Privacy Policy

1. Who is responsible

The controller of your personal data is Solid Code Jakub Jabłoński, ul. Przybyszewskiego 209C/49, 93-120 Łódź, Poland, NIP 7282888619 ("we"). Write to us about anything in this policy at contact@twish.ink.

2. What we collect

• Your account, if you make one: your email address, the name you give us, and your password, which we store only as a one-way hash, so we can never read it.
• Your designs: what you type (requests, words to print, edit instructions), images you upload as inspiration, and the designs we draw for you with their versions.
• Your orders: what you ordered, the name and shipping address you give, your email address, and whether and how much you paid. Card details go straight to our payment provider; we never see your card number.
• Technical data: your IP address, the time and the page or action you asked for, kept in security and server logs. If you arrived via a campaign link (the ?source= on an ad's link), we keep that campaign's name on your guest or account record, to see which campaigns lead to designs and orders.
• Emails we send you: a copy of account and order emails (confirmations, password resets), so we can see they went out.
• Messages you send us through the contact form: what you wrote, what it is about, the email address you give for our answer, the page you wrote from, and which account or guest session sent it.

Without an account you use Twish as a guest: your designs are tied to a cookie in your browser instead of an email address.

People in photos you upload. If you upload a photo showing other people, we process their image to make the design you asked for and to check it against our rules: our and your legitimate interest in providing the requested design (art. 6(1)(f) GDPR), using the providers listed below. The photo is deleted after 24 hours unless it is used in a design, and then kept as long as that design. We check only whether a photo shows a famous person, whom we cannot print; we do not try to identify anyone else. If you appear in a photo uploaded to Twish, you can use your rights by writing to contact@twish.ink.

3. Why, and on what basis

• To provide Twish (drawing and editing designs, your account, sign-in, account emails): to perform our agreement with you, art. 6(1)(b) GDPR.
• To make, ship and support your orders, including payment and handling complaints: art. 6(1)(b) GDPR.
• To keep accounting and tax records of orders and payments, as Polish law requires: art. 6(1)(c) GDPR.
• To keep the service safe and fair: rate limits, bot checks, preventing abuse and fraud, checking requests and uploads against our content rules, and defending legal claims. This is our legitimate interest, art. 6(1)(f) GDPR.
• To answer your messages from the contact form: our legitimate interest in helping you and improving Twish, art. 6(1)(f) GDPR, and, when you write about an order, to perform our agreement with you, art. 6(1)(b) GDPR.
• To understand what works: counting visits and orders per campaign link to see which ads bring people, and keeping the first campaign on your guest or account record. Also our legitimate interest, art. 6(1)(f) GDPR. Visit counts are totals that identify no one.

We don't send marketing emails. Giving us your data is voluntary, but without an email address you can't have an account or place an order, and without a shipping address we can't deliver.

4. Who receives it

Twish runs on our own computers in Poland. These services do part of the work for us. Most of them act on our instructions under a data processing agreement; where one acts on its own account, we say so:

• Cloudflare, Inc. carries all traffic between your browser and us and protects the site from attacks, so it sees your IP address and the pages you request. When a lot of designs come from your network in a day, or many wrong passwords are tried for one email address, Cloudflare Turnstile checks in your browser that you are a person: it sees your IP address and technical details of your browser and device, and tells us only whether the check passed. Cloudflare also uses these signals, as an independent controller, to improve its bot detection.
• Google (its Gemini models): reads your request and turns it into drawing instructions, checks it against our content rules, and reads back what our designs show and say. When OpenAI is unavailable it also checks the images you upload. On the paid service we use, Google does not use this data to improve its products; it keeps it for 55 days only to detect abuse.
• OpenAI checks the images you upload against our content rules and describes them, lists what our designs show, and takes over from Google when Google is unavailable. Its API terms say this data is not used to train its models.
• OpenRouter, Inc. passes your request to a Google model only when both Google and OpenAI are unavailable. It receives the text of the request, not your images or your account, and as we have it set it does not store prompts.
• Replicate, Inc. draws designs when our own machine is busy. It receives the drawing instructions and images for that job, and deletes them within an hour.
• Web search engines (Microsoft Bing, Yahoo, Google): when your request names a person, brand or character, we send that name alone to them to check whether it is a public figure or someone's property. They act as independent controllers under their own privacy policies. We do not search names you introduce as people you know ("my sister Anna"), and never send your account or the rest of your request.
• Gelato and its local print partner make and ship an order. They receive the design, the products, and your name, shipping address and email address.
• Stripe takes the payment. It receives your name, email address, delivery address (to work out VAT) and the amount, and collects your card details itself. For fraud prevention and its own legal duties Stripe acts as an independent controller (stripe.com/privacy).
• Resend delivers account and order emails to your address. It receives your email address and the email itself.
• Our mailbox (contact@twish.ink, hosted by Google): copies of contact-form messages and of order and problem alerts reach it, so we can answer and act. Notifications to the owner's phone (Telegram) carry no personal data: only that something happened, with a link to our own admin panel.

We share data with authorities only when the law requires it.

5. Outside the EEA

Cloudflare, Google, OpenAI, OpenRouter, Replicate, Resend and Stripe may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

6. How long we keep it

• Your account and its designs: until you ask us to delete them.
• A guest's designs: until you ask us to delete them. A guest who made nothing is forgotten after 14 days.
• Uploaded images no design uses: 24 hours.
• Orders and payment records: until the tax liability for them is time-barred, that is 5 years from the end of the calendar year in which the tax was due (art. 70 and 86 of the Tax Ordinance); longer only while a complaint or claim about the order is open.
• Sign-in sessions: 60 days from your last visit, or until you sign out.
• Security logs (sign-ins, refusals and other events with an IP address): 90 days.
• Server logs: rotated automatically and kept only as long as needed to run and secure the service.
• Copies of the emails we send you: 30 days.
• Messages from the contact form: 1 year. A copy also reaches our mailbox, where we keep it while we deal with your message.
• Visit counts per campaign link: stored only as totals, without IP addresses, for up to 2 years.
• Backups of the above are kept for safety and replaced on a rolling basis.

7. Cookies

We use one cookie of our own: __Host-twish_session, which keeps you signed in, or keeps your designs together as a guest, for up to 60 days. It is strictly necessary for the service, so it doesn't need your consent. Cloudflare may also set its own strictly necessary security cookies. We use no analytics, advertising or tracking cookies, and no tracking pixels. Your browser also keeps, on your device only, your last style, product and language choice and, if you ticked "Remember this address on this device" at checkout, your delivery address. You can clear them in your browser.

8. Automatic checks

Every request, uploaded image and design is checked automatically against our content rules before it is drawn or printed, and a request that breaks them is refused. These checks have no legal or similarly significant effect on you, and if you think one got it wrong, write to us with the design link and a person will review it.

9. Your rights

Under the GDPR you can ask us for access to your data and a copy of it, its correction, its deletion, the restriction of its use, and to receive data you gave us in a portable format. Write to contact@twish.ink from the address of your account, or, as a guest, include a link to your design. We answer within one month.

Your right to object. You can object at any time, on grounds relating to your particular situation, to what we do on the basis of our legitimate interest (art. 21 GDPR); we then stop unless we have compelling legitimate grounds or need it for legal claims.

You can also complain to the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

Twish is for adults: you must be 18 or older to use it.

10. Changes

We'll update this policy when what we do with data changes, and announce material changes on the site before they apply. The date at the top shows the current version. See also our Terms & Content Rules.