Privacy Policy

01Who we are

Mocapless is operated by Bar Halifa, an individual based in Israel. Purchases are sold and billed by Dodo Payments, our merchant of record, which issues your invoice and handles applicable taxes.

02What we collect

Your email address and a hashed password, so you can sign in. Passwords are hashed with Argon2 and are never stored or logged in plain text.

The character files you upload, the prompts you write, and the animations we generate for you.

Basic operational logs: request times, error messages and job durations. These do not contain your prompts or file contents.

Basic usage events - which pages you open and which buttons you use, and the prompts you generate - stored on our own servers so we can see where the product fails people. We use no third-party analytics, no advertising pixels and no fingerprinting.

We may look at the animations you generate, and the prompts behind them, to judge and improve their quality. We do this ourselves, on our own systems; nothing is shared or used to train models.

03What we do not do

We do not train models on your uploads, your prompts or your generated animations.

We do not sell your data, and we do not share it with advertisers.

04Who we share it with

Dodo Payments, our merchant of record, processes payments. They receive your email and billing details directly; we never see or store your card number.

If a prompt is too open-ended for our own parser to read, the prompt text alone is sent to a language-model provider to interpret it. Your character files are never sent anywhere outside our own infrastructure. You can see which provider is configured on the service status endpoint.

Our hosting and object-storage providers hold the data at rest on our behalf.

05How long we keep it

Uploaded characters and generated animations are kept while your account is open, so you can re-download them.

Deleting a character removes its file and its generated outputs. Deleting your account removes everything except the billing records we are legally required to retain.

06Your rights

You can export or delete your data at any time from your account, or by asking us. We will respond within 30 days.

If you are in the EU or UK, you also have the right to object to processing and to lodge a complaint with your data protection authority.

07Security

Traffic is encrypted in transit. API keys are stored as keyed digests, not as recoverable secrets, which is why a key is shown only once when created.

If we ever have a breach affecting your data, we will tell you without undue delay.