Privacy Policy

PanoCraft ("we", "us") runs the web app at panocraft.si. PanoCraft turns text prompts and photos into 360° panoramas, turns panoramas into walkable 3D worlds, and lets you link them into virtual tours. We are the controller of the personal data described in this policy. Questions can go to [email protected].

You can use the home page, pricing, guides, and shared tours without an account. An account is only needed to generate content, so your results, credits, and purchases are saved to you.

If you choose Continue with Google, we use Google Sign-In only to create your account and sign you in. We request the basic sign-in scopes openid, email, and profile, and nothing else.

• What we receive. Your Google account ID, email address, name, and profile picture URL. We do not request access to Gmail, Google Drive, Google Photos, Contacts, Calendar, or any other Google service.
• How we use it. To identify your account and keep you signed in, to show your name and picture in the app, to link your credits and purchases to you, and to send service emails such as receipts. That is all.
• What we never do. We do not sell Google user data, use it for advertising, or use it to train or improve AI models. We do not use any Google API to create, edit, or analyze images, and your Google data is never sent to the AI providers that generate content.
• Sharing. Google user data is processed only by our authentication provider (Supabase) and our own database, to run sign-in. We disclose it to others only if the law requires it.
• Storage and security. Data is encrypted in transit and access is limited to the people who operate the service. We don't store your Google password, and we don't keep Google access tokens on our servers.
• Retention and deletion. We keep it while your account is open. Email [email protected] from your account address to delete your account; we erase your Google user data within 30 days. You can also remove PanoCraft's access at any time at myaccount.google.com/permissions.

PanoCraft's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Account data. Your email address, and the display name and profile picture URL your sign-in provider shares, when you sign in with an email link, Google, or GitHub. We also keep a provider account ID so the same login always reaches the same account.
• Content you submit. Text prompts and the reference photos or panoramas you upload.
• Content we generate for you. Panoramas, 3D worlds, exported files, and the virtual tours you build, including their titles, hotspot text, and descriptions.
• Billing data. Plan, credit balance, and transaction history. Card details are entered on Stripe and never reach our servers.
• Technical data. IP address, browser type, request logs, and error reports, kept to operate and secure the service.
• Usage analytics. Aggregated page views from Vercel Web Analytics, which does not use cookies or build cross-site profiles.

• To run the service: generate panoramas and worlds, store your library, and host your tours (contract).
• To process payments, grant credits, and prevent fraud (contract and legal obligation).
• To keep the service secure and debug failures (legitimate interest).
• To enforce our acceptable use rules, including automatically screening prompts for sexual or non-consensual intimate content, which we block (legitimate interest and legal obligation).
• To send service emails such as sign-in links and receipts. We do not send marketing emails without consent.

We do not sell your personal data, and we do not use your prompts, uploads, or results to train AI models unless you explicitly opt in.

To generate content, your prompt and any reference image are sent to the AI provider that powers the engine you choose (World Labs for 3D worlds, GPU inference on RunPod for panoramas). They process this data only to return the result to us, under their own data processing terms. Only the prompt and images you submit are sent — never your name, email address, or any data received from Google.

We share data only with providers that help us run PanoCraft:

Tours are private by default. If you set a tour to unlisted, anyone with the link can view it. If you set it to public, it may also appear in search engines. You can switch a tour back to private at any time; cached copies held by third parties may take time to disappear.

We keep account data and content while your account is active. When you delete content it is removed from storage within 30 days. When you close your account we delete your data within 30 days, except billing records we must keep for tax and accounting law, typically up to 10 years.

Some providers process data outside the European Economic Area. Where that happens we rely on an adequacy decision or the European Commission's Standard Contractual Clauses.

Under the GDPR and similar laws you can request access to, correction of, deletion of, or a portable copy of your data, and you can object to or restrict certain processing. Where we rely on consent you can withdraw it at any time.

Email [email protected] and we will respond within 30 days. To delete your account and all associated data, send the request from the email address on your account. You may also lodge a complaint with your local data protection authority.

We do not use advertising or tracking cookies. The site stores a few strictly necessary items in your browser:

• aurora_token: keeps you signed in.
• panocraft-theme: remembers light or dark mode.
• aurora_gen_draft, aurora_auth_draft: restore an unfinished prompt or sign-in form.

Stripe may set its own cookies on its checkout pages to prevent fraud.

PanoCraft is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

Data is encrypted in transit, access is limited to the people who need it, and download links for your files are signed and expire after a short time. No system is perfectly secure, but we work to protect your data and will notify you of a breach where the law requires.

We will post updates on this page and change the date above. For material changes we will notify you by email or in the app. Questions: [email protected]. See also our Terms of Service.