Last updated: October 24, 2026

1. Who we are

Banana Art Lab (also called NanoBanana) is operated by NOVRILL INC., 30 N Gould St, Ste R, Sheridan, WY 82801, United States ("we", "us"). This policy explains what personal information we collect when you use trynanobanana.net, the canvas at trynanobanana.net/canvas, and our AI tools connection (the MCP server at trynanobanana.net/mcp), and what we do with it. Questions: support@trynanobanana.net.

2. Information we collect

Your account. Your email address and name. If you sign up with email, we store your password only in hashed form (Argon2id), never the password itself. If you sign in with Google, we receive your email address, name, profile picture and Google account ID; we do not receive your Google password and do not keep Google access tokens. You can add a username, bio and website to your profile.

What you create. The prompts you write, the reference images you upload, and the images generated for you. Artworks you save, and your favorites and likes. When you are signed in, the canvas saves your canvases, "My assets" and your image and video generation history to your account, so they are the same on every device.

Credits and payments. A record of every credit added or spent, including the model, the image settings and the first part of the prompt. Payments are handled by Stripe. We receive your email address, the amount, and Stripe's customer and payment IDs. We never see or store your card number.

AI tools you connect. When you connect an app such as Codex, Claude Code or Cursor, or create an API key, we store a hashed copy of the key or token, the app's name, and when it was created and last used. We also keep a record of the changes connected apps make to your canvases until your canvas has applied them.

Messages to us. If you use the contact form: your name, email address, subject, message and language, plus your IP address and browser type, to handle the request and prevent abuse.

Technical information.

To stop abuse we count requests per IP address and per account. IP addresses are kept only in hashed form and the counts expire within an hour.
When you sign in or sign up, Cloudflare Turnstile may check that you are not a bot, which sends your IP address to Cloudflare.
Our hosting provider keeps server logs, such as the pages requested.
We use Google Analytics to count visits and the pages people view.
We use Microsoft Clarity to understand how the site is used. It records clicks, scrolling and mouse movement, and can replay a visit.

Settings that stay in your browser. Some canvas settings, such as a WebDAV address and password you enter, are stored only in your browser and are not sent to us.

3. How we use it

We use this information to run the service: create your account and keep you signed in, generate images, keep your canvases in sync, process payments and keep your credit balance, and let the AI tools you connect act on your behalf. We also use it to send account emails (email verification and password reset; we do not send marketing emails), answer support requests, prevent fraud and abuse, understand and improve how the site is used, and meet legal obligations.

4. What is public

The gallery. When you publish an artwork to the gallery, anyone can see the image, its prompt, any reference image, your username and your profile picture. Published artworks can appear in search engines. If you signed up with Google, your Google name and picture are your username and profile picture until you change them. Your public profile shows your username, bio, website, profile picture and when you joined.

Image links. Every generated image has its own web address. Anyone who has that address can open the image, even if you never published it. Unpublishing or deleting an artwork removes it from the gallery and from search engines over time, but the image file can stay at its address until your account is deleted.

5. Who we share it with

We share personal information only with the companies that help us run the service, and only what they need:

AI model providers, the companies and services that run the image models, receive your prompts and reference images to create your images. For some models they also receive a random ID for your account (not your name or email).
Stripe, for payments.
Hosting and storage:
- Vercel hosts the website.
- Our database runs on a server we rent in the United States.
- Cloudflare stores images and encrypted backups, checks sign-ins (Turnstile), and forwards emails sent to support@trynanobanana.net.
Resend, to send account emails.
Google, for Google sign-in, Google Analytics and web fonts; Microsoft, for Clarity.
Apps you connect, which can read and change your canvases and spend your credits until you disconnect them.

We may also disclose information when the law requires it, to protect our users or the service, or as part of a merger or sale of the business. We do not sell your personal information.

6. Cookies and browser storage

We use these cookies and browser storage:

To keep you signed in. A session cookie that lasts 30 days, and short-lived cookies during Google sign-in.
To remember your choices. Your language, your last known credit balance and the banners you have closed.
To make the site faster. Images and files cached on your device.
To save your canvas work. Your canvas work stays in your browser until it syncs.

Google Analytics, Microsoft Clarity and Cloudflare Turnstile set their own cookies. You can block or delete cookies in your browser settings. If you block the session cookie, you can't sign in.

7. How long we keep it

We keep your account, artworks, canvases and credit history for as long as your account exists.
Temporary records of the images you generate on the Create page are deleted after 7 days.
Sign-in sessions end after 30 days.
Email links expire after 30 minutes.
When you ask us to delete your account, we delete your account data and images within 30 days. Some copies remain longer:
- Encrypted backups are deleted after 30 days.
- We keep payment records as long as tax and accounting law requires.
Contact messages are kept for as long as needed to handle them.

8. Your choices and rights

You can edit your profile, unpublish or delete artworks, and disconnect apps or delete API keys in Canvas Settings → AI tools.
To get a copy of your data, correct it, or delete your account, email support@trynanobanana.net from the address on your account. We reply within 30 days.
Depending on where you live, you may have more rights. These can include the right to object to or restrict some uses, to withdraw consent, or to complain to your data protection authority. This covers residents of California, the EU, the UK and Singapore, among others.
We will not treat you differently for using these rights.

9. Security

Connections to the site are encrypted (HTTPS).
Passwords, API keys and tokens are stored only in hashed form.
Database backups are encrypted.
Only our administrators can see account details, artworks (private ones included) and payment records, and only to run the service and handle support or abuse.

No service is perfectly secure, so please use a strong password and disconnect apps you no longer use.

10. International transfers

We and the companies we work with process information in the United States and other countries. These countries may have different data protection laws from the country where you live.

11. Children

Banana Art Lab is not meant for children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes

If we change this policy, we will update the date at the top. For important changes, we will also tell you on the site or by email.

13. Contact

NOVRILL INC. · 30 N Gould St, Ste R, Sheridan, WY 82801, United States · support@trynanobanana.net

Privacy Policy