Privacy policy

Contact enquiries

We store your name, email, topic, message, submission time, consent version, and a daily hashed network identifier when you use our contact form. We use this information to review and respond to your enquiry and limit abuse. Contact messages are stored privately and are not sent to AI generation providers. Please do not submit passwords or API keys. To request removal of your enquiry or waitlist entry, use the Contact page and select Privacy or data request.

Early-access waitlist

If you join the waitlist, we store your email address, signup time, and consent version to contact you about early access. A daily hashed network identifier helps limit abuse. Joining does not create a product account or share your email with AI generation providers. You can request removal through our Contact page.

Information used by this service

Signing in uses your email address and account information supplied by your selected login method. We store session information to keep you signed in. Features you use may also store project briefs, prompts, research inputs and results, generation records, uploaded media, and integration settings. Browser drafts and locally imported media stay in browser storage until you choose a feature that uploads or sends them.

Provider keys

Saved provider credentials are encrypted at rest. Our server decrypts them when needed to make requests you authorize. This is not end-to-end encryption or a promise that the service can never access the keys. Saved keys are not returned to your browser; you can replace or remove them in Account settings.

When information goes to another service

Using a connected provider sends the credentials and inputs needed for that request to that provider. Depending on the feature, these may include prompts, reference URLs, source text, or media. Higgsfield processes video-generation requests; OpenRouter and the selected model provider process relevant AI requests. Their handling of those inputs is governed by their own policies. TheHiggsField.ai is a separate service, and this policy is not Higgsfield.ai's privacy policy.

Our hosting server stores beta waitlist entries and contact enquiries. Cloudflare provides the domain’s traffic proxy and security services. Backups are retained on the hosting server for up to 15 days. Google handles Google sign-in, and the configured email service delivers magic links. Public-reference and website-import features contact the relevant services to retrieve information you request. If you configure a webhook, project event identifiers are sent to its destination.

Storage and your controls

Cloud-saved data is associated with your account. Account settings provide data export, key removal, and account deletion. Local drafts and media must be removed separately from your browser. Deleting a project does not automatically delete separately stored media; use the media library controls to remove it. Deleting information here does not delete copies already held by external providers, and their retention policies apply.

Sessions and changes

Authentication uses session cookies, and the builder uses browser storage to save local work. Clearing browser storage may remove unsynced drafts and media. We will update this page when the service's data practices change.