Privacy policy

Last updated 20 August 2026

Short version. We collect the minimum needed to run FleshMode: your account, your payments, the images you upload, and basic technical data. We don't sell your data and we don't use your images to train models. You can delete your account and your library at any time.

The controller of your personal data is Flesh Enterprise Ltd (169 Athalassis Ave, Flat 102, Strovolos, Nicosia 2024, Cyprus). This policy explains what we collect, why, and what you can do about it. It follows the EU General Data Protection Regulation (GDPR).

1What we collect

Account - email address and login credentials.
Payments - handled by our payment provider. We receive the transaction record (amount, date, credits, status), not your full card number.
Images - what you upload and what the Service generates for you.
Usage and technical - IP address, approximate country, device and browser type, screen size, language, and the actions you take in the app.
Support - the messages you send us.

2Why we use it, and on what basis

To provide the Service - generating renders, keeping your library, running your account. Basis: performance of our contract with you.
To take payment and prevent fraud - basis: contract and our legitimate interest in not being defrauded.
To keep the platform safe - enforcing the 18+ rule, detecting abuse and prohibited content. Basis: legitimate interest and legal obligation.
To support you - answering your messages. Basis: contract.
To improve the product - aggregated, non-identifying usage statistics. Basis: legitimate interest.
Marketing email - only if you opt in. Basis: consent, withdrawable at any time.

3Your images

Uploads are sent to our server only to generate the render. The finished render and any saved library items are stored locally in your browser using IndexedDB. If you clear your browser data or history, use private browsing, or switch devices, your library will not be available.

We do not use your images to train models and we do not sell or publish them. Automated and, where necessary, manual checks run against uploads to catch prohibited content - that is the only case where a person on our side may view an image.

Images of an identifiable person may count as special-category data in your country. Only upload someone's image if they are an adult and have consented.

4Cookies

We use cookies and similar storage that are strictly necessary to keep you logged in and to remember your settings. If we add analytics or any non-essential cookie, we ask for your consent first. You can clear or block cookies in your browser, but the app may stop working properly.

5Who we share it with

Service providers acting on our instructions - hosting, image generation infrastructure, payment processing, email delivery, error monitoring. They are bound by contract and may only use the data to provide their service to us.
Authorities - where we're legally required to, or to protect someone's vital interests. Suspected child sexual abuse material is always reported.
A buyer, if the business is sold or merged, on the same terms as this policy.

We do not sell personal data and we don't share it with advertisers.

6International transfers

Some of our providers are outside the European Economic Area. Where that happens we rely on an adequacy decision or the European Commission's Standard Contractual Clauses. Copies are available on request from fleshmode@proton.me.

7How long we keep it

Images - until you delete them, or until your account is closed.
Account data - deleted within 30 days of account closure.
Payment and invoice records - for as long as tax and accounting law requires.
Abuse and moderation records - kept longer where needed to stop a banned user returning or to comply with a legal obligation.

8Your rights

Under the GDPR you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; or send it to another provider. You can withdraw consent at any time - that doesn't affect what we did before you withdrew it. Email fleshmode@proton.me and we'll respond within one month.

You can also complain to your national data protection authority. In Cyprus that is the Office of the Commissioner for Personal Data Protection.

9Security

Data is encrypted in transit and at rest, access is limited to staff who need it, and we log administrative access. No system is perfect - if a breach affects you, we will notify you and the regulator as the law requires.

10Children

FleshMode is strictly 18+. We do not knowingly collect data from anyone under 18. If we find such an account, we delete it.

11Changes

If we make a material change to this policy, we'll tell you in the app or by email before it takes effect.

12Contact

Flesh Enterprise Ltd
169 Athalassis Ave, Flat 102, Strovolos, Nicosia 2024, Cyprus
fleshmode@proton.me

One inbox, read by a person. Privacy requests, data deletion, complaints and everything else go to the same place - you never have to work out which address your question belongs to.