Last updated 3 September 2026
Security
A short, honest summary of how the product is built to keep your photos and your balance safe.
In transit
Every request between your browser, our servers and the image provider runs over HTTPS. Uploads are never written to a public URL.
Photos
Your photo is passed through to the image provider for the single request that generates your headshot. We do not keep a copy on our servers, and results are held in your browser only.
Accounts and database
Sign-in is handled by a managed authentication provider — we never see or store your password. Every table enforces row-level rules so one account can never read another account's records.
Credits
Credit balances can only be changed by privileged server-side routines. The browser can read your balance but cannot grant or spend credits, so a balance cannot be edited from developer tools.
Reporting a vulnerability
Found something? Email help@flashformal.com with steps to reproduce. We aim to acknowledge within 2 business days and will not pursue action against good-faith research that avoids privacy violations and service disruption.
Questions? Email help@flashformal.com.