API data handling and privacy

The current YingTu privacy policy states that, under normal service configuration, YingTu does not use API inputs or outputs for model training, advertising, marketing, or user profiling. Requests still have to be transmitted to the selected upstream AI provider and the infrastructure required to process them. The upstream provider’s own terms, abuse-monitoring practices, retention rules, and training controls apply separately. YingTu’s policy must not be read as a promise about Google or another upstream provider.

What the service processes

Data category	Why it may be processed
Prompt and source image	Route and complete the requested generation or edit
Generated response	Return a synchronous result or make an asynchronous result retrievable
Service metadata	Account, key identifier, time, model, operation, usage, status, latency, route, and error diagnosis
Billing records	Reserve, settle, or return API quota and support account reconciliation
Support material	Investigate the specific issue a user chooses to report

Diagnostic or security processing may temporarily include limited request parameters or upstream response fragments. Avoid submitting data that the task does not require.

Synchronous and asynchronous data

A synchronous request carries its content while the upstream model is processing it and returns the result on the same connection. An asynchronous request must persist enough task data to execute after the submitting connection ends. Source-image Base64 is cleared when the task reaches a terminal state. After successful completion, the image result remains retrievable by the authenticated account for 24 hours. Move completed media to storage you control instead of treating the task API as permanent object storage.

What has a fixed result window

Successful asynchronous image results expire 24 hours after completion. The API then reports expired and does not return the old Base64. This result window does not define how long task records, service metadata, billing records, diagnostic logs, or failed-task errors are retained; no fixed public period is promised for those categories. Operational, security, dispute, backup, and legal requirements may differ. If a procurement or compliance decision requires a contractual retention schedule, data residency, deletion deadline, or processor list, contact API support before sending production data.

Reduce the data you expose

Remove secrets, credentials, personal data, and confidential text that the generation does not need.
Keep API keys on the server and separate development from production credentials.
Do not write full Base64 content or Authorization headers to ordinary logs.
Store the returned image in your own controlled system and keep only identifiers needed for support.
Review the selected upstream provider’s current policies for the model and account type you use.

The complete legal terms remain the privacy policy and user agreement.

Secure API keys

Keep credentials out of browser-delivered code, logs, and screenshots.

Understand task storage

Persist your own task ID and copy completed output to controlled storage.

​What the service processes

​Synchronous and asynchronous data

​What has a fixed result window

​Reduce the data you expose