Privacy Policy

Scope

This policy applies to higgskatanaai.com, including the public homepage and any account, payment, or video features when those features are enabled.

Information we handle

When Google sign-in is enabled, we receive an account identifier, name, email, and profile image (avatar), and maintain authentication records needed for login sessions and the account UI. We do not request Gmail or Google Drive permissions, and we do not offer email/password signup.
Google sign-in may be available before payment. Paid generation is available separately for authenticated accounts with credits. A generation request can include one 4–15 second reference video, 1–8 reference images, optional instructions, an audio preference, and technical metadata needed to process a 480p motion-transfer video.
When payment or video features are enabled, we store job status, credit reservations, payment or order references, and private video metadata. We do not store full payment card numbers.
Cloudflare hosting and storage support the service, including account and job records and private media objects. Submitted input objects are retained by higgs-katana-ai for up to 24 hours after a job reaches a terminal state. Finished videos are private, owner-scoped objects and are retained for up to 90 days from processing completion unless you delete them sooner. Deleting a video revokes the application record before object cleanup.
When payment is enabled, Waffo processes checkout and payment details. higgs-katana-ai receives payment and order references needed to grant, expire, or revoke credits.

We use this information to authenticate you, maintain login sessions and the account UI, submit and recover generation jobs when enabled, account for paid credits, deliver private videos, prevent abuse, respond to support requests, and operate and secure the service. We send only the generation content and request metadata needed by the selected provider.

Third-party services

The enabled product may use Google authentication, Waffo payments, Cloudflare hosting and storage, and Higgsfield's API for the prepared Genjutsu Motion Transfer integration. Each service receives the information needed for its stated operation. Google authentication does not give us Gmail or Google Drive access. Provider requests are made by the server and provider URLs are not exposed as public media links.

Higgsfield's current API terms state that request parameters and output metadata can be retained while the API account remains active; generated media is available for at least seven days and may be deleted after that period; provider media URLs are private by default. Those terms also state that API inputs and outputs may be used to improve Higgsfield's models unless the API workspace has an effective training opt-out or a separate no-training commitment. The production workspace setting must therefore be verified before customer generation is enabled, and this policy does not promise that provider-side training is disabled until that verification is recorded. See the Higgsfield API Terms and Higgsfield Privacy Policy.

Microsoft Clarity on the public homepage

On the production public homepage, we use Microsoft Clarity to understand page performance, interaction patterns, and which parts of the tool need improvement. Clarity is not loaded on authentication, dashboard, settings, admin, API, payment, private video, or legal pages. The generator area is explicitly masked, and we do not send your name, email address, account identifier, instructions, uploaded image or video, private media URL, or authentication token to Clarity as an identifier or event.

Without a separate consent manager, the site initializes Clarity Consent V2 with both ad_Storage and analytics_Storage set to denied. This enables Clarity's limited cookieless measurement mode; it does not mean that no technical measurement can occur. We do not use Clarity for advertising or sell browsing data. A browser Do Not Track or Global Privacy Control signal prevents Clarity from loading, and leaving the public homepage stops the SDK before private pages are shown. You can also block third-party scripts or clear browser storage through your browser settings.

Clarity is provided by Microsoft. See Microsoft's Privacy Statement for information about Microsoft's handling of Clarity data.

Retention and deletion

When private video features are enabled, you can delete a finished video from My videos. This removes the application record immediately and schedules object cleanup; backup, security, payment, and legal records may remain where reasonably necessary. To request account deletion, contact jackgao.dev@gmail.com. Account, payment, credit, and security records may be retained for accounting, fraud prevention, dispute handling, and legal obligations. Browser drafts remain on your device until you clear site storage.

Changes and contact