Legal

Privacy Policy

Last updated 17 September 2026

AnyTatt is private by default. Without an account, nothing you upload leaves your device. With an account, you choose what is synced.

What stays on your device

The studio runs in your browser. Photos and designs you upload, arm measurements, placements and exports are kept in your browser's local storage on this device. They are never sent to us unless you sign in and turn on account sync. "Clear all pieces" in the Export tab removes the designs and placements; measurements are replaced when you change them.

What we receive when you sign in

Sign-in uses Google through Firebase Authentication. We receive your Google account identifier, your email address and whether it is verified. We store, against that identifier:

• your plan (free, or an internal testing plan for the operator's own account),
• a daily count of successful AI generations, kept for 7 days so the limit can reset,
• your project and the images in it, only if you turn on account sync.

We do not receive your Google password. We do not send marketing email.

What is sent when you generate a design

When you use "Create with AI", the text description you typed and the style you picked are sent to our server and passed to Google's Vertex AI (Gemini image model) to make the design. Nothing else is sent: not your photos, measurements or placement. Google processes the request under the Google Cloud terms, and Vertex AI does not use customer prompts to train its models. We do not keep a copy of your prompt; our logs record only that a generation succeeded or failed, its style and the size of the image returned.

Account sync

Sync is off until you switch it on. With it on, your current project (design images, measurements and placements) is stored in Google Cloud Storage and Firestore in the asia-southeast1 (Singapore) region, in a location only your account can read, so you can open it on another device. Turning sync off stops further uploads; deleting your account removes what was stored.

Cookies and analytics

AnyTatt sets no tracking cookies and runs no third-party analytics or advertising scripts. Firebase Authentication keeps your session in your browser's local storage. Google Fonts are loaded from Google's servers, which see your IP address when the page loads.

Deleting your data

In the Export tab, Delete account removes your synced project, images, plan and quota records, and your sign-in identity. It takes effect immediately and cannot be undone. Local data on your device is removed by clearing site data in your browser; Clear all pieces removes the designs and placements only.

Who we are

Changes

If this policy changes in a way that affects what we collect, the date above is updated and the change is described here.