Who Can See What You Generate, and How Long We Keep It

Every generator on the internet says your data is safe with them, and almost none of them say what that means mechanically. Where do the bytes physically sit? Which requests can reach them? When is the file actually destroyed, as opposed to hidden? What does the delete button delete?

Those are answerable questions, and the answers are specific rather than reassuring. Here are ours. One of them is an admission.

Where the bytes live

Generated images and videos are stored in our own Postgres database, not in a cloud storage bucket. That is an unusual choice and worth explaining, because it is the reason for several of the properties below: there is no bucket to be misconfigured, no signed URL to leak, and no public object path that exists whether or not anyone is authorised to fetch it. A generation has no address on the open web at all.

What you get instead is an endpoint that looks up the row, compares its owner to the session making the request, and refuses if they differ. There is no unguessable-URL trick anywhere in the design, because unguessable URLs are still URLs.

Who can open them

You can. Your generation history is scoped to your account, and so is the endpoint that serves the actual bytes. There is no public gallery, no shared feed, no explore page, and no way for another user to enumerate or reach what you made.

And two accounts besides yours can: the owners of Fellowi. Admin access is an email allowlist compiled into the app rather than a role anyone can be granted, it is currently those two people, and it exists because someone has to be able to answer “why did this generation fail” and to investigate abuse reports. That screen shows the prompt, the status and the image.

We would rather write that down than let you infer “nobody can see it” from silence. A product that stores your files and tells you no human can ever look is either lying or has no way to handle a support ticket.

How long they last

Thirty days. A scheduled sweep runs and destroys the stored bytes of anything older, replacing them with nothing and stamping the row with the time it happened. Images, videos and any start frame you uploaded for an image-to-video clip all follow the same window.

The row survives the sweep, and it should: it is the record that a generation happened, what it cost and whether it succeeded, which is what the coin ledger reconciles against. The picture is gone. The line item saying you once spent 40 coins is not, and you would want it not to be the first time a charge looked wrong.

Thirty days is also why you should download anything you care about. The retention window is not a backup, and we do not keep a copy somewhere else after it expires. You can also delete any single generation yourself before then, which destroys the bytes on the spot rather than hiding the item from a list.

What deleting your account removes, and what it used to leave behind

Deleting your account revokes every session, anonymises your email so it can be registered again, marks your stored memories deleted, and now destroys the bytes of every image, video and upload you made, in the same transaction.

That last clause was added on 12 September 2026, because it was not true before. Deletion did all the other things and left your generations in the database, where they would sit until the thirty-day sweep happened to reach them. When we went looking, fourteen images belonging to accounts that had already been deleted were still stored. They were purged the same day the fix shipped.

Nobody reported it. We found it while assembling the facts for this post, which is a decent argument for writing things like this down: it is hard to publish a specific claim without first checking whether it is true.

What leaves our servers

Your prompt goes to the rendering provider that actually draws the image. That is unavoidable in the same way that sending a letter requires a postal service, and our privacy policy names the processors involved rather than describing them vaguely.

What does not happen: we do not train models on your content, we do not sell it, and we do not put generated content into analytics or application logs. If you gave marketing consent we share hashed conversion data with an ad platform, which is a purchase event and never a prompt or an image, and withdrawing consent stops it immediately.

One honest caveat about adult work specifically. Nothing above stops a payment appearing on a card statement as a charge from us, and nothing above changes what your own device does with a file you download. Privacy on our side is the part we control; the rest is worth thinking about separately.

The short version

• No public gallery, no shareable link, no object storage.
• Owner-only access, plus two named admins who can look for support and abuse cases.
• Bytes destroyed after 30 days, or the moment you delete the item.
• Deleting your account destroys them immediately.
• No training on your content, no selling it, no prompts in logs.

If any of that changes we will change this page, and if you find something here that is not true, tell us and we will fix the product rather than the sentence. That is roughly what happened to write it in the first place. Generate at Fellowi Images or Fellowi Video, and see what uncensored means here for the content rules that sit alongside these ones.