Privacy policy

Last updated 2 November 2026

This policy explains what personal data Crazy Gooze (the AI picture studio at studio.crazygooze.com and the gallery at crazygooze.com) collects, how we use it, who we share it with, how long we keep it and the rights you have under UK data protection law (UK GDPR and the Data Protection Act 2018). Questions: hello@crazygooze.com.

Who is responsible

Crazy Gooze is the controller of your personal data. You can contact us about anything in this policy at hello@crazygooze.com.

What we collect

Account details: your email address and name, the way you sign in (Google or a code sent to your email) and the date you joined.
What you make: pictures you upload or create, your edits, text, frames and layouts, and your chat messages with Goose, our assistant.
Brand kits and custom styles: colours, fonts, logos and reference pictures you add.
Credits and billing: your credit balance and history and, once paid plans open, invoices. Card details are handled by our payment provider (Stripe); we never see or store your full card number.
Settings: your theme, download preferences and email choices.
Sharing: view-only links you create and comments you write on shared projects.
Technical data: basic request logs (time, IP address, the page or action, errors) used to keep the service secure and working.

Signing in with Google

If you choose "Continue with Google", Google shares the following with us, and only with your permission on Google's consent screen:

your email address (and whether Google has verified it),
your name, and
a Google account identifier, used only to recognise you the next time you sign in.

We ask only for the basic sign-in permissions (openid, email and profile). We do not ask for, and cannot see, your Gmail, contacts, Drive, calendar or any other Google data.

We use this Google user data only to:

create your Crazy Gooze account and sign you in to it,
show your name in the app and on comments you write, and
send you emails about your account (for example sign-in codes) and, only if you switch them on, the weekly picture email and product news.

We do not sell Google user data, use it for advertising, share it with data brokers, or use it to train AI models. We do not transfer it to anyone except the service providers listed below that run Crazy Gooze for us (hosting and sign-in on Amazon Web Services). Crazy Gooze's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Crazy Gooze's access at any time in your Google Account (Security, then Your connections to third-party apps and services). Deleting your Crazy Gooze account deletes the Google data we hold, as described below.

Why we use your data (legal bases)

To provide the service you signed up for (contract): your account, projects, AI tools, credits and sharing.
To keep it safe and working (legitimate interests): preventing abuse and fraud, checking content against our rules, fixing problems.
To send optional emails (consent): the weekly picture and product news, only if you switch them on. You can switch them off in Settings or from any email.
To keep financial records (legal obligation).

Who we share it with

We share personal data only with the service providers that run Crazy Gooze for us, under contracts that limit them to processing it on our instructions:

Amazon Web Services: hosting, storage, sign-in (Amazon Cognito) and email delivery (Amazon SES). Your account and projects are stored in London (eu-west-2).
OpenAI: runs the GPT image models, the Goose chat and our content checks. When you use an AI tool, your prompt and the picture it works on are sent to OpenAI. OpenAI does not use data sent through its business API to train its models.
Google (Gemini API): runs the Nano Banana image models and short clips, for the tools that use them. Data sent through the paid Gemini API is not used to train Google's models. This is separate from Google sign-in.
Stripe: payments, once paid plans open.

Some of these providers process data in the United States. Where they do, the transfer is covered by UK-approved safeguards (the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum). We do not sell personal data, and we share it with authorities only when the law requires.

How long we keep it

Your account, projects and settings are kept until you delete them or your account.
When you delete your account we delete your profile, projects, pictures, chats, brand kits, styles and share links straight away. Copies in our backups are removed within 35 days.
Your credit history and invoices are kept for 6 years, as UK tax law requires. Once your account is deleted they no longer contain your name or email address.
Request logs are kept for 30 days.

How we protect it

All connections use HTTPS. Data is encrypted when stored. Access to the systems that hold it is limited to the people who run the service, and every account can reach only its own projects and pictures.

Your rights

You can ask to see, correct, delete or move your data, object to or restrict how we use it, and withdraw consent at any time.

Download your data: Settings, Profile, Download my data gives you everything in one file.
Delete your account: Settings, Profile, Delete account.

For anything else, email hello@crazygooze.com. We reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Children

Crazy Gooze is not meant for children under 13, and we do not knowingly collect their data. If you think a child has given us their data, email hello@crazygooze.com and we will delete it.

Cookies and storage

We use only what the service needs to work:

Keeping you signed in.
Remembering your theme, the chat panel position and your unsent prompt.
Remembering that you have seen the cookie notice.

These are stored in your browser and are essential, so they do not need your consent. We do not use advertising or tracking cookies. If we add analytics later, we will ask first and you will be able to say no.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the app before the change applies. The date at the top shows when it last changed.