Privacy Policy
How BicepHeart handles photos, generated videos and account data.
Last updated: 2026-11-07
Last updated: November 7, 2026
Your photo and your account
We process the photo you choose, generation requests, account details, task status and credit transactions to provide this service. Passwords are handled by the authentication system as hashes. Payment providers process payment details; BicepHeart does not store full card numbers.
Photo processing and storage
Photos are sent to fal and the selected Kling model to generate your clip. Cloudflare provides hosting, database and temporary phone-upload storage. Your browser retains your selected photo locally to restore it after sign-in or checkout; use Remove saved photo to clear it. Drafts older than one day are not restored. Clearing browser storage also removes the draft.
Phone QR links
Phone upload and download links are temporary bearer links, valid for ten minutes. Anyone with a download link can access its video until expiry or revocation. Keep the QR code private. Uploaded phone photos are stored in private temporary storage and expired transfers are cleaned up.
Public showcase and private videos
Public is the initial visibility choice. You must separately consent to public showcase consideration before submitting a public generation. Your source photo is not part of the public showcase. Curated approved videos may appear on the site; choosing public does not mean every output is published. Eligible packs and plans unlock private generation.
Retention and requests
Account, payment and credit records are retained for service operation, billing and applicable recordkeeping needs. Provider-hosted outputs are subject to provider retention; download videos you want to keep. We do not promise a deletion schedule for third-party processing that we cannot enforce. Contact us through account support to request access, deletion or removal of a public video.
Cookies and outside services
Necessary cookies support login, security and preferences. The photo draft and task receipt use browser storage. Any optional analytics must follow the configured consent mechanism. External payment, authentication and model providers have their own terms and privacy policies.