Skip to main content
AltKit
Try it free

Legal

Privacy Policy

Last updated: 22 October 2026

This policy explains what personal data AltKit (the website at altkit.app, its web app and its browser extension) processes, why, on which legal basis, who receives it, how long it is kept, and which rights You have under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The browser extension has its own notice in the extension privacy policy; this policy applies to it as well.

1. Controller

Allan Charles Warsing, trading as Three Things Media (Einzelunternehmer), Härtingerstr. 29, 85051 Ingolstadt, Germany. Email: support@threethingsmedia.net, phone +49 162 5972624. We have not appointed a data protection officer because the law does not require one for an operation of this size; privacy requests go to the address above.

2. What We process, why, and on which legal basis

2.1 Visiting the website

When You load a page, Your browser sends Your IP address, the requested URL, the time, Your browser's user agent and the referring page to Cloudflare, which hosts and protects the site. This is needed to deliver the page and to defend the service against abuse. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a working, secure website). We run no analytics, advertising or tracking of any kind and use no third-party fonts.

2.2 Creating alt text

To write a description with our hosted AI, the image You choose and the optional context and keywords You enter are sent to our AI service (operated by Three Things Media on Cloudflare), which passes the image and prompt to the AI provider DeepSeek to generate the text. Neither AltKit nor our AI service stores the image: it is held in memory only while the description is written. For an image You right-click in the browser extension, the extension downloads the image in Your browser, without Your cookies, and sends it with the image's web address; the website hosting it sees that request coming from Your browser. Extension versions before 2.5.1 send only the address, and altkit.app downloads the image from it without Your cookies or sign-in. If You are signed in, the generated alt text is saved in Your library; if You turn on library previews in Your account, a small preview of each uploaded image (at most 360 pixels, under 100 KB) is kept with it until You delete the item or Your account. Legal basis: Art. 6(1)(b) GDPR (performing the service You request). Do not upload images containing other people's personal data unless You are allowed to share them.

AltKit is free, and each account may create a limited number of descriptions per UTC day with our hosted AI. To enforce that daily limit and to monitor what the service costs, We record for each hosted generation on Your account the date, a daily count, whether it succeeded or failed, and where it came from (web app or browser extension). Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in preventing abuse and keeping a free service affordable).

2.3 Using Your own AI provider key in the browser extension

In the browser extension You can add Your own API key from an AI provider You choose (OpenAI, Anthropic, Google Gemini, DeepSeek or xAI). When You do, the extension sends the image and the alt text instructions directly from Your browser to that provider. For an image You right-click, the extension first downloads the image itself (without cookies) so it can send it. Your key is stored only in the extension's local storage on that device: it is never synced, never sent to AltKit, and deleted when You remove it in the extension. AltKit receives nothing from these requests - no image, no alt text and no key - and does not log them. The provider acts for You under Your own account with it, not as our processor; its own terms and privacy policy apply, and usage and charges for these requests are between You and Your provider. AltKit's daily limit does not apply to them.

2.4 Free web-form images

Without an account You can create 2 descriptions in the web form. To enforce that limit and to stop abuse We store a keyed hash of Your IP address (never the address itself) with a usage counter, and, only if You accept functionality storage in the cookie settings, a random device identifier kept in Your browser. Legal basis: Art. 6(1)(f) GDPR (preventing abuse of a free service) and, for the device identifier, Your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which You can withdraw at any time in the cookie settings.

2.5 Your AltKit account

Accounts are provided by Three Things Media Accounts (auth.altkit.app), our shared sign-in service, which stores Your name, email address, a hash of Your password, and Your sign-in sessions. If You choose "Continue with Google", Google Ireland Limited confirms Your identity and shares Your name, email address and profile picture with us. AltKit itself keeps a profile with Your user ID, email, role and settings, Your daily usage counts, Your generation history and Your library. Legal basis: Art. 6(1)(b) GDPR.

2.6 Contact form and email

When You write to us, We process Your name, email address and message to answer You. The contact form is protected by Cloudflare Turnstile, which checks Your browser for signs of automation; Turnstile is loaded only on the contact page. Legal basis: Art. 6(1)(b) GDPR for questions about the service, otherwise Art. 6(1)(f) GDPR (answering enquiries and keeping the form free of spam). We send transactional email (sign-in, password reset) through Cloudflare. We send no marketing email, SMS or push notifications.

2.7 Storage on Your device

We use only the cookies and browser storage described in the cookies policy: strictly necessary session, security and consent cookies, Your theme choice, and the optional device identifier described above.

3. Recipients and processors

We share personal data only with the following service providers, each bound by a data processing agreement or acting as an independent controller where stated:

  • Cloudflare, Inc. (USA; Cloudflare Germany GmbH in the EU) - hosting, database and file storage (Workers, D1, R2), network security, transactional and routed email, and Turnstile bot protection on the contact form.
  • Three Things Media Accounts - our own sign-in and account service, operated by the controller on Cloudflare.
  • Three Things Media AI service - our own gateway to the AI provider, operated by the controller on Cloudflare.
  • Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (China) - the AI provider that generates descriptions from the images and text We send it for hosted generation.
  • Google Ireland Limited (Ireland) and Google LLC (USA) - only if You choose to sign in with Google; Google is an independent controller for Your Google account.

If You use Your own API key in the browser extension, the image goes directly from Your browser to the provider You picked (OpenAI, Anthropic, Google, DeepSeek or xAI). That provider is a recipient You choose and engage under Your own account, not our processor, and We do not transfer anything to it ourselves.

We do not sell personal data and do not share it for advertising.

4. Transfers outside the EU

Cloudflare and Google may process data in the United States. Where a recipient is certified under the EU-U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR); otherwise it relies on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

For hosted generation, images and prompts are sent to DeepSeek in China. There is no adequacy decision for China, so this transfer relies on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the applicable safeguards.

5. How long We keep data

  • Images You send for a description: not stored; held in memory only while the description is written.
  • Library items and previews: until You delete them or Your account.
  • Account, profile, daily usage counts and generation history: until You delete Your account.
  • Hashed IP usage counters for the free web form: for as long as they are needed to enforce the free limit; You can ask us to delete Yours at any time.
  • Contact messages: until Your enquiry is resolved, then at most 12 months.
  • API keys You add to the browser extension: never reach us; they stay on Your device until You remove them or uninstall the extension.
  • Server and security logs at Cloudflare: according to Cloudflare's retention, typically a few days.

Deleting Your account from the account page deletes Your Three Things Media account and removes Your AltKit data, except records We must keep by law.

6. Your rights

You have the right to access Your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to withdraw any consent at any time with effect for the future (Art. 7(3)). Where We rely on legitimate interests, You have the right to object on grounds relating to Your particular situation (Art. 21). Send requests to support@threethingsmedia.net.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You may also contact the authority where You live or work.

7. Is providing data required?

You do not have to give us any data to read the website. To create alt text We need the image; to use an account We need Your email address. Without them that part of the service cannot be provided. We make no automated decisions with legal or similarly significant effect on You (Art. 22 GDPR).

8. Age

AltKit is intended for people aged 18 and over, in line with our terms. We do not knowingly process data of anyone younger; if You believe a minor has given us data, contact us and We will delete it.

9. Changes

We update this policy when the service or the law changes and show the date of the latest version above. If a change affects how We use data You have already given us, We will tell You by email before it takes effect.