Privacy Policy
Effective date: October 1, 2026 · Applies to www.magicyoyoyo.com
The short version
- • You need an account (email or Google) to generate avatars.
- • Your photo is sent to our AI provider (MiniMax) solely to generate your avatar — that is the only reason it leaves our servers.
- • We store your uploads and results so you can view them again, but only your 10 most recent generations. Older ones are deleted automatically.
- • You can delete any or all of your creations yourself, at any time, in the app.
- • We do not sell your personal information.
- • We use Microsoft Clarity to understand how the site is used.
The sections below explain this in full detail.
Who we are
www.magicyoyoyo.com(the “Service”), an AI cartoon avatar generator, is operated by Magic Cartoon Avatar(“we”, “us”). We are the data controller for the personal information described in this policy.
For any privacy question, or to exercise any of the rights in Your choices and rights, contact us at jk3m11@gmail.com.
What we collect
We collect the following categories of information:
| Category | What exactly |
|---|---|
| Account | Your email address, a username (defaults to the part of your email before the “@”), your full name if you provide one, and — when you sign in with Google — your Google profile name and profile picture URL. Also your credit balance and account timestamps. |
| Password | Only if you register with email. Passwords are handled and stored in hashed form by our authentication provider (Supabase) — we never see your password in plain text. Signing in with Google does not involve a password with us. |
| Photos & avatars | The photo you upload, the cartoon avatar generated from it, and the style you selected. See the next section. |
| Payment records | A record of each purchase: amount, number of credits, payment status and the payment reference. We never receive or store your card number — card details are handled entirely by our payment provider. |
| Technical & logs | Your IP address, browser user-agent, device type, an approximate location derived from your IP (country level), the time of each sign-in, and which sign-in method you used. We also keep short-lived records for rate limiting and abuse prevention. |
| Usage analytics | How the site is used — pages viewed, clicks, scrolling behaviour and session replays — collected through Microsoft Clarity. See Cookies and local storage. |
Your photos and avatars
This Service exists to turn a photo of you into a cartoon avatar, so the photo you upload is at the centre of how it works. Here is exactly what happens to it:
- You choose a photo in your browser. Before uploading, the app asks for your explicit consent and tells you the image will be processed by AI.
- The photo is sent over HTTPS to our servers and forwarded to our AI processing provider, MiniMax, which produces the cartoon version. MiniMax receives the image only in order to generate your result.
- The result — and the source photo alongside it — are saved to your account so that you can view and download them again later from My Creations.
- We keep only your 10 most recent generations. Once you exceed that, the oldest entries (source photo plus result) are deleted automatically.
- You can delete any individual creation, or wipe your entire history, at any time from My Creations. Deletion takes effect immediately.
What we do NOT do with your photos
- • We do not use them to identify or authenticate you.
- • We do not create biometric templates, faceprints or any other biometric identifier from them.
- • We do not use them to train AI models.
- • We do not sell, rent or share them for advertising.
- • We do not publish them — your avatars are never shown to other users.
Please upload only photos of yourself, or photos of someone who has given you permission to use them this way. Do not upload images of other people without their consent, and do not upload images of children.
How we use your information
We use your information only for the purposes below.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating your account, signing you in, showing your credit balance | Account data, credentials, log data | Performance of a contract |
| Generating your cartoon avatar and saving it to your history | Your photo, the generated avatar, chosen style | Your consent (given in the AI processing notice before upload), and performance of a contract |
| Taking payment and keeping purchase records | Order data, payment reference | Performance of a contract, and legal obligations (accounting and tax) |
| Protecting the Service — abuse prevention, rate limiting, fraud and security investigations | IP address, user-agent, device type, sign-in logs | Our legitimate interests in keeping the Service safe and available |
| Understanding how the Service is used so we can improve it | Usage analytics and session replays | Consent where required by law, otherwise our legitimate interests in improving the product |
We do not currently send marketing emails, we do not sell data, and we do not use automated decision-making to make decisions that produce legal effects about you.
How long we keep it
| Data | Retention |
|---|---|
| Photos and generated avatars | Only your 10 most recent generations; older ones are deleted automatically as you generate more. Anything you delete yourself in the app is removed immediately. |
| Account data | For as long as your account is active. On an account deletion request we delete it within 30 days, except where we must keep records by law. |
| Sign-in and security logs | For as long as your account is active, and for up to 12 months afterwards, so we can investigate abuse and security incidents. |
| Purchase and transaction records | As long as tax and accounting law requires (this period depends on the jurisdiction, typically several years). These records are kept even after you close your account. |
| Rate-limiting records | Minutes to hours — they exist only to slow down abuse. |
| Analytics data | Retained by Microsoft Clarity under Microsoft’s own retention terms, which you can review in Microsoft’s privacy documentation. |
Your choices and rights
In the app, right now. Open My Creations to delete any single creation, or to delete every record of your uploads and avatars in one action. This is immediate and cannot be undone.
By contacting us at jk3m11@gmail.com, you can also ask us to:
- confirm what personal data we hold about you, and give you a copy of it;
- correct anything inaccurate;
- delete your account and the personal data associated with it;
- restrict or object to particular processing (for example, opt out of analytics);
- provide your data in a portable, machine-readable format;
- withdraw any consent you previously gave — for example for photo processing.
We will respond within 30 days. We may ask you to verify that you control the email address on the account before acting on a request, and we will not charge you for exercising these rights.
California and similar US state laws: we do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes beyond providing the Service. You will not be treated differently for exercising any privacy right.
How we protect it
We take a deliberately conservative approach to security:
- All traffic is served over HTTPS.
- Passwords are hashed by our authentication provider — nobody, including us, can read them.
- Access to user data is enforced at the database level (row-level security), so one account cannot read another account’s records even if a client is fully compromised.
- Sensitive account fields (such as your credit balance) can only be changed by trusted server-side code, never directly by a browser.
- Access to production systems is limited, and abuse is rate-limited.
No online service can promise perfect security. If you believe your account has been compromised, contact jk3m11@gmail.com and we will help you secure it.
International transfers
Our service providers are located in several countries, primarily the United States (and our AI provider operates internationally). This means your information may be transferred to, and processed in, a country other than the one you live in.
Where the law of your country requires it — for example if you are in the European Economic Area, the United Kingdom or Switzerland — such transfers are covered by appropriate safeguards, such as standard contractual clauses approved for this purpose. You can ask us for more detail using the contact address above.
Children's privacy
The Service is not intended for children. You must be at least 13 years old to use it, and if you are in a jurisdiction where the age of digital consent is higher (16 in some countries), you must meet that age. If you are under the age of majority where you live, please use the Service only with the involvement of a parent or guardian.
We do not knowingly collect personal information from children, and we ask that you do not upload photos of children. If you believe a child has provided us with personal information, contact us and we will delete it.
Changes to this policy
We may update this policy as the Service evolves. When we do, we will change the effective date at the top of this page. If a change is significant — for example, a new purpose for which we use your photos, or a new category of recipient — we will give notice by email or in the app before it takes effect.
See also our Terms of Service. Questions about this policy? Email jk3m11@gmail.com.
↑ Back to top