Privacy Policy

Last updated: 2026-09-03

This policy explains how ImagineYourBook.com, operated by Chris Mayer as identified in our Impressum, collects and uses personal data.

1) Data We Collect

• Account data (email, authentication identifiers, temporary anonymous-session identifiers, and profile details supplied by your chosen sign-in provider, such as name or profile image).
• Usage data (book prompts, generation metadata, billing/plan state, and service logs).
• Technical data (IP address, browser type, device information, and diagnostics).
• Support data you choose to submit, such as your message, optional reply email, the page where you requested help, and limited technical context needed to diagnose the issue.

2) Optional Analytics and Marketing Tools

Optional browser conversion measurement through Meta Pixel and the OpenAI Ads pixel is used only after you actively consent through our cookie notice. You can reopen your choice any time via Cookie settings in the footer.

Google Analytics and Google Ads conversion measurement use the Google tag (`gtag.js`, measurement ID: G-7PV47M3YW8) installed directly on every page of the site for core traffic and conversion measurement. Meta Pixel (Pixel ID: 990385120007334) remains optional and loads only after consent. The OpenAI Ads base pixel (Pixel ID: 7awiF6rnJY4nWhg3g3jh6Z) is installed site-wide. After consent and after the service confirms that a trial actually began, the same trial-start event may be sent through both the browser pixel and OpenAI's server-side Conversions API, using a shared event ID so it is counted only once.

A confirmed trial start may also be reported to OpenAI's Conversions API without optional cookies. If optional tracking consent was not given, that server event excludes hashed email and customer identifiers and excludes cookie-derived browser references. It may include the conversion event ID, timestamp, plan, source URL, and an OpenAI click reference (oppref) supplied in the landing-page URL.

These providers may receive technical and usage data such as page URLs, referrer information, browser/device details, and event metadata. Depending on the provider setup, processing may also involve transfers outside the EU/EEA subject to the provider's safeguards and contractual terms.

3) Cookie Choice Storage

To remember whether you accepted or rejected optional Meta and OpenAI Ads pixel tracking, we store your cookie choice locally in your browser. This preference storage is used only to manage the notice and your selection.

When a landing page experiment is active, we may store a first-party experiment assignment and anonymous visitor ID to keep page variants consistent and count signup and email-confirmation conversion. Experiment events do not include your IP address, browser user agent, or email address.

If you choose the checkout-first path, Supabase creates a temporary account session before Lemon Squeezy collects your checkout email. We attach the book idea you submitted to that temporary session so it survives checkout. After a signed checkout event, we either let you claim that same account or, when the checkout email already belongs to an account, securely hand the saved idea and billing result to that account. The temporary session is not proof of ownership of an existing account; access to an existing account requires its secure sign-in link.

When Google sign-in is available, we use Google as the identity provider and Supabase to complete authentication, link matching verified-email identities, and maintain your account session. Google and Supabase may process your email address, provider identifier, basic profile information, authentication requests, and related security metadata under their respective privacy terms. We do not request access to Gmail, Drive, Calendar, or other Google services.

4) Affiliate Referral Tracking

We participate in a merchant affiliate program administered by Lemon Squeezy. Pages on this site load Lemon Squeezy's affiliate tracking script. If you arrive through an affiliate link containing an affiliate code (for example, an aff query parameter), Lemon Squeezy creates an anonymous referral identifier in its system so that a qualifying later purchase can be attributed to the referring affiliate. Lemon Squeezy describes this affiliate referral method as cookieless.

For this purpose, Lemon Squeezy may process the affiliate code, referral identifier, page and referrer information, purchase and subscription events, and technical request information such as IP address, browser, device, and timestamps. The current program attribution window is 14 days. We use this information to administer and protect the affiliate program, calculate commissions, prevent fraud, resolve disputes, and understand partner performance.

Lemon Squeezy processes information under its own Privacy Policy. Its processing may involve transfers outside the EU/EEA under applicable safeguards.

5) How We Use Data

• To operate your account and generation workflows.
• To authenticate you through email/password or, when you choose it, Google sign-in.
• To send essential account messages independently from optional marketing, and to send marketing only where our country-based eligibility rule or your explicit consent permits it.
• To process payments/subscriptions and prevent fraud.
• To improve model prompts, reliability, and product features.
• To answer support requests and identify recurring points of confusion or failure in the service.
• To comply with legal obligations and enforce our Terms.

6) Legal Bases

Where the GDPR or similar law applies, we process data as necessary to perform a contract or take requested pre-contract steps, comply with legal obligations, pursue legitimate interests such as service security, fraud prevention, product operations, analytics, and affiliate attribution, and, where required, based on consent. You may withdraw consent at any time without affecting earlier lawful processing.

7) Sharing

We may share data with trusted providers that help operate the service (for example cloud hosting, payments, analytics, marketing measurement, and authentication), subject to contractual safeguards and legal requirements.

We use Sendy to manage marketing newsletter delivery and unsubscribe status. For verified accounts resolved to the United States, Canada, or Australia, we may add the account email to this audience under an opt-out model after the signup notice is displayed. Accounts resolved elsewhere are not automatically added; an existing explicit consent remains valid. Every marketing newsletter includes an unsubscribe option, and an unsubscribed address is not automatically revived.

To apply this rule without requesting precise location, our server sends the connection IP address to Country (country.is) once when marketing eligibility is first checked. We store only the resulting two-letter country code with the profile. If no country can be resolved, we do not automatically add the account to marketing.

We use Resend to deliver behavior-based account and product emails. For delivery, Resend processes the recipient email address, message content, and delivery metadata. Marketing and re-engagement messages include a direct unsubscribe; using it also suppresses the Sendy marketing newsletter.

Supabase authentication messages, password resets, billing and security notices, and other essential account communications are not marketing and continue independently of marketing unsubscribe choices.

When you use the support form, the request is stored with our service provider and a copy may be sent through Resend to our fixed administrative inbox. We do not automatically send mail to an address entered into the public support form. For abuse prevention, the support system stores a salted one-way hash derived from the request connection rather than the raw IP address in the support record.

8) Data Retention

If you claim a book gift, we store its code in your browser for up to 30 days to carry it through signup and associate the gift with your account and its sender. We record claims, qualifying book completion, credit rewards, and daily offer-view and link-copy activity to run the program and measure its results. Senders see aggregate gift and reward counts, not your email address, book contents, or payment details. Authorized administrators can review gift records and associated account emails for support and abuse prevention.

We retain data for as long as needed to provide services, comply with legal obligations, resolve disputes, and enforce agreements. Support messages may also be retained as needed to resolve the request and identify recurring product problems; requests marked as spam may be retained long enough to protect the form from repeated abuse.

Unclaimed temporary checkout sessions and their saved book ideas may be retained for a limited period for checkout recovery, fraud prevention, customer support, and account activation, then deleted or de-identified when no longer needed.

9) Your Responsibilities

Please do not submit personal data in prompts unless you have a lawful basis and permission to do so. You are responsible for ensuring your content and publication workflows comply with applicable laws.

10) Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, and export personal data, as well as the right to complain to a competent data protection authority. Contact us to submit a request.

11) Security

We apply reasonable technical and organizational safeguards, but no system can be guaranteed fully secure.

12) Contact

For privacy requests, contact admin@imagineyourbook.com.