Last updated: November 8, 2026
Translations are provided for convenience. If they differ, this English version applies.
This policy explains what Tiny Desk AI ("we", "us"), the service at tiny-desk.online, collects and how it is used.
Tiny Desk AI is an independent online tool that turns photos into a short music-meme video. It is not affiliated with NPR or the Tiny Desk Concerts series. Contact: hello@tiny-desk.online.
Account data. When you sign in with Google we receive your name, email address and profile picture.
Photos you upload. The face photos you add to a video are resized in your browser and sent to our AI provider to make that video. We do not store them on our servers.
Videos you create. Finished videos, and the still image the AI makes first, are stored so you can watch and download them. We keep finished videos for 30 days.
Purchases. Payments are handled by Stripe. We receive the amount, the pack you bought and a payment reference — never your full card number.
Technical and product analytics. IP address, browser and device details and pages visited are processed by Cloudflare (our host) and our self-hosted, cookie-free Plausible analytics. Our self-hosted, cookie-free OpenPanel records product events such as uploads, generations and checkouts; signed-in events may use only your internal account ID, never your name, email address or uploaded photos.
Purchase attribution. A first-party cookie keeps the referring site, landing page and campaign tags for up to 90 days. If you buy a pack, we connect that snapshot and the page where checkout began to the purchase so we can understand which pages and campaigns lead to sales. We do not use device fingerprinting, and search terms are stored only when a referring link or campaign explicitly supplies them.
Visit and checkout attribution. We record the first and recent landing pages, referring links when provided by your browser, UTM campaign parameters, and the page and button used to start checkout. First-party cookies preserve the first recorded visit for up to 30 days and the current visit for 30 minutes. After sign-in, this information is associated with your account; confirmed purchases retain a snapshot of their checkout source. We also store the latest IP address observed on account activity and the IP address used to start checkout, when supplied by Cloudflare. These records are accessible only to authorized administrators for attribution, support and security, and are retained with account and transaction records. We do not send these IP records to our analytics service. Global Privacy Control and Do Not Track requests disable attribution cookies; security and payment records remain necessary for operating the service.
To run your account, make the videos you ask for, process payments and refunds, prevent abuse and fraud, answer support requests and improve the service. We do not sell personal data and we do not use your photos or videos to train AI models.
These providers act on our instructions and may process data in the United States and other countries, under appropriate safeguards such as the EU Standard Contractual Clauses.
Performing our contract with you (making videos, accounts, payments), our legitimate interests (security, fraud prevention, basic analytics) and legal obligations (tax and accounting records).
Uploaded photos: not stored by us after the video request. Videos: 30 days. Attribution cookie: up to 90 days. Account data: until you ask us to delete your account. Payment and associated attribution records: as long as tax law requires or until they are no longer needed for reporting.
You can ask to access, correct, export or delete your data, or object to its use, by writing to hello@tiny-desk.online. You may also complain to your local data protection authority. Residents of California, Brazil (LGPD), Japan (APPI), Korea (PIPA) and other regions have similar rights, which we honour on the same request.
The service is for adults (18+). Do not upload photos of children.
We will post changes on this page and update the date above.