Bicep Heart · 2026-11-09

Privacy policy

Service operator

Mingzhu Wang

Operator and privacy contact

Bicep Heart (bicepheart.run) is operated by Mingzhu Wang. Contact support@bicepheart.run for account, photo, payment, safety or privacy questions.

Information we process

We process your email, sign-in identifiers, password hashes and Google name, uploaded photo, selected scene, generation status and files, credit and order records, support messages and operational security records. We do not receive your full payment-card number or your email password. We do not run a public customer gallery or our own face-recognition identity database.

Why we use this information

We use account information to sign you in, photos and generation settings to create the output you request, transaction records to maintain credits and handle payments, and support and security records to resolve problems and prevent misuse. We do not sell customer photos or publish them as advertising examples. Public fictional examples are separate from customer uploads.

Generation, hosting and payment providers

Cloudflare hosts the website, account database and private media storage. Google provides optional Google sign-in. Resend delivers account-recovery messages. EvoLink processes the photos and scene instructions through Wan 3.0 for videos and Nano Banana 2 Beta for the optional free picture. Your photo and the selected motion or pose reference are sent for the creation you request. PayPal processes PayPal payments when offered at checkout. Waffo Pancake is a planned additional checkout provider subject to its approval; it does not currently process purchases on this website. Only payment methods actually shown at checkout are available. These providers may process information outside your country under their applicable terms and privacy policies.

Output safety and private access

Before automated delivery, generated media is sent through EvoLink to Gemini 3.1 Flash Lite Preview for an independent visual safety check. This check does not verify identity, ownership, consent or exact likeness, and automated systems can miss content. An uncertain result stays private for operator review; a blocked video restores its charged credit once. Account ownership is checked before a private result is delivered. Authorized operators may review uploaded photos, generated files and task records to investigate delivery, safety, privacy or abuse reports. Do not share private download links. We do not promise that every file receives manual review. Removing our stored copy does not delete copies already downloaded by you or temporarily held by a processor.

File and record retention

Uploaded photos are scheduled for removal after seven days unless an unresolved task still needs them. Video results are available for 30 days after completion. Free picture files expire after one hour; the account retains the record of its one lifetime free request. Temporary creation drafts remain in your browser for up to 30 minutes. Service events, redacted prompt-safety receipts and output-review receipts are scheduled for removal after 90 days. Quarantined files remain private and follow their original media expiry; a blocked file is removed. Expired recovery links, codes, sessions and rate-limit records are cleared by maintenance. Account, credit, payment and support records do not share the media expiry: they remain for account operation, reconciliation, disputes, abuse handling and applicable legal obligations. Contact us for account-data deletion rather than assuming that media expiry deletes these records.

Cookies and optional analytics

Essential cookies keep you signed in, protect requests and remember the selected language. A first-party random browser identifier records service and attribution events and a coarse device category inferred from request headers. We do not retain the full browser user-agent for this device report. Optional Google Analytics and Microsoft Clarity load only after analytics consent when configured. Private account, payment, admin and result screens are excluded from session recording. Photos, passwords, codes, free-text support contents, payment-card details and signed media URLs are excluded from optional analytics events. Use Cookie settings to change your choice. Rejecting optional analytics does not prevent the core service from working.

Access, correction and deletion requests

Email support@bicepheart.run to request access, correction, a copy of your data or deletion of your account or private files. Where applicable, you may also ask to restrict processing, object to a use or withdraw optional consent. We verify account ownership before disclosing or changing personal data. We acknowledge a request within 48 hours and aim to complete it within 30 calendar days, or explain any permitted extension or record we must retain. You may contact the relevant privacy authority if you believe your request has not been handled appropriately. Do not send passwords, API keys, card details or identity documents in an initial support message.

Children and data security

The service is for adults aged 18 or older and accepts photos of adults only. Contact support if a child’s data has been submitted so we can investigate and remove it as appropriate. HTTPS, authenticated access, private storage, bounded media links and restricted operational access protect the service; no internet service can guarantee absolute security. If a security incident requires notice, we notify affected people and authorities as required by applicable law.

Policy updates

The date on this page identifies this policy version. Material changes will be announced on the website or through the account email before they take effect where notice is required. Third-party provider policies govern their own processing and retention; contact us for help with a provider-side data request.

Provider privacy information: Cloudflare, Google, Resend, EvoLink and PayPal.

Contact support@bicepheart.run.