Privacy Policy
Last updated 24 September 2026
This is what Lupi collects, why, who else touches it, and what you can do about it. It applies to the Lupi website and the iOS and Android apps.
What we collect
- Your account: email, name, username, bio, birth year, a hash of your password (never the password itself), the invite you joined with, and when you accepted these terms.
- Your photo: if you add one, it is your profile picture and, when you choose to star, the face placed in scenes made for you. This is sensitive data; we use it only for that.
- What you make and say: the directions you type, your comments, the scenes made for you, reports you file and the people you block.
- How you watch: which scenes you see, how long you watch, likes, passes and the reasons you give, saves, shares and friends. This is what shapes your feed.
- Roughly where you are: country and city from your browser's time zone and language, so scenes can be set somewhere that feels like home. We do not use GPS.
- Technical data: a session cookie that keeps you signed in, and your IP address, used in memory to limit abuse such as password guessing.
We do not sell your data, and we do not use advertising trackers.
Why we use it
- To run your account and the service you asked for (our contract with you).
- To make and recommend scenes, and to put you in the ones you choose to star in (contract and consent).
- To keep people safe: moderation, reports, blocks, limits and abuse prevention (legitimate interest).
- To meet legal obligations.
Who else processes it
We share data only with the providers that make Lupi work, and only what each needs:
- fal.ai — renders scenes. Receives scene descriptions and, for scenes starring you, your photo, which fal stores under its own retention policy.
- OpenRouter and the model providers it routes to — write scene descriptions, check text for policy violations, grade rendered scenes, and may render scenes. Receives the text you type, scene descriptions and still frames.
- RunPod — GPU servers that may render scenes. Receives scene descriptions, never your photo.
- xAI — when configured, writes scene descriptions and text embeddings.
- Our hosting provider, which runs the servers and stores the database, videos and photos.
Some of these providers are outside your country; where the law requires it, transfers use standard contractual safeguards.
How long we keep it
As long as your account exists. When you delete it — from your profile settings, at any time — your account, photo, comments, likes, history and every scene of your face are deleted from our database immediately. Scenes you asked for that do not show you stay in the shared library with nothing linking them to you. Copies in our backups age out on their normal schedule, and copies held by the providers above follow their retention policies.
Your rights
You can see and correct most of your data in the app, and delete your account there. You can also ask us for a copy of your data, to correct or erase it, to restrict or object to how we use it, or to withdraw a consent — write to support@lupi.lol and we will answer within 30 days. If you are in the EU, UK or Brazil you may also complain to your data-protection authority.
Children
Lupi is not for children under 13, or under 16 in Europe. We ask for a birth year at signup and do not open accounts below that age. If you believe a child has an account, tell us and we will delete it.
Changes
We will post changes here and, if they matter, tell you in the app before they apply. See also our Terms of Service.