Privacy Policy (Draft)

Draft for review. This page is not an approved live privacy notice. The service is confirmed to be individually operated, using the website name TinyDesk publicly, with a worldwide audience. Operator identity disclosures, service providers, storage locations and retention periods still need confirmation before public account registration or uploads are enabled.

Scope and operator

This draft describes the intended use of data by TinyDesk, an independent AI video creation tool. It is not affiliated with NPR or the Tiny Desk concert series. The service is operated by an individual based in China, uses the website name TinyDesk publicly, and is intended for users worldwide. It is currently a pre-launch preview, with video generation not yet open to the public; feature availability is shown in the interface. Operator identity disclosures, privacy contact arrangements and applicable jurisdiction still need review for the final notice.

Data involved in the service

The final data inventory should cover account email and profile details; sign-in sessions and preferences; prompts, uploaded images and generated video; generation status and credit history; purchase records; and support messages. Optional sign-in, analytics and payment providers must be named only after they are enabled and verified.

Prompts and uploaded media may include personal information. Upload only material you have permission to use, and avoid sensitive personal information. Where an AI provider processes an input, the final notice must explain that provider's role, use of inputs, retention and any international transfers.

Purposes and providers

The intended purposes are account access, requested generation, storage and delivery of results, payment reconciliation, abuse prevention and support. Before launch, the operator must confirm the legal basis for each purpose, the recipient categories, the specific AI and infrastructure providers, and the countries involved. No promise about provider training, data sales or encryption is made by this draft.

Cookies and optional services

Authentication and preference storage should be distinguished from optional analytics, advertising and support widgets. The final notice must list what is actually enabled, how long identifiers last and how visitors can change choices. A cookie settings control appears in the footer only when the application's consent feature is enabled; that feature's configuration still requires review.

Retention and deletion

The following describes the processing implemented in the current version. Public generation is not open yet; cleanup operation in the final deployment and provider retention arrangements still need verification.

• Local photo previews: When generation is unavailable or the account email is unverified, choosing a photo creates a temporary preview in the current browser. That selection does not upload the photo to the server. Reloading or leaving the creation page clears the preview; the original photo on the device is unaffected.
• Uploaded source photos: Photos are stored privately. The application stops serving them 24 hours after a successful upload. Image links supplied to the generation provider have a separate, shorter validity period and cannot extend access to the source photo.
• Physical deletion of expired photos: The application implements a cleanup process that deletes an expired storage object before deleting its metadata. If deletion fails, the record remains available for a later retry. Execution depends on the automatic cleanup task being enabled and running successfully. Automatic cleanup is not yet enabled in the prepared configuration. Access expiring after 24 hours does not mean the file has been physically deleted, and immediate deletion at that time is not promised. The active configuration and deletion arrangements still need verification before public launch.
• Task records and generated videos: The current version stores prompts, character settings, task status and provider result links to display tasks and deliver results. Video is retrieved through the application from the provider; the current workflow does not automatically archive completed videos in the application's photo storage. Provider link availability is not guaranteed by the application. Download available results you wish to keep. The application currently has no uniform automatic deletion period for task records and no one-click account or task deletion feature.
• Other records and provider copies: Account details, support messages, invoices, security logs and backups do not yet have verified, uniform deletion periods; their retention arrangements need separate confirmation. Expiring or deleting a photo on this service does not automatically delete copies already obtained by an AI provider. Provider copies follow the provider's actual arrangements; simultaneous deletion is not promised.

Requests and contact

You can send privacy enquiries or requests for access, correction, export or deletion to the verified support address, support@tinydesk.pro. Include the account email and relevant task identifiers to help locate the records. Do not email passwords or unnecessary identity documents. Requests require manual handling; this is not an instant or automatic deletion feature. The complete request-handling workflow has not yet been verified. Identity checks, applicable response periods and deletion from provider copies still need confirmation before public launch.

Updates

The approved notice should carry its own effective date and explain how material changes will be communicated. The date above records this draft revision only.

Provider information checked for this draft

APIMart’s privacy policy lists prompts, inputs and generated outputs as content data processed through its API. The public policy checked on 29 October 2026 does not state a specific input/output retention period or a blanket no-training commitment. Those details still require provider confirmation; this draft makes neither promise.