Privacy Policy
Last updated September 21, 2026
PahiWati is run by WPG Interactive Media, LLC, a company registered in Wyoming ("we", "us"). This policy explains what we collect when you use PahiWati, why, who helps us run it, and the choices you have. We are the controller of the personal information described here.
The short version
- Your photos are used only to draw your Pahis. We never save them anywhere.
- We store no face data: no face geometry, no faceprints, no face embeddings and no other biometric identifiers.
- What we save is cartoon art: your chosen look and your finished Pahis, privately in your account until you delete them.
- Every photo is checked automatically before anything is drawn, and every drawing is checked again before you see it.
- You can delete your account and all your images yourself, at any time, in one step.
- We don't sell your personal information, share it for targeted ads, or use ad trackers.
- PahiWati is for people 18 and older.
- You can also ask us to see, fix or delete your data at any time.
This summary is here to help. The full text below is what applies.
1. What we collect and why
Account
When you log in, we collect your email address (or your phone number, if you log in by text message) so we can send you a one-time code and keep your packs in your account. We don't use passwords.
News and offers. When you log in there's a tick box, off by default, asking whether you'd like to hear from us. We only send news or offers to people who ticked it, and we keep the date you did so. If you'd rather not, leave it alone and we'll only ever email you sign-in codes and answers to messages you send us. You can change your mind at any time from the switch in My packs, or by using the unsubscribe link in any email we send.
Photos you add
The photos you take or upload are used to draw your cartoon looks and Pahis. See section 2 for exactly how they're handled.
Looks, Pahis and packs
- Looks you draw are illustrations: a cartoon drawing of you in the art style you picked, which the app uses as the reference for the rest of your Pahis. A look is ordinary image art, not a photo and not a measurement of your face. Looks are saved privately in your account while you're logged in, so you can find them on any device, and a copy is kept in your browser for speed. We keep your 20 most recent looks and drop older ones. Logged out, a look is kept only in your browser on this device, until you clear it or log in.
- Finished Pahis are saved privately in your account with the look you chose, each reaction's name and your drawing settings, so you can download them again on any device.
My page (optional)
If you choose a nickname, star Pahis or turn on My page, we store those choices. While My page is on, anyone with its link can see your nickname and small watermarked previews of your starred Pahis. It's off by default, never shows your photos, and you can turn it off or get a new link at any time.
Purchases
Payments are handled by Paddle.com, our reseller and merchant of record. We receive your order number, which pack you bought, the price, currency and whether it was paid or refunded. We never see your card or bank details.
Usage and limits
We count the images each account draws (and whether each was a look, a Pahi or a redraw) to apply daily limits, your Pahi balance and free redraws.
App usage events
To learn what works, we record simple events like opening the app, adding photos (the number, not the photos), drawing, starring and downloading for a particular app. Events use a random ID stored in your browser and are linked to your account when you're logged in. They never include photos, images, prompts, names or email addresses.
Free look before login
If you try PahiWati without logging in, we set a cookie with a random ID so each browser gets one free look. We store only a scrambled (keyed hash) version of that ID and of your IP address, with the IP version changing every day, to enforce the limit. The clean version of your free look is encrypted and can only be unlocked by logging in within 24 hours.
Security and abuse prevention
Our servers briefly use IP addresses to limit how many requests one connection can make, and our hosting provider keeps standard request logs (like IP address, browser type and time) to keep the service running securely.
One-tap Telegram (optional)
If you add your pack to Telegram in one tap, the sticker files are placed in temporary private storage and sent to Telegram through our bot, then removed once Telegram has its copy. Telegram's own rules apply after that, and anyone with a Telegram sticker pack's link can add it.
Messages you send us
If you email us, we keep your message and email address to answer you.
2. Your photos and face details
- How they're used. Your photos go from your browser to our server and to Google's Gemini AI service, which studies them and draws your looks and Pahis. They are held in your browser's memory while you work.
- We never save your photos. A photo is held in your browser's memory while you work, and is passed through our server to Google only for the request that needs it. It is never written to our storage, our database or our logs, and it is gone from our systems as soon as that request finishes. To draw more Pahis later, you add your photo again, or draw from the look you already saved.
- Face details. To get the likeness right, the AI finds where your head is in each photo and writes a short description of visible features such as face shape, eyes, hair, facial hair, glasses and skin tone. Your browser also samples your skin color from the photo. These details stay in your browser for this session and travel only with the drawing requests. We don't store them.
- No biometric data. We don't create or store face geometry, faceprints, face templates, face embeddings or any other biometric identifier, we don't use your face to identify you, and we don't keep a database of faces to compare against.
- Google's handling. Google doesn't use requests from paid Gemini API services to train or improve its products. Google keeps requests and results for up to 55 days only to detect and prevent misuse, and authorized Google staff may review content its safety systems flag.
- Automatic content check. Before anything is drawn, the same Google AI service checks each photo against our rules. It refuses photos with nudity or sexual content, anyone who appears to be under 18, violent or hateful content, more than one person, a photo that shows a different person from your other photos, a widely recognized public figure such as a celebrity or politician, and images that aren't a photo of a real person at all. The public figure check is the AI recognizing a very famous person the way anyone would; it doesn't name you, compare you against a face database or store anything about your face. Every finished drawing is also checked for sexual or violent content before you see it or are charged for it. Anything that fails is refused on the spot and isn't saved or drawn, and we store only the reason, never the photo.
- Consent, every time. Before each photo you add, by upload or camera, you tick a box confirming the photo is of you, that you are 18 or older, and that you agree to our Terms and this policy. We record that confirmation with your account (if you're logged in), the time, your IP address and the version of the terms, and our server won't look at a photo without one. Where laws treat face information as biometric data (for example in Illinois, Texas or Washington), that confirmation is your consent. We never sell, rent or disclose face information.
3. Who we share data with
We share personal information only with service providers that help us run PahiWati, under contracts that limit how they use it:
| Provider | What they do | What they receive |
|---|---|---|
| Google (Gemini API) | Studies photos and draws looks and Pahis | Photos, face details, drawing requests and results |
| Resend | Sends the one-time login codes by email | Your email address and the code |
| Supabase | Login, database and private file storage (Singapore region) | Account details, saved Pahis and looks, settings, usage counts |
| Vercel | Hosts the website and servers | Requests to the site, including IP address |
| Paddle.com | Checkout, payments, taxes and receipts as merchant of record | What you buy and the details you enter at checkout |
| Google Fonts | Delivers the font the site uses | Your IP address and browser details when the font loads |
| Telegram | Only if you use one-tap Telegram | The sticker files and emoji for that pack |
We may also share information if the law requires it, to protect people's safety or rights, to investigate misuse, or as part of a merger or sale of the business (in which case this policy keeps applying to your data). Anyone you send your My page link to can see that page.
We don't sell personal information or share it for cross-context behavioral advertising, and we don't use advertising or tracking pixels.
4. How long we keep data
| Data | How long |
|---|---|
| Photos | Never stored by us, and gone from our systems when each request finishes. Google may keep drawing requests for up to 55 days only for abuse monitoring. |
| Face details | Not stored by us. They stay in your browser while you work. |
| Refused photos and drawings | Not stored. We keep only the reason, such as "more than one person", for up to 24 months, never the image. |
| Photo confirmations (consent records) | Up to 24 months, or until you delete your account, whichever comes first |
| Looks | In your account until you delete them, keeping the 20 most recent. A copy stays in your browser until you clear it or log out. |
| Saved Pahis, packs, nickname and stars | Until you delete them or your account |
| Account details and usage counts | While your account exists. Deleted immediately when you use Delete my account, or within 30 days of a deletion request by email. |
| Purchase records | Our copy is deleted with your account. Paddle keeps its own records as long as tax and accounting laws require. |
| App usage events | Up to 24 months |
| Free look limits (hashed browser ID and IP) | 30 days |
| Temporary Telegram files | Removed once Telegram has its copy. The job link stops working after 50 minutes. |
| Whether you asked for news and offers | Until you turn it off or delete your account |
| Emails with us | Up to 2 years after the conversation ends |
5. Cookies and browser storage
We only use cookies and browser storage the app needs to work. There are no advertising cookies.
- Login cookies keep you signed in.
- Free look cookie (pw_guest) limits free looks to one per browser. It lasts up to 180 days.
- Browser storage keeps your looks on this device and a random ID for usage events.
We don't sell or share data for advertising, so there is nothing to opt out of, but we treat Global Privacy Control signals as a request not to sell or share.
6. Your choices and rights
In the app
- Delete my account and all images: in the account menu (the round button at the top right when you're logged in). It deletes your account, every look and Pahi, your public page and your records with us straight away.
- Delete any Pahi or whole pack from My packs.
- Turn My page off, or get a new link so the old one stops working.
- Delete any look or pack from My Pahis, and clear the copies on this device by logging out.
By request
Depending on where you live, you may have the right to access your personal information, get a copy in a portable format, correct it, delete it, object to or restrict certain uses, and withdraw consent. To make a request, email support@wpg.agency from the email address on your account. We'll confirm the request comes from you, respond within 30 days (or sooner where the law requires), and won't treat you differently for using your rights.
If we can't do what you asked, we'll explain why. In US states that offer an appeal, reply to our answer with "Appeal" and we'll review it again. You can also complain to your local data protection authority, such as your EU country's authority, the UK Information Commissioner's Office, or the Philippine National Privacy Commission.
7. Legal bases (EEA, UK and similar laws)
- To provide the service you asked for (contract): your account, drawing looks and Pahis, saving packs, purchases and support.
- Consent: processing your photos and face details, which you can withdraw by not adding photos and asking us to delete your data.
- Legitimate interests: keeping the service secure, preventing abuse, applying limits and understanding how the app is used.
- Legal obligations: tax, accounting and responding to lawful requests.
8. US state privacy notice
This section is for residents of California and other US states with consumer privacy laws. In the last 12 months we have collected: identifiers (email or phone number, account ID, IP address); commercial information (packs purchased); internet activity (app usage events); visual information (photos you add and Pahis made from them); and a short, temporary description of your visible features used only while drawing, which some laws may treat as sensitive information. We don't collect biometric identifiers. We collect them from you and your device, for the purposes described above.
We use sensitive information only to provide the service you asked for, so no separate opt-out is needed. We don't sell or share personal information for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing information of anyone under 16.
9. International transfers
We and our providers process data in the United States, Singapore and other countries. When the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses offered by our providers.
10. Age requirement
PahiWati is only for people 18 and older, and our AI provider doesn't allow use by anyone younger. Please don't upload photos of anyone under 18. If we learn we have data from or about a child, we'll delete it. If you think that has happened, contact support@wpg.agency.
11. Security
We protect data with encryption in transit, private storage that only your account can read, row-level access rules in our database, signed server checks and short-lived links. No online service is perfectly secure, so please keep access to your email account safe. If a breach affects your personal information, we'll tell you and the authorities as the law requires.
12. AI and your Pahis
Looks and Pahis are made with AI. Google adds an invisible SynthID watermark to images its models create, which marks them as AI-generated. We don't use your photos, Pahis or data to train AI models, and we don't make automated decisions about you that have legal or similarly significant effects.
13. Changes and contact
If we make important changes, we'll update the date at the top and tell you in the app or by email before they take effect. For privacy questions or requests, email support@wpg.agency or write to WPG Interactive Media, LLC, 304 S. Jones Blvd #8933, Las Vegas, NV 89107. See also our Terms and Refund Policy.