Legal

Privacy Policy

What we collect when you use X-Alchemy, why we collect it, who else sees it, and what you can ask us to do about it.

Last updated: 1 August 2026

Who We Are

X-Alchemy is a community platform for Fujifilm photographers to share and discover film simulation recipes. It is run by one person rather than a company, and the data controller for the personal data described in this policy is Charlie Martina.

For anything in this policy, including a request to exercise any of your rights, email [email protected] or use our contact page. That is the fastest way to reach the person responsible, and it goes straight to them.

What We Collect

You can browse the recipe library, the Academy, and the glossary without an account, and without telling us anything beyond the usage data described below. Everything else depends on what you choose to do.

Account and sign-in

  • Your email address and a securely hashed password, held by our authentication provider. We never see or store your password in readable form
  • Whether your email address has been confirmed, and the timestamps of your sign-ups and sign-ins
  • A session token stored in your browser so you stay signed in. This is strictly necessary for the service to work

Your profile

  • Username, display name, biography, and avatar image
  • Optional details you choose to add: location, gender, years of experience, the cameras you shoot, your favourite styles, and what inspires you
  • Optional links to your Instagram, YouTube, website, Ko-fi, and Buy Me a Coffee
  • Your theme and accessibility preferences, so the site looks the way you left it
  • Your plan status (Free, Pro, or Founders) and, for Founders, your seat number

What you create and do

  • Recipes you write, the images you upload with them, and any drafts you save
  • Comments, votes, favourites, and the accounts you follow
  • Academy articles you have marked complete, and notifications generated for you

Film Recipe Builder (Pro and Founders)

  • The briefs you write and the conversation history with the recipe builder, so you can return to a conversation and so it can refer back to what you asked
  • The recipes it generates for you, and a small set of remembered preferences to improve later results
  • A count of your generations each month, to apply the fair-use allowance described in our Terms

Usage analytics

  • Pages visited, the page that referred you, and your browser’s user-agent string
  • Actions taken in the interface, such as which filters and buttons are used
  • Page load and responsiveness timings, so we can find slow pages
  • A random session identifier held in your browser’s session storage. It is not linked to you if you are signed out, and it is discarded when you close the tab

Security and abuse prevention

  • Your IP address and user-agent string, recorded against security-relevant events such as sign-in attempts, rate-limit breaches, and content reports
  • Counters used to rate-limit form submissions and AI generations
  • IP addresses of banned clients, where a ban has been necessary

Payments

  • We do not receive or store your card details. Stripe processes payments and holds that data
  • We store the identifiers Stripe gives us for your customer and subscription records, and your plan status

Why We Are Allowed To

UK data protection law requires a lawful basis for each purpose. Ours are:

Contract

Running your account, publishing what you choose to publish, and providing paid features you have bought.

Legitimate interests

Keeping the service secure and available, preventing spam and abuse, understanding which pages are used so we can improve them, and moderating content before it goes public. We have considered these against your rights and use the least data that achieves them.

Legal obligation

Keeping records we are required to keep, including for tax on payments taken.

Consent

Anything you volunteer that we do not need, such as the optional profile fields and social links. You can remove these at any time in Settings.

Who Else Sees It

We do not sell your personal data, and we do not share it for anyone else’s marketing. We use the following providers to run the service. Transfers outside the UK rely on the UK International Data Transfer Addendum or equivalent safeguards in each provider’s terms.

Supabase

United Kingdom (London)

Database, authentication, file storage, and the functions behind our forms and features. The bulk of your data lives here.

Stripe

United States and Ireland

Payment processing for Pro subscriptions and Founders purchases. Stripe is the controller of your payment-card data, not us.

Resend

United States

Sends transactional email, including verification emails and the messages you send us through our forms.

Lovable

United States

Hosts and deploys the site, and provides the AI gateway that the Film Recipe Builder sends your brief to. The gateway passes it to an underlying Google Gemini model.

Discord

United States

When a recipe is approved, an automatic post announces it in our community server. That post contains the recipe and the author’s display name, both already public.

We may also disclose data where the law requires it, or to establish or defend legal claims.

What Is Public

Some of what you create is public by design. Anyone on the internet can see:

  • Your username, display name, biography, avatar, and any social links you add
  • Recipes you publish, once approved, and the images attached to them
  • Your comments, and who you follow

Your email address is never shown publicly. Please do not put anything in a profile field, recipe, or AI brief that you would not want the world to read.

Storage On Your Device

We do not use advertising or third-party tracking cookies. We store two things in your browser: a sign-in token, which is strictly necessary for the service to work, and a random analytics session identifier, which is cleared when you close the tab.

Clearing your browser storage removes both. Doing so signs you out.

How Long We Keep It

  • Account, profile, and published content: for as long as your account exists
  • Unpublished recipe drafts: 90 days, after which they and their images are deleted automatically
  • Security and audit records, including IP addresses: retained while they remain useful for preventing abuse
  • Usage analytics: retained in aggregate to track how the site is used over time
  • Payment records: as long as tax and accounting law requires, currently six years

Your Rights

Under UK data protection law you have the following rights. There is no charge, and we will respond within one month.

Access
Ask for a copy of the personal data we hold about you.
Rectification
Correct anything inaccurate. Most of it you can edit yourself in Settings.
Erasure
Ask us to delete your account and its data. Recipes you have published may be retained in anonymised form where others have built on them, and we will tell you if that applies.
Restriction
Ask us to pause processing while a dispute is resolved.
Portability
Receive the data you gave us in a machine-readable format.
Objection
Object to processing we carry out under legitimate interests, including analytics.
Withdraw consent
Where we rely on consent, withdraw it at any time without affecting past processing.

To exercise any of these, email [email protected]. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can put it right.

Children

X-Alchemy is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, please contact us and we will remove it.

Changes To This Policy

We will update this page when our practices change, and revise the date at the top. If a change materially affects how we use your data, we will tell you through the service or by email rather than relying on you to check.

Related

Our Terms of Use cover the rules for using the service and the paid tiers. Our Community Guidelines cover what you can post and how reports are handled.