Privacy Policy

This policy covers mocapgen.com and everything you do while signed in. It is written to be read, not filed. If something here is unclear, write to support@mocapgen.com and we will explain it.

Who is responsible

MocapGen is the data controller for the personal data described here. Privacy contact: support@mocapgen.com.

What we collect

Account data. Your email address, and the display name and profile picture you choose. If you sign in with Google, Google sends us your email address, name and profile picture — we never receive your Google password. If you sign up with an email and password, we store a one-way hash of the password, never the password itself.

What you type into the tools. The prompt you write and the settings you choose (length, motion mode, strength). Prompts are stored with the result they produced.

What you generate. The animations and previews you generate. They are private to your account unless you choose to share one to the public gallery.

No photos, video or likeness in the tools. MocapGen makes animations from text only. The tools never ask you for photos, video, voice recordings or your likeness, and we do not collect them; all we store from the tools is your prompt, your settings and the animations they produce.

Drafts and settings kept in your browser. While you sign in or check out, your draft prompt and settings stay in your own browser storage for up to 24 hours so you do not lose them. They are not sent to us until you submit them.

Purchase records. The order number, what was bought, the amount, the currency, the date, the payment status, and the payment record our processor returns to us. Card numbers and bank details never reach our servers — they go directly to our payment processor. We also keep your credit balance and a ledger of how credits were granted and spent.

Download records. Each time you download a file, we record your account, the item (the generation and variation, or the free library animation), the file format and the time. Free library download records are used to apply the limit of 60 files per account per UTC day and for aggregate statistics; download records for your generations and gallery animations are used to check refund eligibility.

Free preview records. One record per account per UTC day on which you used the free preview, so that the daily limit can be applied.

Moderation records. The outcome of every automated content check on your prompts, and any decision a person makes when reviewing it. When a text is blocked we also keep the blocked text (up to 500 characters) so it can be reviewed and appealed.

Support messages. Anything you send to one of our mailboxes, and our replies.

Usage and device data. Server logs generated by our hosting provider (IP address, URL, response code, timestamp, user agent, referrer), and product analytics events such as which tool was opened or whether a generation succeeded, tied to a random identifier. For website traffic we use Plausible Analytics, which counts visits in aggregate without cookies and without storing your IP address.

Cookies and similar storage. A session cookie so you stay signed in; a random analytics identifier; a utm_source cookie for 30 days if you arrive from a campaign link; and local storage for interface preferences. Any optional cookies would be set only after you click Accept in the cookie banner, and you can change your choice at any time from Cookie settings in the footer. We do not use advertising cookies.

Why we use it, and the legal basis

• Running your account and delivering what you asked for — authentication, generation, credits, subscriptions. Legal basis: performance of a contract.
• Taking payment and preventing fraud, including abuse of free usage. Legal basis: performance of a contract; legitimate interests.
• Moderating prompts under the content policy. Legal basis: legitimate interests in running a safe, lawful service; legal obligation where content is illegal.
• Support, billing and refund requests. Legal basis: performance of a contract.
• Security and availability — rate limiting, abuse detection, logs. Legal basis: legitimate interests.
• Improving the product through analytics. Legal basis: legitimate interests.
• Service email — verification, password resets, receipts. Legal basis: performance of a contract.
• Tax and accounting records. Legal basis: legal obligation.

We do not sell your personal data, we do not use it for targeted advertising, and we do not use it for automated decisions that produce legal effects for you.

Who we share it with

We use the following processors. Each receives only what it needs.

• Cloudflare (hosting, Workers, D1 database, R2 storage) — everything the service stores or serves, including your generated animations in a private R2 bucket.
• AI model providers — the third parties that run the models named in the AI models we use list. They receive the prompt text and the settings a step needs. They receive no account data.
• Waffo Pancake or Creem, as shown at checkout (payments) — our merchant of record. It acts as the reseller of the service to you, handles tax and invoicing, and receives the details you enter at checkout directly; card numbers never reach our servers. Its buyer terms and privacy notice also apply to your purchase.
• Waffo Prompt Sift (prompt screening) — receives the prompt text only, to decide whether it is allowed, and does not store the text it checks.
• Plausible Analytics (website analytics, hosted in the EU) — the page address, referrer, browser, device type and a country derived from your IP address, which Plausible does not store. It sets no cookies and builds no profile of you.
• Resend (transactional email) — your email address and the message content.
• Google — only if you choose to sign in with Google.

We also disclose data where the law requires it, to respond to a lawful request from a public authority, to protect a child's safety, or to establish or defend a legal claim.

International transfers

Our processors operate in the European Economic Area, the United Kingdom and the United States. Where our processors move personal data out of the EEA or the UK, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK Addendum), or by an adequacy decision.

How long we keep it

• Generated animation files — deleted 30 days on credit packs and Starter, 60 days on Pro and 90 days on Studio after they were made. Retention follows the plan you have when our clean-up runs: if you change plans, the new plan's period applies to your existing history. Download anything you want to keep. Animations you share to the public gallery are kept while they are public.
• Prompts and generation records — the prompt text, settings and record of each generation stay in your account history after the files are deleted, so you can see what you made. They are not deleted when the files are, or when you close your account (see below).
• Download records (including free library downloads) — kept while the account exists. When you close your account they stay only against the anonymised account record described below.
• Free preview records — 7 days.
• Account data — kept while the account exists.
• Orders, invoices and the credit ledger — kept for at least 7 years, because tax and accounting law requires it.
• Server logs — up to 7 days.
• Support email — 2 years after the conversation ends.
• Moderation records — kept while they may be needed for appeals and for compliance reviews by our payment partner. The blocked text in them is erased when you close your account; the decision itself is kept.

Closing your account. You can delete your account from Settings → Profile. This cancels any active subscription, ends your sessions, removes your sign-in connections (such as Google) so that signing in again later starts a new, empty account, erases the blocked text kept in moderation records, and irreversibly anonymises your name, email address and profile picture. Order and credit records are kept for the accounting period above, no longer linked to a usable account. Closing your account does not delete your generation records: the prompts, settings and generation history stay in our records against the anonymised account. Your private generated files are then deleted on the schedule for an account without a plan, 30 days after each was made. Animations you shared to the public gallery stay public, so make them private before you close your account if you do not want them shown.

Security

All traffic is encrypted with TLS. Passwords are stored as one-way hashes. Private results live in private storage and are served only through short-lived signed links. Prompt content is redacted and truncated before anything is written to a log. No system is perfectly secure; if a breach is likely to put your rights at risk we will notify the competent authority within 72 hours and tell you directly where the law requires it. To report a vulnerability, write to legal@mocapgen.com.

Children’s privacy

Some of our visitors are young, so we take this seriously.

• MocapGen is not directed at children under 13. We do not knowingly collect personal information from a child under 13 without verifiable consent from a parent or legal guardian, as required by the U.S. Children's Online Privacy Protection Act (COPPA) and similar laws.
• With parental consent, a parent or guardian creates and manages the account for the child, and we collect only what is needed to provide the service: an email address for the account, the prompts and results, and the usage data described above. We do not show a child's name or email on anything public, and we do not use a child's data for advertising.
• Parents and guardians can, at any time, review the personal information we hold about their child, ask us to delete it, and refuse further collection, by emailing support@mocapgen.com. We will verify that the request comes from the child's parent or guardian before acting on it.
• If we learn that we have collected personal information from a child under 13 without parental consent, we delete it and close the account.
• Where the age of digital consent in your country is higher than 13 (for example up to 16 in parts of the EU), that age applies instead.

Your rights

Wherever you are, you have the right to access, correct, delete, restrict or port your personal data, to object to processing based on legitimate interests, to withdraw consent, and to complain to your data protection authority. Email support@mocapgen.com from the address on your account; we answer within 30 days and do not charge for this.

Changes to this policy

We may update this policy. Material changes are reflected in the date at the top of this page and, where appropriate, announced through the service.

Contact

• Privacy questions, data requests, parents and guardians, anything else: support@mocapgen.com
• Legal notices, security reports and copyright complaints: legal@mocapgen.com