Privacy Policy

Prompt safety processing

Before generation, our server checks user-entered text against keyword rules. This check does not send your prompt or photo to Waffo. The generation provider receives the required media and instructions to generate the video and applies its own safety checks. We retain a prompt hash and decision reference for troubleshooting and abuse handling; actual submitted media and generation instructions follow the retention rules below. Prompt approval is not proof of consent, copyright ownership or output safety.

Processing grounds

Where applicable law requires a legal basis: account access, requested generation and support are processed to perform the service contract; fraud prevention and security use legitimate interests, balanced against your rights; accounting and required disclosures meet legal obligations. Optional analytics and any processing requiring consent use consent, which you may withdraw without affecting earlier lawful processing.

Policy changes and incidents

Privacy policy version: 2026-10-24. Material changes will be announced on the website and, where available, by service email before they apply. Where required, new consent will be requested. If a personal-data breach requires notification, we will notify affected users and the appropriate authority within the applicable legal timeframe. Questions and incident reports: thrillerdance_ai@163.com.

Data controller and processing purposes

Thriller Dance AI operates Thriller Dance AI and handles privacy requests at thrillerdance_ai@163.com. Account and service data are used to deliver the service; security and abuse-prevention records are used to protect users; billing records are retained for applicable legal obligations. We do not sell personal information or send marketing email.

Named service providers and international processing

Cloudflare provides website hosting, D1 account storage and R2 media storage. Google provides optional Google sign-in and shares the verified account information you authorize. Support email is handled by the provider of thrillerdance_ai@163.com.

When generation is enabled, NoToken (via self-hosted Hypit) processes the submitted media and prompt for the requested video using Seedance 2.0 Mini. Hypit is the workflow software. When checkout is enabled, Waffo Pancake processes payment and tax information; we store order references and payment status, not full card numbers.

Cloud infrastructure and generation providers may process data outside your country, including the United States and, depending on the selected provider, China. Do not submit material that you cannot lawfully transfer to those services. We do not claim that all processing stays within your country or that an unverified data-transfer agreement is in place.

Privacy requests and security

You may request access, correction, deletion, portability, restriction or objection to processing, and withdrawal of consent where applicable, by emailing thrillerdance_ai@163.com. You may also complain to your local data protection authority. We aim to respond within 30 calendar days, subject to applicable law.

HTTPS protects data in transit. Server credentials stay on the server, passwords are stored as salted hashes, and account pages require authentication. No system is perfectly secure; report suspected exposure to our support email. The service is intended for adults aged 18 or older.

What we collect

If you sign in with Google, we receive your name, verified email address and profile picture. If you register with an email and password, we store your verified email and a salted password hash, never your plaintext password. Verification challenges expire after 10 minutes. When you create a video we store the photo you upload and the video we generate. Payment details are handled by our payment partner; Thriller Dance AI never sees your card number.

How we use it

We use submitted media and background descriptions for the requested video when generation is available. We use your email for account operation, service notices and support; message delivery depends on the configured mail service. We do not send marketing email, sell personal data or train our own models on your photos. Upstream providers have their own processing policies; we do not promise unverified provider-wide training exclusions. We also store session IP addresses and browser details for account security, and report or contact information you submit for handling those requests.

Storage and retention

Files are stored with our infrastructure provider in encrypted form. Uploaded photos are deleted automatically 7 days after upload and generated videos are kept for 30 days after they finish, unless you delete them or your account sooner. Account deletion removes media and anonymizes the account. Order, payment and credit records may be retained for accounting and legal obligations; support, report and safety records may remain where needed to handle disputes or abuse. A one-way email hash is retained to prevent repeat sign-up bonuses.

Safety checks

Uploaded images are checked for supported file types and size; a separate automated image moderation service is not enabled. Background descriptions pass local keyword checks, and the generation provider applies its own rules. These checks cannot confirm every identity, permission or rights issue. Public forms are rate limited; if Cloudflare Turnstile is enabled, it also processes IP addresses and browser signals for bot detection.

Cookies and analytics

The site uses a few cookies and similar browser storage that it needs to work, such as your sign-in session and your light or dark theme preference.

We also set a first-party cookie (vt_attr, kept for 90 days) that records how you first and most recently reached us, such as a referring website or campaign link. We use it only to see which channels lead to sign-ups and purchases, and we do not share it with advertising networks. It is only set after you accept analytics cookies in the banner, and withdrawing consent deletes it.

If you open a friend’s invite link, we set a cookie (vt_ref, kept for up to 30 days and removed once you sign up) so the invite can be credited. To prevent abuse of invite rewards, we store a salted hash of your IP address with the invite, not the address itself. Neither of you can see the other’s account details.

If you accept analytics cookies in the banner, we also use Google Analytics. It sets cookies (such as _ga) and lets Google process your IP address and device information to produce usage reports for us. Google Analytics is not loaded until you accept. You can withdraw consent at any time under “Cookie settings” in the footer, which also deletes these cookies.

Shared videos

If you share a video, anyone with the link can watch it. The share page does not show your name or email and asks search engines not to index it. To make link previews, your browser takes a still frame from the video and we store it with the video. Stopping sharing or deleting the video disables the link and deletes that image; the link also stops working when the video expires or is removed after a report.

Your rights

You can download or delete your videos at any time. In Settings you can export a copy of your data as JSON or delete your account. For any other privacy request, email thrillerdance_ai@163.com.