Privacy policy

Last updated 19 September 2026

SteamKit is a tool for generating game art. This page explains what we store about you, why, who else sees it, and what you can ask us to do about it.

Who is responsible

The data controller for SteamKit is [TO CONFIRM: legal entity or individual, and address]. For anything on this page, including any of the requests described below, contact [TO CONFIRM: privacy contact email].

What we store, and why

Your account

Your email address, your name and profile picture if you signed in with Google, your plan, and your credit balance. We need these to give you an account at all, which in data protection terms means we process them to perform our contract with you. They stay for as long as your account exists.

What you create

Your prompts, the options you chose, and the images produced. These are yours: we store them so you can come back to them, and because the product has no purpose without them. Assets you generate are private unless you post one to the community feed, and the feed is anonymous — it shows the image and the prompt, never who made it.

Deleting an asset removes it from every view in the app. We keep the underlying record so the credit history stays accurate and so a deletion by mistake can be undone; ask us and we will erase it outright.

Payments

If you subscribe, Stripe handles the payment and we never see your card details. We store the identifiers Stripe gives us for your customer and subscription, your plan, and the billing period, which is what lets the app know what you are entitled to. Invoices are read from Stripe when you open the billing page rather than copied into our database. We keep these records as long as tax and accounting law requires, which is normally six years.

Analytics

Only if you agreed to it. This is the one thing on this page that runs on your consent, which means you can withdraw it at any time and we stop. What it collects, what it does not, and how to turn it off are set out in full in our cookie policy.

Logs

Our servers keep short-lived technical logs of errors and requests, which can include an IP address. We use them to find faults and to stop abuse, which is our legitimate interest in keeping the service working. They are not used to build any profile of you.

Who else sees your data

Four companies process data on our behalf. We use no one else, and we sell your data to nobody.

• Supabase — stores the database, your files and your login session.
• OpenRouter — receives the prompt and any reference image when you generate something, and passes it to the image model you selected. It does not receive your name, email or account id.
• Stripe — handles subscriptions and payments.
• Google Analytics — only with your consent, as described above.

Some of these store data outside your country, including in the United States. Those transfers rely on the European Commission’s standard contractual clauses.

Automated decisions

Nothing on this site makes an automated decision with a legal or similarly significant effect on you. Image generation is automated, but it produces a picture, not a decision about you.

Your rights

If you are in the UK or the EU, the law gives you the rights below. We answer within one month, and exercising any of them is free.

• See your data — ask for a copy of what we hold.
• Correct it — have anything wrong put right.
• Delete it — ask us to erase your account and its contents. Records we must keep for tax purposes are the one exception.
• Take it with you — get your data in a portable format. Your generated images are downloadable from the app at any time, individually or as a zip.
• Object, or ask us to pause — object to processing we base on legitimate interests, or ask us to restrict processing while a dispute is sorted out.
• Withdraw consent — turn analytics off, at any time, from the cookie policy or your settings. It takes one click, the same as turning it on.

If you think we have got something wrong you can also complain to your national data protection authority. In the UK that is the Information Commissioner’s Office.

Children

SteamKit is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.

Security

Your files are private and served through short-lived signed links. Access is enforced in the database itself, row by row, so one account cannot reach another’s data even if the application has a bug. Uploads are re-encoded on our servers, which strips any embedded metadata such as camera or location information. No system is perfectly secure, but these are the measures we take.

Changes to this policy

If we change how we use your data we update this page and change the date at the top. Where a change affects something you consented to, we ask you again rather than assuming the old answer still applies.