Privacy Policy

1. Who is responsible

Aihangsoft (an independent project operated by an individual developer, not a registered company) operates the website at www.aihangsoft.top and is the controller of the personal data described here. Contact us at [email protected] for any privacy request.

2. What we collect

• Account data. If you create an account we store your email address and a one-way hash of your password. We never store your password itself.
• Session data. A session token so you stay signed in. We store only a hash of the token, plus the IP address and browser identifier of the session, so that a stolen token can be traced and revoked.
• Usage records. A ledger of cloud operations: which tool, how many credits were consumed, the remaining balance and the time. This is what makes your credit balance auditable and lets us investigate billing questions.
• A hashed IP address. To apply daily limits and prevent abuse, we derive a one-way hash of your IP address along with a fixed salt. We do not store your raw IP address for this purpose, and the hash cannot be reversed into your address.
• Browser fingerprint, only when you create an account. Free credits are meant for one account per person, so when you sign up we compute a browser fingerprint in your browser with the open-source FingerprintJS library and send it to us together with a hash of your IP address. We use it only to decide whether the new account qualifies for the free daily credits. It is not used for advertising or profiling and is never shared.
• Uploaded files. Only for the Cloud AI tools, and only for as long as it takes to process them. See section 4.
• Payment records. If you buy a plan, our payment provider processes your card details. We never see or store your full card number. We receive confirmation of the purchase, the plan and identifiers that let us match the payment to your account.

We do not build advertising profiles of you, and we never use your files or their contents for tracking. We do load Google Tag Manager, which runs analytics tags that record aggregate usage such as page views and which tools are opened. Section 3 lists the cookies those tags can set.

3. Cookies and local storage

• mf_session, an essential cookie that keeps you signed in. It is HttpOnly, restricted to our site, and lasts up to 30 days. It is set only after you sign in and is removed when you sign out. Because it is essential to a service you asked for, it does not require separate consent.
• mf-theme, your dark or light theme choice, kept in your browser's local storage. It never leaves your device.
• mf-device-uid, a random identifier kept in your browser's local storage and used only if the browser fingerprint cannot be computed, for example when a content blocker stops the fingerprint library from loading. It is sent to us when you create an account, for the same one-account-per-person check described in section 2.

We do not use advertising or profiling cookies, and no cookie is ever used to track the files you process. Analytics tags loaded through Google Tag Manager may set cookies from Google in your browser to count visits and tell repeat visits apart. You can block them in your browser without affecting any tool.

4. How long we keep things

Result files are deleted on a timer and are no longer downloadable once their retention period ends. You should download anything you want to keep promptly. Deletion is automatic; we do not keep a copy for our own use.

5. Who we share it with

We keep sharing to the minimum needed to run the service:

• Volcengine AI MediaKit (Beijing, China) receives your uploaded file and returns the processed result for the Cloud AI tools. It does not receive your account details.
• Creem, our reseller and Merchant of Record. Handles payment collection, invoicing, applicable taxes and refunds, and therefore receives your billing details and email address.
• Our hosting providers host the website and API and necessarily process traffic data as part of serving requests.

We do not sell your personal data, and we do not share it for advertising. We may disclose data where we are legally required to.

6. International transfers

Our servers and the AI processing service are located in China, and our payment provider operates internationally. This means your data may be transferred to and processed outside your country, including in countries whose data protection laws differ from your own. Where required, we rely on appropriate safeguards such as standard contractual clauses offered by our providers. If you are not comfortable with your file being processed in China, please use our browser based tools instead, which never upload anything.

7. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct data that is inaccurate;
• delete your account and the data associated with it;
• receive a copy of your data in a portable format;
• object to, or ask us to restrict, certain processing;
• withdraw consent where processing is based on consent.

Email [email protected] and we will respond within 30 days. You also have the right to complain to your local data protection authority.

8. Security

Passwords are stored only as salted hashes, session tokens are stored only as hashes, and sessions are carried in an HttpOnly cookie that page scripts cannot read. Uploaded files are held under unguessable identifiers and are never publicly listed. Traffic to and from the site is encrypted in transit. No system is perfectly secure, so please use a unique password and tell us promptly if you suspect your account has been compromised.

9. Children

Aihangsoft is not intended for children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

We may update this policy as the service changes. The "last updated" date at the top will change, and for material changes we will give reasonable notice by email or a notice on the site.

11. Contact

For any question about this policy or your data, email [email protected].