Your photo. Your business.
Effective October 18, 2026. Videos are a paid product, not a free generation trial. Only a verified successful production payment authorizes one video; preparing an unpaid order never starts generation.
Two-person Softhearted Gunner mode
The Softhearted Gunner page checks two adult portraits locally, then combines them into one reference layout with the gunner on the left and the zombie on the right. Only this metadata-free two-photo layout is carried in the local draft and, after separate consent and security verification, uploaded privately for the order. After matching verified production payment, the same layout is sent to SEEAPI for two fixed scene generations. Both clips are stored privately, trimmed and hard-cut into one MP4 on our server; intermediate copies are removed after assembly, with cleanup potentially delayed. The same source is not published. Both adults must explicitly authorize processing and the intended use. The same draft, order, source, provider and result retention rules below apply to both portraits; they are not published as customer examples.
Scope and purposes
Boo Studio uses the information described here for local previews, secure unpaid-order preparation when enabled, payment verification, fulfillment, abuse prevention and support. Only a matching verified production payment authorizes generation. The upload form reports actual availability; a disabled form does not transmit the photo. There is no free video-generation trial.
The public homepage preview stays in this browser
On the public homepage, photo selection, image quality scoring and scene layout composition run locally in the open tab. We do not receive that locally selected photo, its score or the layout PNG. The app holds these images in tab memory; remove the photo, refresh or close the tab to clear the active preview. Downloaded PNGs remain on your device until you delete them. The check measures technical quality, not faces, age, identity or consent. The separately labelled private order upload below is different and does transmit a prepared photo.
Local checkout drafts
Continue to payment details normalizes your portrait to a metadata-free PNG and saves one draft with the costume, fictional-example flag, permission version, random reference and creation/expiry times in this browser's IndexedDB. A new draft replaces the previous one. Access expires after one hour; expired data is removed when this flow is next opened, not by a background deletion service, and may remain on disk until then. Remove local photo & draft or clear this site's storage to delete it sooner; this does not delete a separately uploaded server source. The draft itself is not an upload, payment or generation request. Availability checks only read server configuration and do not send the photo. Draft links work only in the browser storing the draft. A separate confirmed upload creates a private unpaid order whose actual state is retrieved with its access token.
Secure customer-order preparation
The separate Upload for paid order action, adult-photo permission checkbox and Cloudflare Turnstile check are required before sending a prepared portrait to our server. Turnstile processes browser and network security signals under Cloudflare's policies. We verify the challenge server-side and store a keyed hash derived from the connecting IP for admission limits, not the raw IP in our order table. D1 records the random production-order reference, costume, fixed price, consent/source metadata and timestamps; an independent random access token is stored only as a hash on the server and in session storage in your browser. These records do not prove payment. For payment, Waffo receives checkout details and we retain its payment/session references and signed-callback receipt hashes; card fields are on Waffo, not our site.
Hosting and technical information
Cloudflare hosts the site and APIs, so it processes ordinary request information such as IP address, requested URL and browser/network metadata to deliver and protect the service under its own policies. Our app does not add advertising trackers, analytics events or a customer-account cookie. Worker invocation logging is not enabled. This does not mean that hosting or payment providers keep no security or operational records.
Authorized sandbox payment records
Operator-authorized tests send simulated checkout details to Waffo Pancake. Our Cloudflare D1 database stores a test order ID, costume selection, simulated price and payment status, provider/order references, checkout session information, timestamps and signed-webhook receipt hashes. An order access code is stored only as a hash on our server; the browser keeps the code in session storage to retrieve its private test status. API access expires 24 hours after order creation. This is an access limit, not automatic database deletion. Sandbox confirmation does not upload a photo or start a video task. Card details are entered on the provider’s checkout, not collected by this app.
Operator-only fixture delivery tests
The operator can attach the existing fictional vampire sample to a verified sandbox order to test task states, bounded simulated retries, private delivery and sandbox refund requests. This does not upload a visitor photo, call a generation model or create a personalized video. Task and refund records are stored in D1. Test video copies are stored in a private Cloudflare R2 bucket; downloads require private order access and a signed link lasting at most three minutes. Access ends no later than 24 hours after order creation, and is revoked when a refund is requested. These are test limits, not a paid customer delivery promise.
Private photo preparation and controlled operator tests
A private, operator-created test-order link can accept an adult portrait after an explicit permission checkbox and upload action. The browser converts JPG/PNG/WebP to a PNG no larger than 2048 pixels per side; the server checks the real dimensions, CRC, decompressed pixel data and decoded image, then re-encodes it without source metadata. The normalized photo is stored in private Cloudflare R2, not a public bucket. D1 records its hash, size, dimensions, consent version, timestamps and task association. This is not automated age, identity, consent or content verification. Operator test permissions cannot unlock production orders. A separately authorized operator acceptance test may temporarily enable SEEAPI for one specified test order under an explicit credit budget, using a server-only credential. Neither an upload nor a sandbox payment authorizes generation. Verified sandbox payment and separate per-task spending approval are required. Only then can a scoped, expiring source URL be sent to SEEAPI; source URLs and API keys are not returned in order status.
Retention and deletion
Uploaded production and test sources expire no later than 24 hours after order creation; expired sources need a new order and upload. Private order and result access also ends no later than that 24-hour boundary. A five-minute cleanup checks expired sources, sources of completed or refunded tasks, and expired/refunded result copies. Delete source is available when no provider submission/render/storage step is active; deleting the local draft does not delete a server upload. Separate one-day R2 lifecycle rules cover source, generated-video and fixture prefixes, including orphaned writes. Cleanup may be delayed: access expiry is not proof of physical deletion at that exact time. Deleting our copy does not recall provider copies. D1 order metadata, keyed network hashes, request snapshots, task/refund references and callback records have no automatic purge; ask support for deletion. Support email is forwarded through Cloudflare Email Routing to Gmail and remains until manually deleted, subject to provider retention and legal requirements. Public fictional assets remain until removed.
Production generation and private results
Only a matching verified production payment authorizes sending that order's scoped, expiring source URL, fixed costume prompt and task data to SEEAPI for Seedance 2 Mini. Sandbox payment cannot authorize this. Completed customer results are copied to private R2, never substituted with a demonstration fixture or published in a gallery. Downloads require private order access and signed links lasting at most three minutes, within the order expiry. A refund request revokes downloads. Uploading or returning from checkout cannot bypass payment verification.
Generation providers and the published sample
The published fictional vampire sample was made using Seedance 2 Mini through SEEAPI; homepage local previews do not send visitors’ photos to that provider. For a verified paid generation or separately authorized operator API test, SEEAPI receives its input, prompt and task data. Its current data-handling policy states no scheduled automatic expiry for stored input/output files, task information and moderation results, and a 60-day retention period for API request records/logs. Deletion is requested through its support process. Removing our copy or expiring an input URL does not establish deletion by SEEAPI or an underlying model provider. We do not promise a 24-hour deletion period for their copies.
Security and your choices
Provider credentials are kept on the server, not in browser code. Sandbox APIs require private operator or order credentials as appropriate; neither a redirect nor possession of an order ID alone proves payment or grants access. No security measure is absolute. Do not select sensitive documents or send passwords, API keys, verification codes or full card numbers in support messages. We do not sell selected photos or use them to train our own models.
Privacy requests and changes
Email support@aihalloweencostumevideo.com with the subject Privacy request to ask about access, correction or deletion of information we actually hold. Include only enough information to locate the relevant order or correspondence, not unnecessary identity documents. We may need proportionate verification and may retain limited records where legally required. We will respond within the period required by applicable law and explain relevant exceptions. Material changes to processing, retention or download arrangements will be disclosed here before they apply.
Operator and support
Boo Studio is the independent project operating this website, not an official product of its hosting, payment or model providers. Contact the operator for support, billing, privacy or content reports at support@aihalloweencostumevideo.com.