Consent that is enforced at generation time, not argued about afterwards.
Creators publish a machine-readable boundary set: the contexts their likeness may appear in, the depictions that are never permitted, the realism ceiling, whether conversational use exists, and how fast consent can be withdrawn. Every request — from the website, the API or an agent over MCP — is evaluated against that document server-side before a model is called.
What the boundary set actually controls
Structured fields, not prose. A rule written in a paragraph is a rule somebody has to read and agree to interpret; these are evaluated the same way every time, and the evaluation is reproducible from the version and policy hash recorded on the output.
An allowlist of 10 contexts. A context the creator has not permitted is refused — omission is not permission.
See the vocabulary →15 categories a creator can forbid, with 4 the platform forbids on everyone’s behalf. Adult categories stay closed unless explicitly opened.
Stylised, illustrative or photoreal. Photoreal additionally requires a fully identity-verified requester, not merely an age-verified one.
A cap, a rolling window and a variety nudge, enforced on the same path as the content rules. Soft by default; a creator can make it a hard refusal.
Four things no creator can license away
Checked before the creator’s own rules are read, so the outcome never depends on how carefully a boundary set was filled in. Each is a case where the creator’s permission is not the only consent that matters.
A creator cannot consent on behalf of a child, and no boundary set may authorise output that sexualises or juvenilises a likeness. Refused platform-wide, before the creator's own rules are read.
Why this one →The product exists to make consent legible. Output that performs the absence of consent contradicts the artifact it would be stamped with, whatever the boundary set says.
Why this one →A licensed likeness in a fabricated news frame deceives third parties who never entered into the licence. Creators may license endorsement; they may not license the appearance of a fact.
Why this one →Defamatory by construction and unlawful in most of the markets this operates in. Not a creator-level choice.
Why this one →For fans
Verify your account once, then generate inside what the creator actually agreed to. The free tier gives 3 watermarked generations a day; credits and per-creator subscriptions remove the watermark, never the boundaries.
Pricing →For agencies
Onboard a roster, record the identity evidence you hold, and change boundaries across every creator you manage in one call. Each creator still gets their own new version, so whose consent is whose never blurs. Revenue splits are configurable and recorded per payment.
Agency console →For agents
Read the boundary set as JSON, dry-run a request for free, then generate. A refusal is a 403 naming the rule and the matched term, so an agent can adjust rather than retry blindly. MCP server included.
MCP server →Questions people actually ask
- How is consent verified?
- Twice, on both sides. A creator is not listed until the managing agency records the identity evidence held for them, and the platform refuses to activate a profile without it. A requester cannot generate until their account clears age assurance through Stripe Identity, and photoreal output additionally requires full identity verification.
- What happens if a request breaches a boundary?
- It is refused before any model is called, with the specific rule and the matched term quoted back. It is never quietly rewritten into something permitted, and the refusal is recorded in the creator's audit log. The same code path serves the website, the API and the MCP server, so an automated integration cannot get a weaker check than a browser.
- Can a creator change their mind?
- Yes, at any time. Editing a boundary set publishes a new version that takes effect on the next request; revoking consent stops all further authorisation immediately. Earlier versions stay readable rather than being deleted, because that is what makes already-distributed output traceable and a revocation actionable rather than symbolic.
- Is anything forbidden regardless of what the creator permits?
- Four categories: depictions involving minors, non-consensual framing, deceptive news and official framing, and criminal or extremist context. These are checked before the creator's own rules are read and cannot be permitted by any boundary set. Each is a case where the creator's permission is not the only consent that matters.
- What proves an image came from here?
- Every authorised output carries a provenance manifest — creator, boundary-set version, policy hash, requester, surface and timestamp — signed with HMAC-SHA256. Anyone holding a manifest can verify it without an account, so a takedown or a card-network consent request is answered with an artifact rather than an assurance.