Privacy Policy

Last updated: October 7, 2026 · customcomicbooks.com is operated by MR LISTER LLC ("we")

Plain-language summary: you upload photos, our AI partners turn them into comic art, and your creations are stored in your account so they sync across your devices. We never sell your photos or comics, never use your photos for advertising or to train facial-recognition systems or AI models, and you can permanently delete your photos, comics and account from inside the app; we keep only pseudonymised order and safety records (see Retention; email us for a copy of your data). On the website and web app, Meta's pixel tells Meta which of our ads brought you and what you did next, unless you turn it off; what it already sent is kept by Meta. Photos of children may only be uploaded by their parent or legal guardian.

What changed in this version: the website now keeps the campaign tags, ad click id and referring site of the link that brought you, on your account, and puts the campaign tags on your Stripe payment record (see "How you found us" in section 1). The website and web app also use Meta's pixel to measure our ads and help Meta show them to people likely to want a comic (see Ads and cookies). Earlier versions said we didn't sell or share personal information; under US state laws the pixel can count as "sharing", and you can turn it off. The iPhone app is unchanged and has no ad tracking.

1. What we collect

Photos you upload — including face photos and multi-angle face scans used to create your character's likeness.
Content you create — generated comic panels, covers, characters, sticker sheets, and 3D models.
Account details — email and name if you sign in with Apple; anonymous identifiers otherwise.
Order details — shipping name, address, and email when you buy physical products.
Purchase records — what you bought and your credit balance (payment card numbers are handled by Apple and Stripe; we never see them).
Usage & diagnostics — generation activity, app session lengths, crash reports, and device/OS information used to run and improve the Service.
How you found us — on the website, the campaign tags in the link you arrived from (utm tags), an ad's click id if the link had one, and the name of the site that sent you, kept in your browser and on your account so we can tell which ads and links work. The utm tags, which ad network the click came from and when you first arrived also go on your payment record with Stripe; we don't send our copy of the click id anywhere. Signing out or deleting your account clears these from your browser.
Ad measurement — on the website and web app only, unless you turn it off: what Meta's pixel sends Meta (see Ads and cookies).

2. Face data

Your photos, including face photos, are used for exactly one purpose: generating your custom comic art, stickers, and 3D figures. Specifically:

Reference photos and face scans are sent to Google Gemini to render your character's likeness, and a picture of your drawn character goes to Tripo3D when you create a 3D model. OpenAI receives text (names, story details and written descriptions of the characters) as a backup when Gemini is unavailable, and may receive a drawing of your character to cut out a sticker, but never your photos or face scans.
Before the app sends your first photo, face scan or story to these AI services, it shows a screen that says what is sent and to whom, and asks you to agree and to confirm that you are the parent or guardian of any child pictured, or have their permission. Nothing is sent if you choose "Not now". Your agreement is remembered on that device.
Reference photos are kept in private cloud storage. Generated art is stored behind unguessable links that open without a password, so anyone you send a link to can see it. Both sync across your devices and are kept until you delete them or delete your account.
We do not use face data to identify you, build a facial-recognition database, authenticate you, or for advertising, and we do not sell or share it for those purposes. We do not use your photos, face scans or story details to train AI models.

3. Where your data goes (our processors)

We use these providers to deliver the Service, each receiving only what its job requires: Supabase (hosting, database, and content storage), Google Gemini (AI image and text generation from your photos, face scans and the details you type), OpenAI (backup AI text and image generation, and cutting out sticker drawings of your characters; never your photos or face scans), Tripo3D (3D model generation), Apple and RevenueCat (in-app purchases), Stripe (web and physical-goods payments), Printful (sticker sheet printing and shipping), Printify (individual sticker printing and shipping), Lulu Press (comic book printing and shipping), and Vercel (this website). When you order a physical product, files needed for printing (for example a sticker sheet or book PDF) are shared with the printing partner via unguessable links to fulfil your order.

Share pages. When you share a cover, page or hero from the app, it creates a public page at customcomicbooks.com/c/... that shows that picture, the comic's title and the hero's name. Anyone with the link can open it. The page is removed when you delete your account, or when you ask us.

4. Ads and cookies (Meta's pixel)

On customcomicbooks.com and the web app (not the iPhone app), we use Meta's pixel, code from Meta Platforms that measures our Facebook and Instagram ads and helps Meta show them to people likely to want a comic. When it is on, your browser sends Meta each page you open here (its address and the site that sent you), when you start making a comic, when your preview pages are drawn, and what you buy and what it cost. Meta also receives your IP address and browser details, and sets or reads its own cookies on this site, _fbp and _fbc (the click id from a Meta ad link), each kept for 90 days from your last visit. In browsers that allow it, the pixel's requests also carry Meta's own facebook.com cookies (such as fr and datr, and c_user if you're logged in to Facebook), so Meta can connect this to a Facebook or Instagram account. Meta uses it under its own Privacy Policy, including to improve its ads. We never send Meta your photos, face scans, comics, story details, name, email or address, and we switch off the pixel's automatic collection of buttons and form fields.

Under California and other US state privacy laws this can count as "selling" or "sharing" personal information, or as "targeted advertising". It is the only such use we make of your information, and you can opt out:

Your privacy choices turns the pixel off for that browser and deletes Meta's _fbp and _fbc cookies from this site. The choice is kept in that browser (a cookie, ccb_ads_choice, kept for up to 400 days, and its storage), so make it on each browser or device you use, and again if you clear this site's cookies or use a private window. If your browser blocks this site's cookies and storage, the pixel stays off in it.
Global Privacy Control: if your browser sends it, the pixel stays off in that browser, and we treat the signal as your opt-out there.
Outside the US (going by your device's time zone), the pixel stays off unless you allow it on the banner that asks.
For ads from Meta and other companies generally: your Facebook ad settings, aboutads.info, and in Europe youronlinechoices.eu.

We use no other advertising or analytics cookies. The site and app keep a few things in your browser's storage so they work: your anonymous id, your sign-in, your settings and choices (including your ad tracking choice), and the campaign tags above. When the pixel is on, it also keeps a list of the events already reported to Meta (starting a comic, the first preview, each purchase) and of sticker checkouts waiting to be reported (ccb_px_once, ccb_px_expect), so none is counted twice; turning the pixel off deletes both.

5. Retention and deletion

Your content stays in your account until you delete it or delete your account.
Delete Account (in the app's settings) permanently erases your profile, photos, comics, characters, generated art, and stored files. Records we must keep for safety, fraud, or legal reasons (for example content-abuse reports and purchase ledgers) are kept in pseudonymised form, unlinked from your identity.
What Meta's pixel already sent Meta is held by Meta under its own Privacy Policy; deleting your account here doesn't remove it.
Export: email us and ask for a copy of your account data (GDPR Art. 15 / CCPA access).

6. Children

The Service is not directed at children under 13, and you must be at least 13 (or the age of digital consent in your region) to create an account. Photos of a child may be uploaded only by that child's parent or legal guardian, or with the guardian's express permission. If we learn an account was created by a child under 13, we will delete it. Our ads are aimed at adults, and we don't knowingly let Meta's pixel collect information about anyone under 16. Guardians can contact us at any time to remove a child's photos.

7. Security

Data is encrypted in transit (TLS). Server data is protected by per-account access controls; devices prove ownership of an account with a secret token stored in the iOS Keychain. No system is perfectly secure, and we do not claim otherwise — if a breach affecting your data occurs, we will notify you as the law requires.

8. Your rights (GDPR & CCPA)

Access / portability: email us for a copy of your data.
Deletion — use in-app Delete Account, or email us.
Correction, objection, restriction — email us and we'll act within the statutory window.
Opt out of selling, sharing and targeted advertising (CCPA and other US state laws): use Your privacy choices or Global Privacy Control (see Ads and cookies). We don't sell personal information for money. The iPhone app has no ad tracking and doesn't track you across other companies' apps or websites, so it shows no App Tracking Transparency prompt.

9. Contact

Privacy requests and questions: mrlister@mrlister.life or the Support Center. We answer within 30 days.

If this policy changes materially, we'll update this page and note it in the app.