, or rerouted.
TypeShirt does not use Private Content to train a TypeShirt-owned AI model unless we first provide a separate notice and obtain any consent required by law. AI service providers may retain or use inputs and outputs according to their contracts, account settings, technical configurations, and privacy policies. Do not submit sensitive, regulated, or confidential personal information to AI features.
5. How We Disclose Information
We may disclose personal information as follows.
5.1 Service providers and infrastructure partners
We use third parties to operate the Services, including:
| Provider or category | Purpose | Information potentially involved |
|---|---|---|
| Supabase | Authentication, database hosting, and file storage | Account data, User Content, configuration data, credit records |
| Vercel | Website hosting, serverless processing, analytics, and performance monitoring | Request, device, usage, diagnostic, and content-processing data |
| Creem | Checkout, merchant-of-record services, tax, billing, subscriptions, refunds, chargebacks, and pre-generation prompt moderation | Contact, checkout, transaction, subscription, prompt text, and moderation request identifiers |
| OpenRouter | Routing AI requests to model providers | Prompts, images, model settings, outputs, request metadata |
| Gemini model processing | Prompts, images, settings, and outputs | |
| OpenAI | GPT Image model processing | Prompts, images, settings, and outputs |
| fal.ai | AI media processing, including background removal | Submitted images, outputs, and request metadata |
These providers may process information in multiple countries and may use their own subprocessors.
5.2 At your direction or publicly
We disclose User Content when you publish it, share it, request an export, send it to an integrated service, or otherwise direct us to disclose it.
5.3 Legal, safety, and enforcement reasons
We may disclose information when we reasonably believe disclosure is necessary to:
- comply with applicable law, regulation, court order, subpoena, or other valid legal process;
- protect the rights, property, or safety of TypeShirt, our users, or the public;
- investigate fraud, abuse, security incidents, infringement, or violations of our Terms of Service; or
- establish, exercise, or defend legal claims.
5.4 Business transfers
If TypeShirt is involved in a merger, acquisition, financing, restructuring, bankruptcy, or sale of assets, information may be disclosed or transferred as part of that transaction, subject to applicable law.
5.5 Professional advisers
We may disclose information to lawyers, accountants, auditors, insurers, and other professional advisers where reasonably necessary and subject to appropriate confidentiality obligations.
5.6 Aggregated or de-identified information
We may use and disclose information that has been aggregated or de-identified so that it cannot reasonably be linked to you. We will not attempt to re-identify it except as permitted by law.
6. No Sale of Personal Information
We do not sell personal information for money. We also do not knowingly share personal information for cross-context behavioral advertising as those terms are defined under applicable California privacy law.
If our practices change, we will update this Privacy Policy and provide any legally required opt-out mechanism.
7. International Data Transfers
TypeShirt and its service providers may process information outside the country where you live, including in the United States, the European Economic Area, Singapore, and other locations where our providers or their subprocessors operate.
Those countries may have data-protection laws different from those in your jurisdiction. Where required, we rely on recognized legal safeguards such as adequacy decisions, standard contractual clauses, contractual commitments, or another lawful transfer mechanism.
You may contact us to request additional information about safeguards relevant to your personal information.
8. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, resolving disputes, enforcing agreements, maintaining security, and complying with legal obligations.
Our intended retention schedule is:
| Information | Intended retention |
|---|---|
| Account and profile data | While the account is active and normally up to 30 days after a verified deletion request, unless a longer period is required |
| Private User Content | Until you delete it or close your account, followed by normal deletion processing of up to 30 days |
| Public User Content | Until you unpublish or delete it; residual cached or third-party copies may remain beyond our control |
| Credit and feature-usage records | While the account is active and up to 24 months afterward for account, fraud, and dispute purposes |
| Subscription, transaction, tax, and refund records | For the period required by applicable accounting, tax, payment, and anti-fraud laws, which may be up to seven years or longer where required |
| Support and complaint records | Normally up to 24 months after the matter is closed, or longer if needed for a legal claim |
| Security and diagnostic logs | Normally up to 12 months, unless needed longer to investigate an incident |
| Analytics data | According to Vercel's analytics configuration and retention practices; aggregate reports may be retained longer |
| Backups | Deleted information may remain in protected backups until overwritten under our normal backup cycle, ordinarily no longer than 90 days |
AI providers and payment providers maintain their own retention schedules. Their copies may not be deleted at the same time as TypeShirt's active records.
We may retain limited information longer when necessary to comply with law, prevent fraud, resolve a dispute, enforce our agreements, or preserve a record of a privacy or opt-out request.
9. Security
We use reasonable administrative, technical, and organizational measures designed to protect personal information, including encrypted transmission, access controls, authentication, database security policies, and separation of user records.
No online service, storage system, or transmission method is completely secure. We therefore cannot guarantee absolute security. You are responsible for using a strong password, protecting access to your email and devices, and notifying us promptly if you believe your account has been compromised.
10. Your Choices and Privacy Rights
Depending on where you live, you may have the right to:
- access personal information we hold about you;
- obtain a portable copy of certain information;
- correct inaccurate or incomplete information;
- delete personal information;
- restrict or object to certain processing;
- withdraw consent where processing is based on consent;
- opt out of marketing communications;
- opt out of the sale or sharing of personal information, where applicable;
- limit certain uses of sensitive personal information, where applicable; and
- lodge a complaint with a data-protection or privacy authority.
You may manage certain profile, asset, sharing, and billing settings directly through the Services. To submit a privacy request, email contact@typeshirt.app with the subject line "Privacy Request."
We may need to verify your identity before completing a request. Authorized agents may submit requests where permitted by law, but we may require proof of authority and identity. Certain information may be exempt from a request, including records we must retain by law or need to protect security, prevent fraud, or establish legal claims.
We will not unlawfully discriminate against you for exercising a privacy right.
10.1 European Economic Area, United Kingdom, and Switzerland
If you are located in the EEA, UK, or Switzerland, you may contact your local supervisory authority if you believe our processing violates applicable data-protection law. We encourage you to contact us first so we can try to resolve your concern.
10.2 United States state privacy disclosures
During the preceding 12 months, we may have collected the following categories of personal information, as described more fully above:
- identifiers;
- customer and transaction records;
- commercial information;
- internet or other electronic network activity;
- approximate geolocation;
- audio, electronic, visual, or similar information;
- professional or business-related information you choose to provide;
- User Content that may contain personal information; and
- inferences relating to preferences, such as selected design styles.
We collect these categories from you, your device, service providers, and other sources described in Section 2. We use and disclose them for the business and commercial purposes described in Sections 3 and 5.
We do not knowingly collect sensitive personal information for the purpose of inferring characteristics about an individual.
11. Children's Privacy
The Services are not directed to children or persons under 18 years of age. You must be at least 18 to create an account or use the AI features.
We do not knowingly collect personal information from children. If you believe a child has provided personal information to TypeShirt, contact us at contact@typeshirt.app so we can investigate and take appropriate action.
12. Third-Party Personal Information
If you upload or publish information about another person, you represent that you have a lawful basis and all necessary permissions to provide that information to TypeShirt and its service providers for the purposes described in this Privacy Policy.
You must not use the Services to create deceptive impersonations, non-consensual intimate imagery, unlawful biometric databases, or content that exploits or endangers children.
13. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to the Services, providers, technology, or law. We will post the revised policy with an updated date.
If a change materially affects how we use personal information, we will provide additional notice when required, such as through the Services or by email. Changes apply prospectively from their effective date unless otherwise stated or required by law.
14. Contact Us
For privacy questions, requests, or complaints, contact:
TypeShirt Privacy Team
Email: contact@typeshirt.app
Useful third-party privacy notices include:
- Supabase: https://supabase.com/privacy
- Vercel: https://vercel.com/legal/privacy-notice
- Creem: https://www.creem.io/privacy
- OpenRouter: https://openrouter.ai/privacy
- Google: https://policies.google.com/privacy
- OpenAI: https://openai.com/policies/privacy-policy
- fal.ai: https://fal.ai/legal/privacy-policy