This policy explains what personal data ALMA processes, why, and your choices. The data controller is ALMA. Privacy contact: not yet published.
What we collect
| Data | Examples | Why |
|---|---|---|
| Account | Discord user ID, username, avatar, registration and Terms acceptance date | To run your account (contract) |
| Credits | Balance, credit ledger, purchase records | To provide and account for credits (contract, legal obligation) |
| Prompts and uploads | Text prompts, enhanced prompts, images, audio, and video you submit; server and channel names; message links | To generate results and show your usage history (contract) |
| Chat memory | Recent /chat messages per channel | To continue conversations (contract) |
| Generated output | Images, audio, video, comic pages, hosted pages | To deliver results (contract) |
| Feedback | Payment preference votes and comments sent with the former /wallet vote, which no longer collects anything; earlier entries are kept until you delete your data | To plan payment options (legitimate interest) |
| Hosted page analytics | Daily-rotating hashed visitor ID, country, device type, browser, referrer | To show page owners view counts (legitimate interest) |
| Technical and security | Session cookie, error logs, rate-limit counters, IP address in server logs | To keep the Service secure and working (legitimate interest) |
We do not sell personal data, do not use it for advertising, and do not use your prompts or Discord messages to train our own models. Login uses only the Discord identify scope — we never see your email or password.
Quality checks
To improve comic generation, some finished comic pages and premises may be reviewed automatically by additional AI models. These reviews are stored without being shown publicly.
Who processes your data
We share data only with providers that help run the Service:
- Discord — Login (OAuth identify scope), bot commands, and delivering results to channels.
- OpenRouter — Routes prompts and uploads to AI model providers for generation.
- AI model providers via OpenRouter — Run the selected model (for example OpenAI, Google, xAI, ByteDance, Black Forest Labs, and others listed in /wiki).
- HeyGen — Talking-avatar video for /clip avatar.
- Exa, Parallel, Pexels — Optional web search and stock images for /chat and /build when enabled.
- Iconify, Kenney, Poly Haven, ambientCG, Openverse, Wikimedia Commons — Free asset libraries for /build. Our server sends them short search words taken from your build request and downloads the files it picks; a chosen photograph is downloaded from the site that hosts it, and a chosen illustration (Open Doodles, Open Peeps) from its makers' file host. No account details are sent.
- Cloudflare — Network proxy, TLS, and DDoS protection for the website and hosted pages.
- Hosting provider (VPS) — Runs the bot, website, and database.
- Fontshare and jsDelivr — Serve web fonts and the animation library to website visitors.
Prompts and uploads you submit are sent to the AI provider for the model you choose. Some free models may log prompts under their own policies; check /wiki for the provider. These providers may be located outside your country, including in the United States and China. Where required, we rely on appropriate safeguards such as standard contractual clauses.
How long we keep it
- Prompts in usage history and jobs: scrubbed after 90 days (cost and model records stay for accounting).
- Chat memory: deleted after 30 days.
- Error logs: deleted after 30 days.
- Hosted page analytics: deleted after 400 days.
- Hosted pages: kept until you or we take them down. Download links expire after 12 hours.
- Pictures you attach to a build request on the website: deleted when that build or change ends, and after three days at the latest. They are sent to the model you picked, like the rest of the request.
- Credit ledger and purchase records: kept as long as tax and accounting law requires, linked only to your Discord ID.
Cookies
The website sets one strictly necessary cookie, ciel.sid, only after you log in. It keeps you signed in for up to 7 days. We do not use advertising or tracking cookies. Fonts and an animation library are loaded from Fontshare and jsDelivr, which receive your IP address.
Your rights
Depending on where you live (for example under the GDPR, UK GDPR, India's Digital Personal Data Protection Act, or California law), you may have the right to access, correct, delete, or port your data, withdraw consent, object to processing, and nominate someone to act for you.
- Export:
/privacy exportin Discord, or "Download my data" on the dashboard. - Delete:
/privacy deletein Discord, or "Delete my account" on the dashboard. - For anything else, email not yet published. We reply within 30 days.
You can complain to your local data protection authority. In India you can contact our Grievance Officer (see Contact) and then the Data Protection Board of India.
Children
ALMA is not for children under 13. If you are under 18, a parent or guardian must agree to the Terms and to how we handle your data, as described here, before you use ALMA; accepting the Terms confirms this. Users under 18 also need a parent or guardian's permission to buy credits. If you believe a child under 13 has given us data, or that someone under 18 is using ALMA without a parent or guardian's agreement, contact us and we will delete the data.
Changes
We will post updates here with a new version date and ask you to accept material changes.