Privacy policy

1. Information and purposes

We process information provided by users or needed when they use the service, on the applicable basis of service performance, legal obligations, legitimate interests or consent where required. Publishing this policy is not a substitute for separate consent when the law requires it.

Groble checkout receives only a random order reference generated by our server, without account emails, conversations or original models. Names, phone numbers and payment details entered directly in Groble checkout follow Groble’s notices. Earto stores transaction IDs, product, amount and status from signed payment/refund notifications, excluding buyer phone numbers, emails and card details.

To operate invitations, we process invite codes, account attribution, verification and reward records, and reminder preferences. We do not disclose an invited account’s email or real name to the inviter. We verify account creation dates on the server and identify emails using a keyed hash to prevent duplicate rewards. Referral records and identifiers are retained as needed to operate the program and address abuse, separately from model-generation credits and access.

2. Retention and deletion

Account and private-project material is retained while needed for the account or project service. Project deletion removes its conversations, versions and work data from the service database. Running or paused work may need to be ended first.

Public versions already lawfully acquired by other users and minimal entitlement records are retained separately for redownload rights. Project deletion does not automatically erase those records or external downloaded copies. Unpublication stops new acquisitions.

You can request account closure, access, correction, deletion or restriction through the contact below. After verifying the requester, information whose purpose has ended is deleted or made irrecoverable without undue delay; records legally required for retention are kept separately.

Where the Korean e-commerce retention rules apply, advertising records are retained for six months, contracts/cancellation and payment/supply records for five years, and consumer complaint/dispute records for three years. Only information needed for those purposes is retained.

Error/security records and access-restricted recovery backups may contain some processing data. We review relevant copies on a deletion request and destroy material when its retention purpose ends. External AI retention and erasure also follow the provider's account conditions, so deleting an Earto project does not instantly erase all external copies.

3. AI processing and model improvement

After safety screening of user text and reference images, AI creation and editing send requests to Baseten (DeepSeek), Anthropic (Claude), or the existing account-based AI service according to the selected quality. Necessary prompts, conversation context, reference/annotation images, models and textures may be included. Project titles and image generation use the separate existing GPT routes. Inputs and outputs on the account-based route may be used for model improvement according to that account’s settings. Processing and retention by Baseten and Anthropic follow their respective agreements and policies.

The provider may retain data for security, legal obligations and its own policy purposes. Contact Earto about AI-data processing or deletion so we can review the processing path. We cannot universally guarantee withdrawal of data already de-identified or incorporated into training.

If you do not want AI transmission, do not submit material for generation or editing; you can still browse public pages.

For model-publication and paid-distribution permission and withdrawal, we record the account, target version and model hash, the version of the terms reviewed and the confirmation time. Minimal permission evidence may be retained separately from project material for as long as needed to support acquired licences and rights disputes, and is not disclosed to other users.

4. External services and international processing

These processes support the functions described. You may refrain from the relevant function or ask for restriction/account closure if you do not want international processing; this can prevent delivery of the affected function. Transfers requiring separate legal consent must follow that consent process.

Unifi Direct receives the order reference, product, amount, currency and callback/return addresses for international payments. Earto links the order to your account internally. Private prompts and model files are not sent for payment processing.

Groble checkout receives only a random order reference generated by our server, without account emails, conversations or original models. Names, phone numbers and payment details entered directly in Groble checkout follow Groble’s notices. Earto stores transaction IDs, product, amount and status from signed payment/refund notifications, excluding buyer phone numbers, emails and card details.

5. Public content and browser storage

Only explicitly published model versions and public names are shared. Private conversations, references and account emails are excluded from Store previews. Personal information you place inside public material can nevertheless be seen or downloaded by others.

The browser may store sign-in state, language/preferences, local drafts and pending-payment recovery data. You can sign out or remove site storage through browser settings; doing so may erase device-local drafts and recovery information. Authentication/payment providers use their own necessary cookies and storage.

This policy does not itself subscribe you to advertising personalization or marketing emails.

6. Safeguards, rights and contact

Earto uses HTTPS, account ownership checks, restricted private configuration access and payment signature verification. Rights requests use the minimum necessary identity checks; we do not ask for passwords or card security codes.

Privacy contact: 유정욱, contact@earto.app. Use the subject ‘Privacy request’ and identify the account and requested action. If a legal reason limits a request, we explain it.

In Korea, you may contact the Personal Information Infringement Report Center at 118 or the Personal Information Dispute Mediation Committee at 1833-6972. Member services currently target adults aged 19 or older; when we learn of ineligible use, we review it and take appropriate action.

Updates are announced on this page with their effective date. Additional notice or consent is provided where the law requires it.

Optional usage analytics

When analytics is on, Google Analytics for Firebase measures page visits, public model identifiers, public display names and categories, licence acquisition and download formats, generation type, quality, delivery settings and run outcomes. This helps improve Earto content and user flows. Generation topics are classified locally into a fixed set of groups; the original text is not sent to Analytics. Unrecognized requests remain unclassified.

Google may process pseudonymous analytics cookie identifiers, browser and device information and approximate location derived from IP addresses. Earto does not send email addresses, Firebase UIDs, private project or model names, prompts, raw search terms, reference images, textures or conversations to Analytics. Ad personalization and Google signals are disabled.

When the connection country is identified as the United States and this browser has no saved refusal or privacy signal, analytics starts without a consent prompt. In other countries, including South Korea and Europe, or when the country is unknown, we ask for consent first and do not load Analytics before it is given. Connection country is an IP-based estimate, not proof of nationality or residence. Turning analytics off or declining does not affect sign-in, generation or downloads. You can turn it off anytime in Analytics preferences in the footer; this stops future transmission and deletes Earto analytics cookies. A saved refusal is respected even in regions with default collection, and Global Privacy Control or Do Not Track signals prevent collection. Your explicit choice is kept in this browser for up to 180 days and is not automatically linked to your account or other devices. Default collection is not saved as explicit consent. Previously transmitted information follows the Google Analytics property retention and deletion settings and Google data-processing terms.

Cookie-free visit statistics

Earto uses its self-hosted Umami to estimate daily visitors and count public pageviews, coarse countries, devices and browsers, and major referral sources. These basic statistics are on by default without tracking cookies. The server briefly processes the original IP address and User-Agent to produce a daily pseudonym; the originals are neither sent to nor stored in Umami. The secret changes at midnight in Seoul and the previous secret is erased. We do not connect accounts, sites or different days, or collect search terms, public model names, private work or payment information. Public model IDs are used only within Earto to increment each model’s total views; they are not sent to Umami or stored with account or visitor records. Private screens are excluded.

To understand demand for the local model converter, we record completion and the first download start for each result as operational notifications. Records contain only input format, selected quality, time and a random per-result identifier; Discord receives only format, quality and time, without the identifier. File contents, filenames and account information are not sent. These notices respect the basic-statistics opt-out and GPC/DNT.

A pseudonym can link views within a day, so these statistics are not fully anonymous or an exact count of people. A shared network and browser can merge visitors; network changes or a server restart can split them. Detailed Umami visit events and pseudonyms are automatically deleted from the operational database after at most 90 days; separate operational backups follow their retention schedule. We respect existing analytics refusals and GPC/DNT. You can turn off Basic visit statistics anytime in Analytics preferences in the footer. Only your explicit setting is kept in this browser for up to 180 days. Google Analytics retains its separate regional consent rules.

With separate permission for detailed usage statistics, Umami records actions and outcomes for browsing, downloads, generation, signup, verification, referrals, checkout and manual editing. We send fixed page and setting categories and coarse count and duration ranges, excluding account, model and order identifiers, names, amounts, prompts, images, search terms and raw errors. Actions within a day may be linked using the daily pseudonym above. Basic visit statistics must be on; previous Google consent or default US collection does not enable this option. Turn it off anytime in Analytics preferences. Turning basic statistics off or sending GPC/DNT also stops future transmission. The choice lasts up to 180 days in this browser and events up to 90 days in the operational database. Results after a tab closes and completion of an actual file save may not be observed.

Creem content-safety processing (ended 25 October 2026)

Since 25 October 2026, Earto no longer uses Creem content-safety screening and sends no new requests to Creem. Before then, for content-safety screening of new AI work, Earto sent user-supplied prompts, annotation comments and additional instructions to Creem (Armitage Labs OÜ, Estonia) over HTTPS with a hashed account pseudonym. Text already sent may be processed and retained under the privacy and processing terms of Creem and its service providers. Contact contact@earto.app about related questions or restriction requests.

Dodo Payments

Dodo Payments is the merchant of record for new overseas credit purchases. It processes your email, billing details, payment information and order reference for checkout, tax, fraud prevention and refunds. Card details are entered on its hosted checkout, not stored by Earto. Earto does not send private prompts or model files for payment processing.

Allow ad performance measurement (optional)

Allow Google Analytics and Google Ads to measure ad performance using ad click identifiers and cookies, generation attempts, payment amount and currency, and a transaction identifier for deduplication. No personalized ads, emails, prompts or images. Withdraw anytime in Analytics preferences.

Advertising (Google AdSense and Ad Manager)

Earto shows advertising through Google AdSense and Google Ad Manager. Model converter pages may show Google automatic ads. A rewarded ad is shown only when a signed-in user who has used all available downloads chooses “Watch an ad, get 4 more downloads” in the download dialog; the ad code is not loaded on the page before that choice.

When ads are shown, Google and its partners may use cookies, web beacons and similar technologies, and may process the IP address, browser and device information, and the address and content of the page showing the ad, to serve and measure ads and to prevent invalid traffic. The ad code runs within that page. Earto does not include email addresses, account identifiers, private projects, prompts or original models in ad requests, and requests ads that are not personalized: rewarded ads use limited ads, and converter ads use non-personalized ads with restricted data processing. These settings narrow Google’s processing; they do not prevent it.

Earto does not show ads in the European Economic Area, the United Kingdom or Switzerland, or when the connection country cannot be determined, until a certified consent management platform is connected. Converter ads are not shown when the browser sends Global Privacy Control or Do Not Track. You never have to watch a rewarded ad: free downloads and other features remain available without it.

Completing a rewarded ad adds 4 downloads to that account. To do this, Earto stores per-account ad sessions, grant and usage records and their times, and each new grant is sent to Earto’s operations notifications (Discord) with the account’s display name, a pseudonymous reference, the number of downloads and the time. Earto does not receive personal information about the viewer or per-view ad revenue from Google. Clicking an ad is not required.

You can review how Google uses information from sites that use its services and change your ad settings through the links below.

Importing converter models into Studio

Only when you choose Import into Studio in the converter and agree to the notice, we store the cube model converted in your browser (not your original file), its part structure, its part-number, colour and preview images, the original file name and format, and the consent time and notice version in your private project. Converting or downloading alone sends no file to our servers.

At import, the name and the part-number, colour and preview images are screened by OpenAI’s moderation service. If you later ask the AI for changes, the imported model and its rendered views are processed as described in “AI processing and model improvement”. Imported projects are retained and can be deleted like other projects.

Automated signup detection

At the first verified visit, we check browser automation indicators and browser type, request consistency, and signup frequency from the same connection to identify possible automated signups. We do not collect canvas, audio or font fingerprints, keystrokes or mouse movements. IP addresses are converted to temporary cryptographic digests; repeat-signup records remain in memory for at most one hour.

Scores and reasons are kept on our server for up to seven days and included in existing Discord operations alerts. Discord messages follow the channel's retention and deletion settings. Scores are not actual bot probabilities and do not automatically block signup. Server assessment records are deleted when the account is closed.

Delete account

Profile → Account management → Delete account

Your profile, private projects, conversations and uploads will be deleted. Download files you want to keep first.

Required transaction records and public models already acquired by others are retained separately. Backups and external providers follow the privacy policy.

Remaining credits and payments are reviewed under the refund policy. Closing your account does not waive your right to request a refund.

Work in progress will end with settlement preserved. Unconfirmed charges or external identity and AI-data deletion may need follow-up.

Access and new public distribution stop when a closure request is accepted. Identity deletion, unsettled charges and external data are reviewed separately, with review targeted within 10 days. Check the status or contact support with the request number for outcomes or delay reasons. The status receipt stays in this browser for up to 90 days. A contact needed for transactions or refunds is retained separately only as needed, for at most five years. Access to erasure records is restricted; they are applied when restoring older backups so withdrawn accounts and data awaiting erasure do not return to use. Password reauthentication is handled by Firebase; never send a password to Earto's server or support email.