Privacy policy

Bttr is a product of Red Tail Den LLC, a company formed in Florida, United States, with its address at 882 E State Road 44, Wildwood, FL 34785.

Red Tail Den is the controller of the data described here. You can find the company at redtailden.com.

The minimum Bttr needs to work:

• Your name and email, to create your account and sign you in.
• Your password, which we never store as you typed it — it is kept as a bcrypt hash. Not even we can read it.
• Your sessions. Access lasts 15 minutes and renews with a refresh token we store as a SHA-256 hash, valid for 90 days and single-use. Signing out revokes it. With each session we also store the user-agent (the text a browser or app uses to identify itself). Your IP address is not stored with the session.
• The photos you upload, to process them and return the result.
• The text you write for a retouch or an effect: the instruction for retouching an area (up to 500 characters) or the content an effect asks for, such as a recipe, the points of a summary, or a profession (up to 4,000 characters). We use it to process it together with the photo, and we do not keep it on our server.
• Your AI key, if you choose to connect your own OpenAI or FAL account. It is stored encrypted, and only its last 4 characters are shown on screen so you can recognize it.
• Your account status: whether you are on trial, which plan you have, how many creations are left, and your auto-recharge preferences.
• Your creation history with Bttr-managed AI: the date, the type (creation or retouch), and the style of each one, to keep track of your plan.
• A record of your account's automatic notices (for example, the welcome notice or a payment notice): your address, the kind of notice, the subject, the date, and whether it was sent. Those notices reach you by email, through Resend (see 05).
• Your payments on the web: the customer, subscription, and saved-card identifiers Stripe gives us (never the card number) and the notice Stripe sends us for each charge, with the name, email, and billing country or address of the purchase. If you buy inside the iPhone app, the record of each Apple purchase: the full transaction and renewal information Apple sends us, with the product, the dates, the price, the currency, the App Store country, and the account identifier the app attaches to the purchase.
• Your content reports, if you report a result: the reason you pick, any details you choose to write (optional, up to 500 characters), the AI engine and model that created it, the date, and your account. The report does not include the image.
• What you write to support: your email and what you tell us in the message, including any photos you attach.
• Server logs: every visit to the site and every request to the API is logged, with the IP address and the user-agent, in the web server's access logs. Web server errors, also with the IP address and the user-agent, are logged in the server's system log. The application logs may include your email, when one of your account's automatic notices is recorded, and your account's internal identifier.

We do not ask for government ID, your contacts, or access to your full photo library. On iPhone, the camera and photo permission is used only when you tap to take or pick an image. On Android, the app does not ask for camera or photo permissions: it opens the system camera or photo picker only when you tap.

Your photos are yours. We do not train models on them, we do not sell them, we do not publish them, and we do not hand them over to anyone, except to the AI provider that processes them to give you the result, as explained below.

To produce the result, the photo and any text you wrote for the retouch or effect are sent to the AI provider matching your plan:

• If you have the Your own API plan active or in its trial period and you connected your own key, they go to the provider you connected, OpenAI or FAL, under your account, and that provider's policy applies to that use. Without that plan, Bttr-managed AI (FAL) is used, even if you have a key saved.
• If you use AI managed by Bttr, they go to FAL, the provider we contract to process them.
• Creating with ChatGPT, from OpenAI, exists only on accounts Red Tail Den turns on by hand for internal use and testing, never on customer accounts. That route does not use the OpenAI API: it uses a ChatGPT account (a ChatGPT subscription) connected to the Bttr server, and it is governed by OpenAI's terms for ChatGPT accounts. Customer accounts always create with FAL (Bttr-managed AI) or with their own OpenAI or FAL key.

FAL processes photos with the GPT Image model from OpenAI. So when the photo and the text go to FAL (with managed AI or with your FAL key), OpenAI also receives them, as FAL's provider.

Photos pass through our server only while they are processed: we do not keep them there. Your projects, with the original photo and its results, are saved on your device.

The original is never overwritten: you always keep the photo exactly as you uploaded it.

• Create your account and keep your session open securely.
• Process your photos and deliver the result.
• Track your trial, your plan, and the creations you have left.
• Charge the subscription or packs you buy and, if you turn on auto-recharge on the web, the packs that are recharged with your saved card.
• Email you your account's automatic notices (the welcome, the code to recover your password, and the notices about your plan, your payments, and your packs).
• Write to you about your account when needed (for example, to tell you about a price change or a change to these terms) and handle what you ask us through support.
• Review the content reports you send us (the reason and the details), detect content that breaks the usage rules, and maintain the security of the service.

We do not advertise with your data and we do not hand it to advertisers.

We work with a short list of providers, each for a single job:

Provider	What for
Stripe	Payments on the web. Your card details go straight to Stripe; Bttr never sees or stores them.
OpenAI	Processing your photos and the text you write: directly, when you connect your own OpenAI key and have the Your own API plan active or in its trial period, and through FAL, which uses its GPT Image model. Also with ChatGPT, through a ChatGPT account and under OpenAI's terms for ChatGPT, only on Red Tail Den's internal and test accounts where we turn it on by hand.
FAL	Processing your photos and the text you write, with OpenAI's GPT Image model: with Bttr-managed AI, or with your own FAL key when you have the Your own API plan active or in its trial period.
Hetzner	Hosting the server, the database and their backups.
Resend	Sending your account's automatic emails: the welcome, the code to recover your password, and the notices about your plan, your payments, and your packs. It receives only your email, your name, and the content of each message (for example, the code, or the plan and the amount).
The email provider for redtailden.com	Hosting the info@redtailden.com mailbox: receiving and storing the messages you send to support, with anything you attach, and our replies.
Apple	Distributing the iPhone app and processing purchases made inside it.
Google	Distributing the Android app through Google Play.

Each provider receives only what it needs for its job and protects your data at least as described in this policy. The ChatGPT route, which exists only on Red Tail Den's internal and test accounts, is governed by OpenAI's terms for ChatGPT accounts (see 03). When you connect your own OpenAI or FAL key, that use is also governed by that provider's policy.

Bttr has its own database, separate from the other Red Tail Den products. We do not share your data between products.

• Your account: as long as it exists. If you delete it, we delete your personal data right away, including your creation history and the record of your account's automatic notices, except for what is listed below.
• Sessions: they expire after 90 days without use and are revoked when you sign out; if you ask us, we close all of them. Their record, with the user-agent, is erased when you delete your account.
• Content reports: kept with no fixed limit even if you delete your account, no longer linked to it, with the reason and the details you wrote. We keep them to review the report, detect content that breaks the usage rules, and maintain the security of the service.
• The messages you send to support: they stay in the info@redtailden.com mailbox until you ask us to erase them, including when you delete your account.
• The web server's access logs and the application logs: they are kept in files that are closed every day, and each file is erased automatically about 45 days after it is closed.
• Web server errors, with the IP address and the user-agent: they stay in the server's system log, which has no deletion period. They are kept there until that log is cleaned up.
• Payment records: the charge notices Stripe sends us (with the name, email, and billing country or address of the purchase) and the record of Apple purchases stay in our database even if you delete your account. Stripe also keeps your customer record, with the charge history and the saved card, if there was one. We keep them for 7 years from each charge, for tax and accounting obligations, and then erase them. If you want us to remove the saved card from Stripe sooner, write to us.
• Automatic server backups: Hetzner, our hosting provider, makes a full copy of the server every day, including the database, the logs and the database backups. Hetzner keeps these copies off the server and retains the last 7: each one is erased automatically after 7 days. Until then they may keep data from a deleted account.
• Database backups: before we change the server we make backups of the database, which are kept on that same server. They are erased automatically after 90 days, although those from the last 5 server changes may stay longer, until there are newer ones. Until then they may keep data from a deleted account.

• Everything that travels between the app or the site and our server is encrypted with HTTPS (TLS). What the server sends to the AI providers, to Stripe, and to Resend also goes over HTTPS.
• Your password is stored as a bcrypt hash; session tokens and recovery codes, as SHA-256 hashes; your AI key, encrypted with AES-256-GCM.
• The database lives on our own server, at Hetzner, and cannot be reached from the internet: only the Bttr application uses it, inside the same server. Access to the server is restricted to the Red Tail Den team.
• Your photos are not kept on the server: the temporary files of each creation are erased when it finishes.
• On the web, your card details are received only by Stripe; for purchases inside the iPhone app, only by Apple. Bttr never sees them.

You can ask us at any time to:

• See what data we hold about you.
• Correct anything that is wrong.
• Delete your account and your personal data.
• Stop receiving email that is not essential to the service.

Write to info@redtailden.com and we will sort it out with you. If you live somewhere whose law gives you additional rights over your data, those rights remain yours and we honor them.

Bttr is intended for people over 18. If you are a parent or guardian and believe a minor in your care created an account, write to us and we will delete it.

If something material changes — for example, if we start collecting a new kind of data or switch providers — you will see it here, with the update date at the top. Continuing to use Bttr after a change means you accept it.

Questions about your data or this policy? Write to info@redtailden.com. A person answers, not an automated inbox.