PatchmanWho we are and what this policy covers
Patchman provides a connected suite of creative, productivity, storage and communication tools. This policy explains how Patchman ("we", "us" or "our") handles personal information across patchman.io, Account and the Patchman apps, including Dowe, Figur, Flux, Fold, Harness, HookBoy, Outpaint, Repaint, Veil and Visualizer. Contact us at support@patchman.io about privacy or your information.
The information involved depends on the tools you choose, the content you provide and the permissions you grant. A feature-specific notice or permission request explains additional processing at the point of use. This policy covers our handling of information; a third party's own website or service has its own notice.
Information you provide and information generated by use
Account and support. We process your email address, profile name, optional profile image, authentication and recovery information, preferences, support correspondence and account security records. Passwords are stored as password hashes, rather than as readable passwords.
Your work. Depending on the app, this includes uploaded documents, images, audio and video; prompts, reference images and URLs; project settings, masks, layers, versions and exports; file names, sizes and permissions; and processing or activity history. Mail features involve mailbox addresses, sender and recipient details, message contents, attachments, rules, reminders and delivery records. Campaign features involve briefs, social account identifiers, schedules, publishing choices and delivery results.
Transactions and rewards. We keep credit balances, quotes, reservations, charges, releases, purchases, payment references and verified advertising or reward events. Payment providers process payment credentials; we use their transaction references and payment status to administer purchases.
Technical information. Our services and infrastructure receive IP addresses, requested pages, browser and device information, timestamps, session identifiers, error details and security or operational logs. Connected services can return account details, authorization status and operation results needed for the feature you requested.
How and why we use information
We use information to create and secure accounts; deliver, store, edit, convert and export your work; synchronize the settings and projects you save; send or organize mail; carry out authorized publishing and scheduled jobs; process payments and credit usage; verify rewards; provide support; and investigate misuse, failures and disputed transactions.
Where a law requires a legal basis, service delivery and requested transactions rely on performing our agreement with you; fraud prevention, security, reliability and responding to support requests rely on our legitimate interests, subject to your rights; statutory records rely on legal obligations; and optional tracking, advertising personalization or other activities requiring permission rely on consent. We do not treat agreement to these terms as consent to every optional use.
We use operational information to understand failures and improve the service. We do not use access to a connected private mailbox, file library or social account as permission to publish its contents or target advertising from that content.
Files, browser tools and AI processing
Tools that operate locally process the selected material in your browser. Saving a project, uploading an asset, sharing a file or selecting a server-side operation sends the information required for that action to Patchman. Local processing does not mean that a project you choose to save has no server-side records.
For remote AI operations, we send the selected prompt, source material, references and required settings to the provider used for that operation. Review the action and its provider information before submitting confidential content. Different operations can use different providers and processing locations. Browser-local AI does not send your source images, masks or prompts to a remote AI service.
We use your content to provide the operations you request. These permissions do not grant us ownership of your work or permission to make private projects public. Do not submit another person's sensitive information unless you have the necessary authority and an appropriate basis for doing so.
Connected accounts, mail, calendars and publishing
You choose which external accounts to connect and the permissions to grant. We use authorization credentials on the server to perform the requested access, synchronization, delivery and publishing. Disconnecting an integration prevents further use through that connection, subject to tasks already sent to the provider and records we must retain. You can also revoke access in the provider's own account settings.
Mail recipients and publishing destinations receive the material you choose to send. Mail content, calendar events and social account data are used for the relevant user-facing features. AI-assisted handling of private mail requires your selection or an explicitly enabled rule. Remote images, linked content and third-party recipients can involve their own data collection.
Patchman's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Access to Google user data is limited to the authorized user-facing feature; it is not used for advertising targeting or to train generalized AI models. Disconnecting a Google account does not itself delete material you separately saved or published.
Optional rewarded advertising
Account manages Patchman's rewarded advertising with Rocket Sloth, OfferwallAPI and Google Ad Manager as advertising partners. The selected partner can receive an opaque user or attempt identifier, IP address, browser or device details, consent signals and ad interaction information needed to serve the video, prevent fraud and verify completion. Providers and availability differ by region, consent and inventory.
We keep reward attempts, provider transaction identifiers and verified completion or revenue information to assign credits to the correct account, avoid duplicates and handle corrections. We do not send your account password or private creative files to an ad network to personalize an advertisement.
Rewarded videos are voluntary. The offer explains the reward before you start. Test or preview advertisements do not create earnings. Advertising partners operate under their own privacy information, including Google's advertising privacy information. You can decline a video without losing normal access to the service.
Who receives information
We use providers for hosting and delivery, databases and object storage, transactional email, payment and checkout, selected AI processing, connected mail and social platforms, security and advertising. They receive the information needed for their role or the operation you request. Checkout uses Stripe and Superwall; an AI action identifies its configured provider in the relevant operation information.
We disclose information to recipients you authorize, to comply with a valid legal requirement, to protect people or the service against unlawful activity, or in connection with a business transfer subject to appropriate protections and notices. Administrators and support staff access information only as needed for their responsibilities. A request for help is not permission for unrestricted access to your private work.
Retention, deletion and backups
We retain account details and saved content while needed to operate your account and the projects or services you maintain. You can delete supported content in the relevant app or request account deletion. Temporary job data is retained according to the operation's needs; cancelled or uncertain jobs may need reconciliation before records can be closed safely.
Transaction, reward and security records can remain longer where needed for accounting, fraud prevention, disputes or legal obligations. Retention depends on the type of record, whether the account or project remains active, unresolved incidents and applicable requirements. We do not keep every category indefinitely merely because an account once existed.
Deletion from the active service does not instantly erase backup copies, recipient-held copies or independently published content. Backup records remain protected and expire through their retention cycle; restoration must respect completed deletion requests. Ask us about the retention criteria applicable to your information if a particular period is important to you.
Security and international processing
We use access controls, authenticated ownership checks and measures appropriate to the type of information, including protection of sessions and stored integration credentials. No network or storage system is completely secure. Keep your password private, review sharing permissions and report suspected unauthorized access promptly.
Our infrastructure and selected providers can process information outside your country. The location depends on the hosting region and feature provider rather than a promise that all processing stays in one country. Where transfer rules apply, we use the transfer basis and safeguards required by applicable law. Contact us for information about the arrangements relevant to your data and how to obtain details of the applicable safeguards.
Your privacy rights and choices
Depending on the law that applies, you may request access, correction, deletion, restriction or a portable copy of your personal information. You may object to processing based on legitimate interests, including a separate right to object to direct marketing, and withdraw consent for processing that depends on it. Withdrawal does not affect the lawfulness of earlier processing.
Use available account and integration controls or write to support@patchman.io. Tell us which account and request are involved, but do not email passwords, recovery codes or payment card details. We may ask for proportionate verification before disclosing or changing personal data. Some requests are subject to legal exceptions, other people's rights or records required for disputes and accounting.
You can raise a concern with the privacy regulator where you live or where the relevant processing takes place. Contacting us first can help resolve a problem, but does not remove your right to complain to a regulator.
Children and sensitive information
Patchman is a general-audience creative service and is not directed to children. Do not create an account or provide information where you lack the legal capacity or required parental authorization. Advertising and connected services may have additional age or eligibility requirements. Contact us if you believe a child has provided information without appropriate authorization.
Our creative tools are not an invitation to submit unnecessary health, financial, identity or other highly sensitive information. Choose the least information needed for the task and obtain the required permissions for information about others.
Policy changes and contact
We update this policy when our processing or applicable requirements change. The date at the top identifies this version. Material changes receive an appropriate notice; a new purpose requiring consent is not authorized simply by editing this page.
For privacy questions, rights requests or concerns about Patchman's handling of information, contact support@patchman.io. Read the Terms of service for use, purchases and rewards, or visit Help centreSupport for help with a particular app.