Privacy policy
Last updated 23 October 2026
This policy explains what GOL Productions, trading as Vyndigital, collects when you use this site and Pencil, why, and what you can do about it. Short version: we collect as little as we can, we don't sell anything, and we don't track you.
What we collect
- Your email address, when you create an account. We use it to identify your account and to contact you about it.
- Your password, scrambled. We store only a one-way scrambled form of it (scrypt), never the password itself. Nobody, including us, can read it back.
- One-way hashes of your API keys, plus each key's name, its last 4 characters and the date it was last used, so you can manage them. We never store the keys themselves.
- Login sessions: a scrambled session token and its expiry date, so you stay logged in for up to 30 days.
- Your plan and drawing counts, to apply the limits.
- The drawings you make (the drawing instructions, SVG and PNG), so your AI can view and edit them later. Images you place in a drawing are sent to us as part of it.
- Your IP address, briefly, to enforce rate limits and stop password-guessing and abuse. It's held in memory only, never written to disk, and cleared within 24 hours.
- Payment details, if you upgrade: your card goes straight to Stripe and we never see it. We keep the Stripe customer and subscription IDs so we know your plan.
We don't receive your conversation with your AI, only the drawing instructions it sends to Pencil.
What we don't do
- No ads, no tracking, and no third-party analytics on this site. We only count visits as anonymous daily totals: which page was opened and which website or link (like TikTok) it came from. No cookies, no IP address and nothing about you is kept with those counts. The only cookie is a strictly necessary login cookie, set when you log in. It only keeps you logged in, can't be read by scripts, and is never used for tracking.
- No third-party fonts or scripts: everything on this site comes from our own server.
- We don't sell, rent or share your information for marketing.
- We don't look at your drawings, except to fix a problem you report or to investigate abuse.
Who else handles it
- Hetzner Online hosts our server in Helsinki, Finland, so your information is stored outside Australia.
- Stripe processes payments if you upgrade, under its own privacy policy.
- Resend delivers our account emails (welcome, password reset, plan changes and account deletion), so it receives your email address and the email we send you.
We may also disclose information when the law requires it.
How long we keep it
Your account and drawings are kept while your account exists. You can delete single drawings any time from your dashboard. When you delete your account from your dashboard, your email, password, keys, sessions, usage and drawings are deleted straight away, and Pro is cancelled. If you can't log in, email us and we'll delete it within 7 days. Stripe keeps payment records as financial law requires.
Security
Passwords are scrambled with scrypt, login attempts are rate-limited, and changing your password logs out your other devices. Our server only accepts key-based admin logins, blocks repeated attacks, runs Pencil in a locked-down account, and installs security updates automatically. Connections are encrypted with HTTPS. No system is perfectly secure, but we work to protect your information, and we'll tell you if a breach is likely to cause you serious harm.
Your choices
Your dashboard shows your account, keys, usage and drawings, and lets you delete any of them, or your whole account. You can also ask us to see, correct or delete the information we hold about you: email contact@golproductions.com from your account's address. If you're unhappy with how we've handled your information, tell us first and we'll respond within 30 days. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Emails
We only email you about your account: a welcome when you sign up, password resets and changes, your plan starting or ending, price changes, and account deletion. We won't send marketing unless you ask for it.