Privacy Policy

Last updated: 27 August 2026

This policy explains what PhotoCraft collects, why, who else touches it, and how to get it deleted. The short version: we keep the account details we need to run your subscription, your photos go to two computing providers to be turned into builds, and nothing is sold or used to train models.

1.Who is responsible

The data controller is Individual Entrepreneur Ivan Khmelev, registration number [REGISTRATION NUMBER], registered address [REGISTERED ADDRESS]. For any privacy request, write to [email protected].

2.What we collect

  • Account: email address, a hash of your password (we never store the password itself), and optionally a nickname and one of the built-in avatars.
  • Your content: the photos you upload, the 3D model generated from them, the block map of each build, and the isometric preview image.
  • Subscription and tokens: your plan, its dates, token balances, and a ledger of every token movement (purchases, grants, spending, refunds).
  • Support and requests: refund requests you submit, including the build they refer to.
  • Waitlist: if you left an email or Telegram handle on the waitlist page, we keep it until launch communication is done.
  • Technical: standard server and CDN logs (IP address, browser, requested page), and privacy-focused traffic analytics that count visits without profiling individuals.

We never receive your card details: payment data goes straight to our payment provider.

3.Where your photos go

This is the part worth reading twice. To turn a photo into a build we send it to two third-party providers, both in the United States:

  • Replicate — runs the 3D reconstruction model that turns your photo into a 3D model.
  • Anthropic — the vision model that corrects which Minecraft blocks match the colours in your photo.

We keep the primary photo on our own server alongside the generated 3D model, so that a build can be rescaled later without paying for generation again. It is stored encrypted (AES-256-GCM): on disk it is a block of ciphertext, not a picture — nobody can open it in an image viewer, browse a folder of user photos, or look at yours out of curiosity. It is decrypted only for the moment a rescale needs it, into a temporary file that is deleted as soon as the job finishes.

Deleting a build deletes that photo and the 3D model with it, unless another of your builds was made from the same file.

4.Why we are allowed to process it

  • To provide the service you signed up for — generating, storing and delivering builds (performance of a contract).
  • To take payment, keep a token ledger and answer support and refund requests (contract and legal obligation).
  • To keep the service secure and to prevent fraud and abuse (legitimate interest).
  • To measure aggregate traffic so we know what to build next (legitimate interest).

5.Who else processes your data

Your photographs go to two named providers, both in the United States, because that is a transfer worth naming rather than describing in the abstract:

  • Replicate — runs the 3D reconstruction model on your photo.
  • Anthropic — the vision model that maps the colours in your photo to Minecraft blocks.

The rest of the data is handled by the ordinary infrastructure behind any website, which we describe by category so this page stays accurate when a supplier changes:

  • A hosting provider — the server that runs the application and stores the database, your builds and the encrypted photo cache.
  • A CDN and security provider in front of the site, which sees request metadata such as your IP address.
  • A privacy-focused analytics provider that counts visits without profiling individuals.
  • A payment provider acting as merchant of record, which handles the payment, billing details and invoices; it is named on your receipt and in the checkout.

Want the current list by name? Ask us at [email protected] and we will tell you who they are.

We do not sell your data, do not share it for advertising, and do not use your photos or builds to train any model.

6.How long we keep it

  • Account details: while your account exists.
  • Builds, block maps, previews, the 3D model and the source photo: until you delete the build or ask us to delete your account.
  • Token ledger and payment records: kept after account deletion where accounting rules require it, and no longer than those rules require.
  • Login sessions: the token in your browser is valid for 30 days.
  • Server and CDN logs: short-term, for security and debugging.

7.Your rights

You can ask us to show you the data we hold about you, correct it, delete it, or send it to you in a portable form; you can object to processing based on legitimate interest. Write to [email protected] from the address on your account and we will answer within 30 days.

You can delete individual builds yourself from your library at any time — that removes the block map, the preview, the 3D model and the source photo.

You can also ask us to erase everything we hold about you. Write to [email protected] from your account address and we delete your account, every build with its block map and preview, every generated 3D model and every source photograph you ever uploaded. The only thing that survives is the minimum payment and accounting record the law requires us to keep, and it is kept no longer than that. Deletion is permanent — we cannot bring a build back afterwards, so export anything you want to keep first.

8.Cookies and browser storage

We do not use advertising or tracking cookies. Your browser stores what the app needs to work: your login token, and the contents of the build form on the upload page — the name, the scale and the photos you selected — so that leaving the page does not lose your work. That form data stays in your browser and is only sent to us when you press Generate.

Our analytics provider and Cloudflare set their own minimal technical identifiers to count visits and protect the site.

9.Children

The service is not intended for anyone under 13, and we do not knowingly collect their data. If you are younger than the age of digital consent in your country, a parent or guardian has to agree on your behalf and is responsible for the account.

If you are a parent and believe your child created an account, write to [email protected] and we will delete it and everything in it.

10.Changes to this policy

If we change how we handle your data in a way that matters, we update this page and announce it by email or in the app before it takes effect. See also our Terms of Use.

PHOTOCRAFT IS NOT AN OFFICIAL MINECRAFT PRODUCT. NOT APPROVED BY OR ASSOCIATED WITH MOJANG, 4J STUDIOS, MICROSOFT, SONY OR NINTENDO.