Privacy Policy

Last updated: October 9, 2026

1. Who Controls Your Data

Outrun is a product operated by Aporay, an individually-operated business based in Jiangsu, China, which is the data controller for the personal data described below. Contact: support@useoutrun.com.

2. What We Collect, and Why

• Your Google account's email address, when you sign in — used as your account's sole identifier (legal basis: performance of our contract with you; without it, you cannot create an account or use Outrun, since nothing else identifies your account). Google's sign-in response may also include your name and profile picture; these pass through your session but are not written to our database.
• What you build in Outrun: campaign history, brand settings (style descriptions, uploaded logo and reference images), and profile (industry and focus) — used to provide the Service and keep it available across sessions (legal basis: performance of contract). These are optional beyond the core service: if you don't set them, Outrun still works, just without that customization.
• Uploaded images and screenshots — sent to the AI model behind the feature you're using (for example, analyzing a trigger screenshot, extracting brand style from a reference image, or generating a banner) and stored so you can see and reuse what you made (legal basis: performance of contract).
• Support messages: if you write to us from the Support window in the workspace, we keep the text and any images you attach, our replies, and — to help us answer — your account email, your plan and credit balance, and the screen you were on (legal basis: performance of contract, and our legitimate interest in answering you).
• Usage and diagnostic data: which step of a flow you reached, which action you took, the source tag of the link you arrived through (if it had one), and — only when you edit a field the model wrote (like the Overview or a banner's headline) — both what the model originally wrote and what you changed it to (legal basis: our legitimate interest in finding and fixing cases where our models get something wrong; you can object to this by emailing us, though this may limit our ability to diagnose problems with your account specifically). We do not record the model's full output beyond what you actually changed, and we do not store the raw bytes of an uploaded screenshot in this diagnostic data — only that one was provided.
• Billing data: Dodo Payments, our payment provider, collects your payment details directly — we never see or store your card number. We keep your subscription status (and, for a subscription you have cancelled, the date its paid period ends), the Dodo customer and subscription identifiers tied to your account, and a ledger of credits granted or spent, including the Dodo payment id and product behind a purchase-driven credit grant (legal basis: performance of contract, and our legal obligation to keep certain payment/tax records).
• Cookies and browser storage: we set two cookies. One keeps you signed in (managed by our authentication library). The other is set only if you arrive through a link that carries a source tag (for example, one ending in ?ref=followed by a short name): it holds that name for up to 30 days, is read once when you first open the workspace — where it is recorded against your account as the way you arrived — and is then deleted. We use it only to learn which channels our visitors come from. There are no advertising or third-party analytics cookies. A small amount of data is also kept on your own device for convenience: your browser's session storage holds a random id for the current browser tab only, cleared the moment you close it, used solely to group the diagnostic events above into one visit; your browser's local storage may hold a draft you were typing, so it survives a reload. Neither is sent to us as a file — only the diagnostic events described above are.

We do not use your data for advertising, and we do not sell it.

3. Who We Share It With, and Where

• Google, to authenticate your sign-in.
• OpenRouter, which receives the content of a generation request (your trigger text, brief, or an uploaded screenshot/image, as relevant to the feature you used) in order to route it to the AI model that produces your result.
• Dodo Payments, which receives what it needs to process your payment and acts as the Merchant of Record for your purchase; its own use of that data is described in its Privacy Policy.
• Telegram, through which a Support message you send (with the details listed above) reaches us and through which we reply; its own use of that data is described in its Privacy Policy. Telegram keeps its own copy of the messages that pass through it, which deleting your Outrun account does not remove.
• Vercel, which hosts the application and the images described above, and Neon, which hosts our database — both only as infrastructure providers.

These providers may process or store data outside your own country, including in the United States, as part of their own infrastructure. We choose providers that are appropriate for a service of this size, but we do not independently audit their own security programs.

4. How Long We Keep It

We keep your account content — campaign history, brand settings, profile, Support conversation, and stored images — for as long as your account exists. If you delete your account, we delete all of that immediately. The one exception: records of your actual payments (the transaction/subscription identifiers, the price, the amount, and the date, with your email address removed) are kept for as long as necessary for tax, accounting, refund, chargeback, fraud-prevention, or legal-dispute purposes, including any period required by applicable law or by Dodo Payments' own obligations as Merchant of Record. We do not currently operate an automated process that deletes these anonymised records once that period lapses — once anonymised, they can no longer be linked back to you or used to affect any account, but they are not automatically purged on a fixed schedule.

5. Your Rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, and to receive a copy of it in a portable format. Here is what is actually available today:

• Delete: fully self-service — delete your account from your account settings at any time (see Section 4 above and our Terms for exactly what this does and does not remove).
• Correct: brand settings and profile are self-service — edit them directly in the app. For anything else, email us.
• Access, restrict, object, or receive a portable copy: we don't have a self-service export or a settings toggle for these yet — email support@useoutrun.com and we will handle the request directly.

If you are in a country with a data protection authority (for example, an EU member state or the UK), you also have the right to lodge a complaint with that authority.

6. Consequences of Not Providing Data

Your Google email is required — without it, you cannot create an account or use Outrun. Everything else described in Section 2 beyond your email is optional: skipping it means the related feature (for example, a custom brand style) won't be available or customized, but the rest of Outrun still works.

7. Security

We use reasonable technical measures to protect your data — private, access-controlled storage for your images, encrypted connections, and signature verification on payment events from Dodo Payments — but no method of storage or transmission over the internet is completely secure, and we cannot guarantee absolute security.

8. Children

Outrun is not directed at, and may not be used by, anyone under 18.

9. Changes to This Policy

If we make a material change to this policy, we will update the "Last updated" date above and, where required by law, notify you.

10. Contact

support@useoutrun.com