Privacy Policy

TinShe Mirage is a service operated by TinShe ("we", "us", "our"). We provide a mock, OpenAI-compatible image generation API for developers to use during development and testing. This policy explains what data we collect, why, and how we handle it.

Email address

Used solely for passwordless authentication (magic links). We do not send marketing emails. Your email is stored by Supabase as part of your account record and is never sold or shared with third parties for marketing.

Daily request counts

We record how many API calls your key makes per UTC day to enforce the daily limit (200 requests). This counter is associated with your account and visible to you on the dashboard. Individual call timestamps are not stored.

API key hash

We store only the SHA-256 hash of your key — never the key itself. We cannot recover your key if you lose it. We also store the first 8 characters of the key so you can identify it in the dashboard.

Prompts

We do not log or store prompt text. Prompts are used only in memory to match against our image catalog and are discarded immediately after the response is sent.

Server logs

Our hosting provider (Vercel) and database provider (Supabase) may retain standard server-side logs (IP addresses, HTTP metadata) for security and abuse monitoring. These logs are subject to their respective privacy policies.

We use one essential HTTP-only cookie to maintain your authenticated session, managed by Supabase Auth. We do not use advertising, analytics, or tracking cookies.

The dashboard may use your browser's sessionStorage to temporarily hold your API key within the current browser tab. If you opt in to "Remember on this device", it uses localStorage instead. This data never leaves your browser; it is used only to pre-fill the playground.

We do not sell, rent, or share your personal data with third parties for marketing or commercial purposes. We rely on the following sub-processors:

• Supabase — database and authentication (EU/US, ISO 27001)
• Vercel — application hosting and edge delivery
• Cloudflare — image CDN (Cloudflare R2)

Each of these providers processes data only as needed to deliver the service.

Your account data is retained as long as your account exists. Usage counters are kept for rolling historical purposes (no defined deletion window yet — we may prune data older than 90 days in a future update).

You can exercise the following at any time:

• Access — view your key info and usage on the dashboard.
• Deletion — click "Delete my account" on the dashboard. This permanently removes your auth user, API key, and usage data via cascading deletes.

We hash API keys with SHA-256 before storage, use Supabase Row Level Security so users can only read their own rows, and never log or persist prompt text. Access to the database from our API routes uses a service-role key that is never exposed client-side.

This service is not directed at children under 13. We do not knowingly collect data from children.

We may update this policy. Material changes will be reflected by a new "Effective" date at the top. Continued use after changes constitutes acceptance.