Privacy Policy

Introduction

Hookai ("we", "us", "our") operates hookai.io, an AI rap video generator. You upload a photo and choose a theme (or write a short verse prompt); the service generates a short, lip-synced rap video with its own native vocals and beat.

This policy explains what we collect, how we use it, who we share it with, and how long we keep it. It applies to hookai.io and every page, API and generation job served from it.

This policy describes the data practices of the service as it is built today. If a new feature would change those practices, we will update this page before that feature ships.

Information We Collect

1. Account information — your email address and password when you create an account. Authentication is handled by better-auth, and your password is stored only as a one-way hash. If social sign-in is enabled by the site operator, we also receive the basic profile that provider returns (account identifier, email, display name, avatar).
2. Photos you upload — the photo of the performer and, for a duo video, a second photo for the featured artist. Used solely to render your video.
3. Theme and verse prompt text — the theme you select and any short custom text you type to describe the vibe or message of the rap. Pasting full lyrics and uploading an audio track are planned features and are not live today; when they ship, you will have to confirm you hold the rights to anything you import.
4. Generated content — the videos (and the rap audio rendered with them) that we produce for you, plus generation metadata needed to serve and regenerate them.
5. Usage and credits data — features used, generations started or failed, credits spent and granted, and basic request data (timestamp, IP address, user agent) used for rate limiting and abuse prevention.
6. Payment metadata — when you buy credits, our payment provider tells us the order id, amount, currency, status and a provider customer reference. We never receive or store full card numbers, CVC codes or bank credentials; those stay with the payment provider.

We do not ask for your real name, address or date of birth, and we do not run advertising profiles on you.

How We Use Your Information

• To generate your rap video and deliver it to you.
• To manage your account, credits, orders and refunds.
• To send service messages: order confirmations, generation failures, security notices and replies to support requests. We do not send marketing email without your consent.
• To detect, rate-limit and prevent abuse, fraud and attempts to circumvent credits or content rules.
• To operate, debug and improve the service using aggregated, non-identifying usage statistics.

Your Photos and Likeness

This is the part most people care about most:

• Uploaded photos and the theme text you enter are used only to generate the video you requested.
• We never train AI models — ours or anyone else's — on your photos.
• We never sell or license your photos, and we do not share them with third parties beyond the AI processing provider that is strictly required to render the video.
• Only upload photos of people who have explicitly agreed to appear. Photos of public figures, celebrities and minors are not allowed, and we remove content and may close accounts that break this rule.
• Photos and generated media are retained for 7 days and then deleted, because generated videos are hosted for 7 days only. Download yours before it expires.
• Do not upload a photo you do not have permission to use. If you are the person in the photo, you are giving us permission to process it for this single purpose.

Cookies and Local Storage

We keep cookies to a minimum:

• Strictly necessary — session cookie for staying signed in, and a locale cookie that remembers your language choice. The site does not work without these.
• Functional — small preferences such as theme or consent state.
• Analytics (optional) — only if analytics is enabled for the site and you accept the cookie banner. Until you accept, analytics scripts do not load.

You can clear or block cookies in your browser at any time; blocking the session and locale cookies will sign you out and reset your language.

Service Providers and Third Parties

We do not sell your personal information. We share data only with the providers needed to run the service, each under their own confidentiality and data-protection terms, and only to the extent required:

• AI video and motion generation — Higgsfield is wired into the generation pipeline. When the generation provider is configured by the site operator, the uploaded photos and the theme / verse prompt are sent to it to render your video.
• Authentication — better-auth for email and password sign-in; optional Google or GitHub OAuth when the site operator enables it.
• Payments — Stripe, Creem, PayPal, Alipay or WeChat Pay, whichever the site operator has configured. The provider handles the card or wallet transaction; we receive order metadata only.
• Email — Resend, when configured, for transactional messages such as verification and order receipts.
• Storage — object storage such as Cloudflare R2 or any S3-compatible bucket, when configured, for uploaded media and generated videos.
• Database and hosting — Cloudflare Workers with D1 by default. Self-hosted deployments may run PostgreSQL, MySQL, SQLite or Turso instead.
• Analytics — Plausible and/or Google Analytics, when enabled in the admin settings and (if the cookie banner is on) after you consent. These are aggregate visit statistics; we do not pass your photos, prompts or generated videos to them.

We do not currently integrate with Suno. Hookai generates the rap audio for your video itself, so no audio file is sent to us today. Importing a track or a Suno export is a planned feature; once it ships, any file you upload must be one you created or obtained elsewhere and have the rights to use. Hookai does not call Suno APIs, does not receive data from Suno, and does not send your data to Suno.

We may also disclose information when required by law, in response to a valid legal request, or to protect the rights, property or safety of Hookai, our users or the public.

Data Security

We use encryption in transit (HTTPS everywhere), encryption at rest for secrets stored in our settings store, hashed passwords, scoped access controls and short-lived signed URLs for media delivery. No system is perfectly secure, but we limit what we collect, restrict who can reach it and delete it on the schedule below.

Data Retention

• Uploaded photos, theme / verse prompts and the generated videos — deleted after 7 days (the hosting window for generated videos).
• Account, credit and order records — kept while your account is active and afterwards as long as required for accounting, tax and fraud-prevention obligations.
• Support conversations — kept while needed to resolve the request and for a reasonable period afterwards.
• Server and rate-limit logs — short-lived, typically days, not months.

You can request deletion of your account and its data at any time by emailing support@hookai.io. We delete or anonymise what we are not legally required to keep.

Children

The service is not directed at children and is not available to anyone under 18. You must be at least 18 years old to create an account, and photos of minors may not be uploaded under any circumstances. If we learn that a minor has created an account, we will close it and delete the associated data.

Your Rights

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, and to object to certain processing. Email support@hookai.io and we will respond within the timeframe required by applicable law. You can also lodge a complaint with your local data-protection authority.

International Transfers

Our providers may process data in countries other than yours. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

Changes to This Policy

We may update this policy as the service evolves. Material changes will be posted on this page with a new "last updated" date, and where the change is significant we will also notify you by email or in-product.

Contact

Privacy questions, data requests or takedown notices: support@hookai.io. We aim to reply within a few business days.