Privacy Policy

What we collect

• Account details. Our authentication provider handles sign-in. It holds your email address, name, profile picture and the sign-in methods you link, such as a Google account, keeps a record of your sign-in sessions (including device and IP address) for security, and gives us your email address, display name and a user ID.
• Your workspace. Threads and their messages (your prompts and the answers), the model that answered, its cost, token counts and response time, citations and tool steps; Spaces, with their descriptions, instructions and pinned files; tags, likes, comparisons and their outputs, artifacts, your custom instructions and your settings.
• Files and media. Files you attach or add to a Space, voice recordings you make with the microphone (up to 90 seconds each), and the images, audio and video you create in Studio, including the prompts and settings you used. Text taken from an attached file can be stored so that it can be given to the model.
• Requests and usage. For each request, our gateway records when it happened, the API key used, the model requested and the model that served it, token counts, cost, response time and status. These records do not hold the text of your prompts or the answers.
• Billing. Your balance, your top-ups (amount, status and date) and the payment processor's reference for each payment. You enter payment details on the processor's checkout page; we receive the amount, the status and a reference, not your full payment details.
• API keys and provider keys. API keys you create in Settings > API keys are stored as a one-way hash and a short hint so that you can tell them apart, and cannot be read back. Your account also has a key that the Service uses on your behalf to run your requests and charge your balance, and partner accounts (resellers and affiliates) have one more for partner features. We store those keys encrypted, in a form our servers can decrypt, because the Service has to use them. Provider keys you attach in Settings > BYOK are stored encrypted, and only a masked version is shown.
• API credit without an account. If you buy credit on the API's top-up page (api.impossi.build/topup) without signing in, we keep the email address you enter and give it to the payment processor for your receipt. We create a new API key for that credit and keep it encrypted, in a form our servers can decrypt, so that the claim link you reach after paying can show it to you. After the payment confirms, the link shows the full key for a few minutes from the first time you open it, and after that only its first few characters. The link stops working 7 days after you start the purchase.
• Guest trial. If you try a prompt without an account, we store a signed cookie and a salted hash of your IP address, not the address itself, to allow one prompt per visitor. A bot-protection check runs in your browser first. The guest conversation is not saved to any account.
• Partner programs. A referral code from an affiliate link, your affiliate earnings, and the business name and note you send with a reseller application.
• Technical data. Our hosting provider and our servers log technical details of each request, such as IP address, browser, the page or endpoint requested, time and errors. Your browser may also send us reports when a page breaks our content security rules; these include the page address and the blocked resource.
• Analytics. On the main Singular site we use Google Analytics to count page views and learn which browsers and devices visit. It is not used on reseller-branded sites.
• Messages you send us, for example when you ask for support or a refund.

How we use it

• To provide the Service: run your requests, keep your history and files, show your costs and charge your balance.
• To keep the Service and its users safe: prevent abuse and fraud, enforce limits and investigate misuse.
• To support you and to tell you about changes to the Service or to these documents.
• To understand and improve the Service, mostly from usage records and analytics.
• To meet legal, accounting and tax obligations.

We do not sell your personal information, and we do not use your prompts, files or outputs to train AI models.

Where the law asks for a legal basis, we rely on: performing our contract with you (providing the Service and billing); our legitimate interests (security, abuse prevention and improving the Service); your consent (analytics cookies, where consent is required); and our legal obligations. [Legal bases to be confirmed in legal review]

Who we share it with

• Model providers and infrastructure providers. To answer a request, its content (your prompt, attachments, the earlier messages in the thread, and any instructions from your settings or Space) is sent to the providers that run the model. Search and web tools send queries and addresses to the providers that perform them. These providers process the data under their own terms, which can include keeping it for a limited time, for example to monitor abuse.
• Service providers that run parts of the Service for us: hosting and databases, sign-in, file storage, payment processing, bot protection and analytics. They may use the data only to provide their service to us.
• Resellers. If you signed up on a reseller's branded site, that reseller can see the usage, spending and balance of the accounts on its site.
• People you share with. A shared thread can be read by anyone who has its link.
• Others when required. We may disclose information when the law requires it, or when it is needed to protect the rights, property or safety of our users, the public or us.
• A buyer or successor, if the Service or our business is sold, merged or reorganized. This policy keeps applying to the information transferred.

Cookies and browser storage

• Sign-in cookies, set by our authentication provider, keep you signed in to the web app. Signing in does not work without them.
• look_guest holds the signed guest-trial token and expires after a few minutes.
• look_ref remembers the referral code of an affiliate link for 30 days, so that a new account can be credited to the affiliate.
• Google Analytics cookies (whose names start with _ga) on the main Singular site.
• Your browser's local storage keeps interface preferences on your device, such as theme, accent color, reading style, sidebar state, pinned threads and an unsent prompt.

You can block or delete cookies in your browser settings. Blocking sign-in cookies stops sign-in from working, and blocking analytics cookies does not affect the Service.

How long we keep it

• Your account, workspace and files are kept while your account exists.
• Deleting a thread removes it from your lists, but the thread and its messages stay in our database until you delete your account.
• Deleting a file or a Studio item deletes it from storage.
• A shared thread stays at its link until you delete your account; deleting or changing the thread does not change the shared copy, and there is no in-app way to stop sharing yet. To have a shared link removed sooner, write to [Privacy contact email].
• To continue multi-step answers, the gateway keeps the content of some chat requests and their responses for up to 30 days (7 days for failed ones), then deletes them automatically.
• Request and billing records are kept as long as we need them for billing, accounting, security and legal obligations, including after an account is deleted. After deletion they are linked only to internal identifiers and revoked keys, not to your profile.
• The gateway keeps the prompt and settings of each video generation job with that job's record. These are not yet deleted on a fixed schedule, and they remain after an account is deleted.
• If you bought credit without an account, the email address you entered and the encrypted copy of the API key are deleted 30 days after the claim link first showed you the key, or, if it never did, 30 days after the link stopped working. We do not keep the copy of your email address that comes back with the payment processor's confirmation. The record of the purchase itself is kept with the other billing records.
• Guest-trial records are kept to enforce the trial limit.
• Server logs rotate and are overwritten automatically. Our hosting provider keeps its logs for a limited period.
• Deleted data can remain in backups until those backups are deleted. We keep about two weeks of daily backups and about two months of weekly ones; if a scheduled backup is missed, an older one is kept for longer. Copies made by hand, for example before maintenance, are not yet deleted on a fixed schedule.

Deleting your account

Settings > Profile > Delete account deletes your account immediately; it cannot be undone. It revokes your API keys, removes your user record from our gateway, deletes your shared links, threads and messages, Spaces, comparisons, artifacts, files and Studio media and your settings, and then deletes your sign-in identity with our authentication provider. Any remaining balance can no longer be used, so ask for a refund first if you want one (see the Terms of Service).

Detach any provider keys in Settings > BYOK before you delete your account. Deletion revokes the API key they are attached to, so they can no longer be used through Singular, but detaching is what deletes the stored, encrypted key.

Your choices and rights

• Export: Settings > Profile > Export all data downloads a JSON file with your profile, threads and messages, Spaces, artifacts, tags, settings, API key details (no secrets) and masked provider keys. Files are listed by name and size; download the files themselves from where they are attached.
• Correct: change your name and email in your account settings.
• Delete: delete your account as described above, or delete individual files and threads.
• Control access: revoke API keys in Settings > API keys and detach provider keys in Settings > BYOK.
• Credit bought without an account: a key bought on the API's top-up page is not listed in Settings. To have it revoked, or to use the rights below for the email address you entered, write to [Privacy contact email].
• Analytics: block analytics cookies in your browser, or use a browser extension that blocks analytics.

Depending on where you live, you may also have the right to access, correct, delete or move your information, to object to or restrict some uses, to withdraw consent, and to complain to a data protection authority. To use any of these rights, write to [Privacy contact email]. We may need to confirm your identity first, and we will answer within the time the law requires.

Security

The web app at singular.impossibuild.ai is served only over HTTPS: a plain-HTTP request to it is redirected to HTTPS. The API at api.impossi.build is also served only over HTTPS: a plain-HTTP GET or HEAD request to it is redirected to the same address over HTTPS, and any other plain-HTTP request, such as a POST, is refused. The redirect or refusal comes only after the request has arrived, so a request sent over plain HTTP, including its API key and its content, has already crossed the network unencrypted. Always use an https:// address for the API, and revoke any API key you have sent over plain HTTP (for a key bought on the top-up page, write to [Privacy contact email] to have it revoked). API keys you create in Settings > API keys are stored as a one-way hash. Provider keys, the account keys the Service uses on your behalf, and API keys bought on the top-up page without an account are encrypted at rest, in a form our servers can decrypt, and your files sit in private storage that is reached only through short-lived signed links. Access to production systems is limited. No system is perfectly secure, so keep your sign-in and your API keys safe and tell us at once if you think they were exposed.

Where your data is processed

We and our providers process data in the United States and other countries, which may have different data protection laws from yours. [Transfer safeguards to be confirmed in legal review]

Children

The Service is not meant for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, write to [Privacy contact email] and we will delete it.

Changes to this policy

We may update this policy. The date at the top of this page shows when it last changed. If a change materially affects you, we will tell you in the app or by email before it takes effect.

Contact

[Operator legal name], [Registered address]. Privacy questions and requests: [Privacy contact email].