Public purchases and generation are closed. Approved operator tests are separate. The processing below describes the implemented service when enabled.
Updated October 18, 2026
Photo previews and validation
The first release lets you select curated AI-created fictional adult character photos supplied by this site. It does not accept custom uploads, real-person photos or celebrity portraits. Browser previews and free file checks do not send the selected photos to an AI video provider. File checks are not automated identity or age verification.
When generation is available, the server verifies that both photos match the supplied character images and checks their file content. Generating a video sends both selected photos, re-encoded without source metadata, and the built-in story prompt to OpenRouter and its selected Wan provider. The curated source images are public site assets, while the resulting task and video remain private. Checking a consent box does not authorize a custom photo upload.
Private tasks and video storage
The service keeps a private task ID, portrait-byte hash, selected settings, submission state, provider ID and reported provider cost. These records contain neither the photos nor the OpenRouter key. Production storage is a private Cloudflare R2 bucket; local development uses a private directory.
Completed MP4 files are retained for 24 hours after completion. Authenticated playback and download are not publicly indexed or added to the gallery. Expired files become inaccessible immediately and are removed by maintenance. Download your own copy before expiry.
Deleting a terminal task removes its saved video and detailed local record. A minimal ownership tombstone and spent authorization remain to prevent duplicate billing. This action does not delete provider copies, undo charges or erase records required to review a payment. Active or uncertain tasks must be checked first.
Essential cookies and recovery
An HTTP-only customer cookie identifies the private browser session for up to 30 days. It is required for checkout, orders and private results; public file checks do not require it. Operator sessions last up to eight hours. Cookies use Secure on the public HTTPS domain and same-site protections.
The browser tab stores request IDs for task and checkout recovery, not photo files. Clearing cookies or changing browsers can remove access to purchases. Contact support with your Waffo receipt if this happens. The site does not require a customer account.
Payments and financial records
Waffo hosts checkout and processes payment details. Card numbers are not submitted to or stored by this application. Waffo may collect email, billing and tax information under its own terms. Our order records contain a hashed session identity, order and payment references, verified amounts, refund status and the linked task.
Order and spending records are retained for reconciliation and duplicate-charge prevention; they are not automatically erased with video files. Private recovery copies of records may remain in storage history or operator backups. Contact support to request a review of record access or deletion. We do not promise immediate deletion of all accounting or provider records.
Service providers
Cloudflare handles hosting, network delivery, image validation and re-encoding, and private R2 storage when deployed. OpenRouter and the selected video provider receive reference photos and the story prompt only for explicitly submitted generation. Their processing regions, retention and deletion depend on their current agreements; we do not claim zero retention by these services.
Support email is forwarded by Cloudflare Email Routing to a private Google Gmail inbox. Include an order or task reference, not source portraits, passwords, API keys or card details. Public example videos depict AI-created fictional adults and are separate from private customer results.
Questions and requests
Use the official address on our contact page for privacy requests. We may need evidence of the relevant purchase or session before releasing or deleting private records. This site does not publish a private forwarding address.