Effective date: October 29, 2026
Tiny Desk AI is operated by an individual based in Shenzhen, Guangdong, China ("we," "us," or "our"). The operator acts as the controller of personal information processed to run this service. We operate tiny-desk-ai.online. Our service helps you create Tiny Desk-style AI parody videos using a character photo, a reference video, and optional text instructions.
For privacy, account deletion, security, or rights-holder requests, contact [email protected].
This policy explains how information is handled when you browse the website, sign in, purchase credits, upload media, or generate and download a video. It should be read alongside our Terms of Service.
Tiny Desk AI is an independent service. We are not affiliated with, endorsed by, or sponsored by NPR, Tiny Desk, Charlie Wilson, or The Gap Band.
When sign-in is available, we receive information from the authentication provider you select, such as your email address, display name, profile image, and provider account identifier. We also process account identifiers, credit balances, and information you send in support requests. Do not send passwords or full payment card details to support.
To fulfill a generation request, we process the photo, reference video, media links, and text instructions you submit. We also process settings such as output quality, video duration, task status, generation identifiers, and output links.
A photo or video may contain faces, voices, or other personal information about you or someone else. Only submit material you have permission to use. Avoid uploading identity documents, financial records, sensitive private material, or information that is unnecessary for making your clip.
Generating videos requires paid credits. Purchases are handled through the payment provider presented at checkout, which may be Stripe or Creem. We receive information needed to administer the purchase, such as your account email, order number, selected product, amount, currency, payment status, subscription identifiers, and credit allocation.
Payment details entered in the provider's checkout are processed by that provider. Our checkout integration does not collect or store your full payment card number or security code. See the applicable Stripe Privacy Policy or Creem Privacy Policy.
Our infrastructure may process IP addresses, browser and device information, request timestamps, security events, and error logs. If analytics integrations are enabled, those integrations may also process page views and interaction events. The information processed depends on the integrations operating on the website.
| Information | Main purpose | Recipients where needed |
|---|---|---|
| Account email, name, avatar, and provider identifiers | Sign-in, account administration, and support | Authentication and hosting providers |
| Uploaded photos, reference videos, media links, and prompts | Process your requested generation | Storage and AI generation providers |
| Task identifiers, settings, status, and result links | Deliver results, troubleshoot, and reconcile credits | Hosting, database, storage, and AI providers |
| Orders, payment status, and subscription records | Fulfill purchases and administer billing | Payment, hosting, and database providers |
| Technical logs and enabled analytics events | Security, troubleshooting, and service measurement | Hosting and enabled analytics providers |
We collect information directly from you, from your chosen sign-in provider, from payment and generation status notifications, and through website requests. If required input is not supplied, we may be unable to create an account, complete a purchase, or generate a video.
We use information to:
Where applicable law requires a legal basis, processing may rely on performing our contract with you, complying with legal obligations, legitimate operational and security interests, or consent where required. Optional processing that requires consent must not rely solely on your use of the website as consent.
The service uses third-party infrastructure and AI generation APIs. Your submitted media or media links, prompts, and generation settings are sent to the providers needed to complete your request. Hosting, storage, authentication, payment, and email providers may receive information necessary for their respective services.
The current application integrates with KIE AI and fal.ai for generation and supports Cloudflare R2-compatible storage. Authentication may use Google or GitHub, and checkout may use Stripe or Creem. The providers used for a particular request depend on the enabled service configuration; not every supported integration is used for every visitor.
Faces and voices in submitted media are processed to create the requested synthetic content. This policy does not describe an identity-verification service. Whether a particular provider's processing constitutes biometric processing depends on its actual techniques and applicable law; we do not promise that all face processing falls outside biometric-data rules.
The permission to process an upload for your request is not a separate permission to train our own models or advertise with your likeness. Any additional use requiring permission must be separately explained and authorized. Provider-side training and retention depend on the applicable provider arrangements; we cannot promise a provider-wide training opt-out without verifying those arrangements.
AI and infrastructure providers may process information on systems outside your country. Their handling of information is subject to the applicable service arrangements, their policies, and applicable law. We do not guarantee that every provider uses the same retention period or training settings. Do not assume that a generation request is processed entirely on your device or that providers immediately delete every copy.
We do not claim ownership of your uploaded content merely because you use the service. Uploading material does not give us permission to present someone as endorsing Tiny Desk AI.
Uploaded media and generated videos may be delivered through direct storage or provider links. A person who obtains such a link may be able to access the file without signing in. Treat these links as sensitive; do not publish or forward them unless you intend to share the content.
We do not automatically publish your uploads as a public showcase. A file being absent from a gallery does not mean its direct link is access-controlled. Download results you want to keep; links may expire or become unavailable.
Account, order, credit, and subscription records may be retained while needed to operate your account, administer payments, resolve disputes, prevent fraud, or meet legal obligations. Generation records may include prompts, input and output links, settings, provider responses, and task status.
Uploaded files, generated clips, application records, logs, and backups can have different retention periods. Expiry or deletion of a task record does not necessarily delete the associated file from storage or a provider's systems. We do not promise that all media is automatically or permanently deleted after a fixed number of days.
You may request deletion of your account or submitted content by emailing [email protected]. Include the account email and relevant task or order identifiers so we can locate the records. We may need to verify your identity and retain information required for billing, security, disputes, or legal compliance. Provider copies and backups may follow separate deletion processes. Specify whether you want to delete an account, an individual upload, or a generated video. We review requests, verify identity where necessary, identify the records we control, and explain any applicable retention exceptions. We respond within the period required by applicable law. We do not require a full identity-document copy by default; any additional verification should be proportionate to the request.
Deleting your account and canceling a paid subscription are separate requests. Tell us if you also want renewal canceled so that the relevant payment-provider process can be followed.
Authentication cookies and browser storage may be used to maintain sign-in, remember preferences, and support essential website functions. Supported optional integrations include Google Analytics, Plausible, OpenPanel, and Microsoft Clarity. When enabled, these may process page views, interactions, device information, or session activity according to their configuration. Merely supporting an integration does not mean it is active for every visitor. Enabled analytics integrations may use additional cookies or similar technologies.
You can manage cookies and site storage in your browser. Blocking essential storage may affect sign-in or other functionality. Where consent is required for optional cookies or analytics, applicable consent requirements still apply; this policy does not itself provide that consent.
In addition to operational providers, we may disclose information when reasonably necessary to comply with law, respond to valid legal requests, investigate fraud, enforce our terms, or protect people and the service. If the business is transferred, relevant records may be transferred with it, subject to applicable privacy requirements.
We do not offer uploaded photos, reference videos, or generated clips for sale as personal-data products.
Depending on your location, you may have rights to request access, correction, deletion, restriction, portability, or an objection to certain processing. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing. You may also have the right to complain to the relevant data protection authority.
Email [email protected]. Explain your request and identify the account concerned. Applicable exceptions, identity checks, and response requirements may apply.
We use operational and technical measures intended to protect information, but no online service can guarantee absolute security. Protect your account, uploaded media, and direct download links. Tell us if you suspect unauthorized access.
Our providers may process information internationally. Where applicable law requires safeguards for an international transfer, those requirements apply to that transfer.
Tiny Desk AI is intended for adults aged 18 or older. Do not create an account if you are under 18. Do not upload a child's image or voice without the necessary authority and permissions, and never submit exploitative or sexualized content involving minors. If you believe a child has provided personal information improperly, contact us so we can investigate.
We may update this policy as the service changes. We will revise the effective date and provide additional notice where required. A policy update does not remove obligations concerning information already collected.
For privacy, deletion, billing, security, or content complaints, email [email protected]. The service is individually operated from Shenzhen, Guangdong, China. Include only the information necessary to explain your request.