Privacy Policy
Updated October 16, 2026 · Operator: MM Studio. Contact email, operator address/country and jurisdiction remain to be supplied. This policy needs review before public launch.
Data we use
Account email and identity, profile name, age band (not exact birth date), acceptance records, guardian requests and authorizations, referral attribution, gem balances and transactions, generated files, reports and moderation actions. Do not upload sensitive personal information or images of children.
Why we use it
Provide the service, authenticate accounts, enforce age and content safeguards, process credits and payments, investigate reports and disputes, and satisfy applicable legal duties. Where required, optional analytics rely on consent. Applicable legal bases and local disclosures depend on the operator jurisdiction, still pending.
Service providers
Lovable Cloud provides account, database and private file storage. Stripe processes payments; we do not collect or store your card number. fal.ai receives clothing prompts and Tripo3D receives model prompts/reference images. Their processing and retention are governed by their respective terms; cross-border processing may occur.
Children and guardians
Under-13 users cannot use BloxForge. Ages 13–17 remain blocked from generation and purchases until a verified adult account requests authorization and MM Studio reviews the guardian relationship. An adult account and checkbox alone do not prove legal guardianship. Do not submit identity documents through prompts or public reports.
Storage and cookies
Essential account/session storage and local preference choices are necessary. No advertising or device-fingerprinting scripts are installed. Optional analytics are off by default; you may change your choice in the footer. Aggregate operational events are recorded to operate the service, without prompt, email, IP or device-fingerprint payloads.
Retention and access
Private generated assets are stored for your account until deleted or moderated. Payment, safety and consent records may need longer retention for accounting or legal obligations. Specific retention periods and international-transfer safeguards must be confirmed before launch. Admin access is restricted to authorized accounts.
Your rights
Depending on your location you may request access, correction, deletion, portability, objection or withdrawal of consent. Use the account report form for a privacy request while the dedicated contact email is pending. We verify requests before disclosing or deleting information; some legal records may need to remain.
Security and incidents
We restrict access to account-owned data and verify payment notifications. No system is risk-free. Material incidents will be investigated and notified where required. Do not send passwords, card details or government documents in reports.