Trust Center

Obrasken uses private app routes, server-side checks, and protected provider-key handling.

• Private app surfaces require an authenticated session.
• Sensitive APIs should continue to use server-side guards.
• Service-role credentials must never be exposed to browser bundles.

User projects and memory are private by default.

• Memory is not sold.
• Memory is not shared with other users.
• Public sharing must be opt-in and reviewable.

Users control what Obrasken remembers about their style.

• Memory can be turned off.
• Users can export, reset, or delete memory.
• Secrets, API keys, payment data, and raw uploads do not belong in memory.

Provider keys belong in the encrypted server-side vault, not in client code.

• Raw keys are never intentionally shown in the browser.
• BYOK is for advanced Pro workflows.
• Provider billing is separate from Obrasken credits.

Users should be able to request deletion of memory, generated data, and account data.

• Deletion controls live in privacy and memory settings where available.
• Destructive actions should require strong confirmation.
• Deletion requests must not expose other users' data.

The cookie consent UI stores preferences locally and does not add third-party analytics.

• Essential cookies keep auth working.
• Analytics, marketing, and AI personalization can be rejected locally.
• Consent does not block authentication.

Users should only create with content they own or have rights to use.

• No unsafe public sharing is enabled by this foundation.
• Generated content rights need final legal review.
• Acceptable use rules apply to prompts, uploads, and exports.

AI tools should avoid unsafe media edits, harassment, dangerous challenges, and rights violations.

• No real-person deepfakes.
• No sexual content or harassment generation.
• No copyrighted character imitation.