Effective date: August 31, 2026. World Models Watch operates the editorial site and private generation service described in this policy. This policy explains the data used for accounts, comments, generation, credits, support, analytics, advertising, and site security.
Who is responsible for the data
World Models Watch is the service operator and data controller for the processing it determines. The providers listed below act as processors, independent controllers, or both under their own terms, depending on the service. Privacy requests can be submitted through the contact details published on this site.
Information we collect
Public use and device data
Public pages can be read without an account. Hosting, security, analytics, and advertising systems may receive IP address, user agent, device and browser information, timestamps, referring URL, requested path, approximate location derived from IP, and interaction events such as demo plays, model selections, generation starts, and downloads.
Accounts and authentication
The site currently contains separate account paths. Clerk powers the main sign-in and account controls. Supabase Auth with Google OAuth powers private generation records, downloads, comments, and likes. The systems may process an account identifier, email address, display name, avatar, authentication metadata, session information, and security events. A separate administrator session uses the configured editor email to protect internal routes.
Generation inputs, outputs, and records
A generation may include uploaded images or video, text prompts, multiple reference views, selected model and mode, parameter choices, source-file type and size, provider task identifiers, progress, error details, timestamps, quoted credits, credit-ledger entries, generated previews, and downloadable output files. Server-side inputs and outputs are stored in private buckets and access to task records and signed downloads is restricted to the associated user.
The selected provider receives the input, prompt, parameters, and other technical data needed to run the task. Do not upload confidential, unlawful, or third-party material you are not authorized to process.
Comments and public contributions
Comment text, display name, avatar, timestamp, likes, and the linked page are stored to operate public discussions. Comments are public immediately. Do not post private information or personal data that should not appear on a public page. Email addresses are not displayed in comment threads.
Browser-stored generation drafts
To preserve an in-progress mobile workflow, the browser may store draft prompts, parameters, task identifiers, displayed credit balance, and selected source files in session storage or IndexedDB on the user's device. This local copy is controlled by the browser and is separate from the server retention schedule. It remains until the draft is cleared, the relevant browser storage is removed, or the browser applies its own storage policy.
Why we use information
We process data to provide accounts and requested generations, reserve and settle credits, deliver private files, maintain history, publish and moderate comments, respond to requests, prevent fraud and abuse, diagnose failures, secure and improve the service, measure aggregate use, support advertising, comply with legal obligations, and establish or defend legal claims.
Depending on the activity and applicable law, the legal basis is performance of the service contract, consent, compliance with a legal obligation, or legitimate interests in security, service reliability, support, measurement, and protecting users and the service. Where processing relies on consent, it may be withdrawn for future processing.
Cookies
The protected account area uses one HTTP-only session cookie named wmw_session. It is marked SameSite=Lax, is secure in production, and expires after eight hours. It is not used for ads or cross-site tracking.
Supabase Auth may set its own authentication cookies to keep signed-in users connected for private generations, downloads, comments, and likes. These cookies are used for authentication and abuse prevention.
Research and source data
Site content is based on public sources such as official company announcements, research posts, documentation, and release notes. We avoid collecting private individual profiles as part of normal editorial operations.
Service providers and data recipients
Infrastructure and account services include Vercel for hosting and request delivery, Clerk for the main account interface, Supabase for authentication, database records, and private file storage, and Google for OAuth, Analytics, and AdSense. Stripe may process checkout, transaction, and payment identifiers only after purchasing is enabled.
Generation data is sent only to the provider selected for the task. Current integrations may use fal.ai and models supplied by Tripo AI, Meshy, Hyper3D, or Tencent Hunyuan; World Labs Marble; SpAItial; Blockade Labs; and, when made available, Manycore Tech's AHOLO service. These providers may keep operational copies under their own documented retention, security, and legal obligations. Their terms can also affect permitted output uses.
We may also disclose limited information to professional advisers, authorities, or another operator when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a business transfer with appropriate safeguards. We do not sell private generation inputs or account credentials for money.
International processing
The service and its providers operate in multiple countries. Data may therefore be processed outside the user's country, including in countries with different privacy laws. Where required, transfers rely on an adequacy decision, contractual safeguards, provider transfer mechanisms, or another lawful basis. Users may request information about safeguards applicable to their data.
Retention and deletion
Server-side generation inputs are scheduled for deletion within 24 hours after a task finishes. Successful generated downloads are stored privately for seven days and then deleted. Failed tasks may keep only the minimum metadata needed to return credits, investigate the failure, and prevent duplicate settlement.
Account, generation metadata, credit ledgers, security records, and transaction records may remain while an account is active and afterwards for fraud prevention, accounting, dispute resolution, and legal obligations. Comments remain public until the author deletes them or the site removes them. Hosting and provider logs follow the relevant provider's operational settings. When no fixed period applies, we use the purpose, sensitivity, legal duties, security needs, and potential dispute period to decide when data is deleted or anonymized.
Your choices and rights
Depending on local law, users may request access, correction, deletion, restriction, objection, or a portable copy of their personal data and may withdraw consent for future processing. Users may also complain to their local data-protection authority. Requests may require reasonable identity verification and can be limited where retention is required by law or needed to protect other people's rights.
Authors can remove their own comments where the interface permits it, readers can remove likes, and browser-stored drafts can be removed by clearing the selected files or relevant site storage. Account and broader data requests can be sent to privacy@worldmodelswatch.com.
Security
We use access controls, private storage, signed download links, restricted service credentials, input validation, and retention jobs to reduce risk. No internet service is completely secure, so users should protect their account and report suspected unauthorized access.
Children
The account and generation service is not directed to children under 18. A parent or guardian who believes a child submitted personal data without appropriate permission may request review and deletion.
Automated processing
Model providers automatically generate outputs and may reject inputs under technical or safety rules. Automated task status and credit settlement determine whether reserved site credits are captured or returned, but the service does not use those decisions to make legal, employment, credit, or similarly significant decisions about users.
Changes
Material changes to this policy should be reflected on this page with an updated effective date.