Privacy Policy

Overview

This Privacy Policy explains how Tactical Boar Inc., a Virginia corporation with its address at 1001 N Randolph St, 204, Arlington, VA 22201, USA (“Rewind.ai”, “we”, “us”), collects and uses personal data. Tactical Boar Inc. is the data controller for the Services. Contact: support@rewind.ai.

This policy applies when you use our website, AI tools, and API (collectively, the “Services”).

By using the Services, you agree to the collection and use of information in accordance with this policy.

Information We Collect

• Account information: email address, password hash, and basic profile settings if you create an account.
• Usage data: pages visited, tool usage, feature interactions, and device/browser metadata.
• Content you provide: prompts, messages, uploaded files (images/audio/docs), and outputs generated by the Services.
• Payment data: payments are processed by our payment processor. We do not store full card details on our servers.
• Visitors without an account: your IP address and browser data (user agent). We use them to count the free daily token allowance and to keep the history of your tool runs without an account. We also set an anonymous session cookie so that the Services recognize your browser between visits.

How We Use Information

• Provide and operate the Services, including processing your requests and tool runs.
• Maintain and improve performance, reliability and user experience.
• Prevent abuse, detect fraud, and ensure platform security.
• Communicate with you about important changes, support requests, and service messages.

Model Training

We do not use your content (prompts, messages, files, outputs) to train AI models unless you explicitly opt in. If optional opt-in training is enabled in the future, it will be clearly disclosed and off by default.

Face Photos and Voice Recordings

Some tools work with photos of faces or voice recordings. We use them only to produce the result you ask for, not to recognize or identify people and not to train AI models. Like other files you upload for a generation, they are deleted from our servers 1 hour after upload; the result is kept in your history. When a tool asks you to confirm that you have the consent of the people shown, we keep a record of that confirmation.

Cookies and Analytics

We use cookies and similar technologies (such as local storage in your browser):

• Strictly necessary: signing in and keeping your session. has_session tells the site that you are signed in; refresh_token keeps you signed in (HttpOnly); anon_token holds your session without an account (HttpOnly, 90 days). refresh_token and anon_token are set by our API.
• Functional: exp_*_bucket remembers which version of a page you see in an experiment; pricing_entry_point and funnel_attr remember where you came to the pricing page from and which page you used before signing up or buying; free_credits_low and free_credits_critical remember when to show the low-balance warning again.
• Local storage: your sign-in token, display preferences such as dark mode, and your choice in the cookie banner.
• Google Analytics 4: usage analytics, with the cookies _ga and _ga_*.
• OpenReplay: recording of about 5% of sessions, with what you type masked.
• Sentry: error reports.

If you visit from the EU/EEA, the UK or Switzerland, Google Analytics cookies and session recording run only after you accept them in the cookie banner. Until then, or if you decline, Google receives only cookieless signals and session recording does not load. Strictly necessary and functional cookies and error reports do not depend on this choice. We remember your choice for 12 months. You can change your choice at any time via Cookie settings in the site footer.

Sharing of Information

• We do not sell your personal data.
• We share data with service providers that process it for us:
  • Google Analytics 4 — usage analytics
  • OpenReplay (hosted by us) — recording a small share of sessions
  • Sentry (hosted by us) — error reports
  • Cloudflare — delivering and protecting the website
  • OpenRouter — most AI models: chat, images, video, text-to-speech and speech recognition; it passes your prompts and files to the provider of the model you choose, such as OpenAI, Anthropic or Google
  • vmodel — video face swap
  • our cloud file storage provider — storing your uploads and results
  • our payment processor — payment processing
  • our previous payment processor — payment records for purchases made before October 2026
• Models we run on our own GPU servers (Stable Diffusion XL, FLUX.2 Klein 4B, Wan 2.2 TI2V 5B, CogVideoX 1.5 5B) process your data without sending it to a third party. We send emails ourselves, without an email delivery provider.
• We may disclose information if required by law or to protect the rights and safety of users and the platform.

Data Retention

We keep your data for these periods:

• Your account (email, name, settings), your generation history (prompts, responses and links to results) and the result files: for as long as your account exists.
• When you delete your account, the text of your prompts and responses is erased; anonymized usage records (type of run, tokens spent, date) remain.
• An anonymous account: 30 days after its last activity.
• Files you upload for a generation: 1 hour after upload. Documents you chat with: 24 hours. Intermediate GIF files: 2 hours.
• Technical records of generation jobs, which include the full prompt, and events from our payment processor: 90 days.
• Emails we have sent: 30 days. Emails that could not be sent: 365 days.
• Records of subscription purchases outlive a deleted account, with the email and name in them anonymized.
• Application logs, Google Analytics and our payment processor keep data under their own retention rules.

You can request deletion of your account and associated data at any time by emailing support@rewind.ai.

Security

We implement reasonable technical and organizational measures to protect information, including encryption in transit (HTTPS/TLS) and access controls. No method of transmission or storage is 100% secure, but we work continuously to improve our safeguards.

Your Rights

• Access, correct, or delete your personal data.
• Object to processing or request portability where applicable.
• Withdraw consent where processing is based on consent.

To exercise these rights, email support@rewind.ai. We respond within 30 days.

We process data to perform our contract with you, for our legitimate interests (security, abuse prevention, improving the Services), with your consent (analytics cookies and session recording where consent is required), and to comply with the law.

You also have the right to lodge a complaint with your local data protection supervisory authority.

California residents

You have the right to know what personal information we collect about you, to delete it and to correct it. Email support@rewind.ai; we respond within 45 days. We do not sell your personal information.

Children, International Transfers and Data Breaches

The Services are not directed to children under 13; we do not knowingly collect their data and will delete it if we learn we have.

We process data in the United States, and our service providers may process it in other countries. When personal data from the EU/EEA, the UK or Switzerland is transferred to the United States or another country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and the Swiss amendments where they apply).

If a data breach affects your personal data, we will notify you and the authorities as the law requires.

Contact

If you have questions about this Privacy Policy, email us at support@rewind.ai or use the contact page.