Privacy Policy
This policy explains what data the app handles, why, and where it goes. The developer, Ömer Erbalta (publishing as Brave Axe), is responsible for this data (data controller). PopShot for iOS does not require an account, does not show ads, and does not sell your data.
1. Your photos and generated images
- Sent only when you make a Pop. Your photo leaves your iPhone only when you start a creation (a single Pop, a group Pop or a 4-frame strip). The photo and a text description of the look you chose are sent over an encrypted connection to the developer's Firebase Cloud Function (Google Cloud, region europe-west1, Belgium), which passes them to our third-party AI provider, kie.ai. kie.ai runs the image model (ByteDance Seedream) that creates the new image and returns it to the app. Before the first photo is sent, the app tells you this and asks for your permission.
- Not stored on our servers. The Cloud Function only forwards the request; it does not keep your photos or the results. We do not use your photos to train AI models, for face recognition or to identify you.
- Kept by the AI provider only for a limited time. kie.ai stores the uploaded photo and the generated image temporarily to produce and deliver the result, then deletes them automatically; according to kie.ai's documentation, generated files are kept for at most 14 days. kie.ai processes the files under its own privacy policy.
- Faces are counted on your device. To tell a selfie from a group photo, the app counts the faces in a photo with Apple's on-device Vision framework. This happens entirely on your iPhone; the result is not stored and is never sent to a server.
- Group Pops include your friends' photos. When you make a group Pop from several selfies or from one photo of 2–4 people, every photo is handled exactly as described above. Only add photos of people who have agreed to it.
- Your results stay with you. Selfies you add and every Pop you make are stored on your device and, if iCloud is enabled on your iPhone, in your private iCloud database (Apple CloudKit) so your library syncs across your devices. We cannot read your private iCloud data.
- You can delete Pops and saved selfies inside the app at any time (My Pops, or Settings → Delete all Pops / Delete saved selfies). Deleting the app removes local data, and removing the app's iCloud data removes the synced copy.
2. Protecting the service
Requests to our Cloud Function are protected with Firebase App Check (Apple App Attest), which confirms that a request comes from a genuine copy of PopShot. App Check exchanges a device attestation with Google and Apple; it does not identify you.
3. Analytics and crash reports
The app uses Google Firebase services:
- Firebase Analytics: anonymous usage events (for example which screens are opened), device model, OS version, country and app version. This helps us improve the app.
- Firebase Crashlytics: crash logs and device state at the time of a crash.
- Firebase Cloud Messaging: a push token so we can send notifications you opted in to, such as "your Pop is ready" and news.
- Firebase Remote Config: feature flags and limits; no personal data is sent.
Firebase data is processed by Google under the Firebase Privacy and Security terms. Photos are never sent to Analytics or Crashlytics. PopShot does not use the Apple advertising identifier and does not track you across other companies' apps or websites.
4. Purchases
Subscriptions are sold through Apple's App Store. Apple handles payment, billing and refunds; we never see your card details. The app checks your subscription status with Apple to unlock Premium.
5. Permissions the app may ask for
The app may ask for Camera (to take a selfie), adding to Photos (to save your Pops) and Notifications (to tell you when a Pop is ready), only when a feature needs them. Photos you pick from your library are chosen with the system picker, without access to your whole library. Every permission is optional and can be changed in iOS Settings.
6. Data retention
Your selfies and Pops stay on your device and in your iCloud until you delete them. Files at the AI provider are deleted automatically as described in section 1. Analytics and crash data are retained by Firebase for up to 14 months.
7. Children
PopShot is not directed to children under 13 and we do not knowingly collect data from them.
8. Your rights
You can ask us to delete analytics data linked to your device or ask any question about this policy at erbalta80@gmail.com. Depending on where you live, you may have additional rights under GDPR, the UK GDPR, the CCPA or Türkiye's KVKK; we honour them on request. Your photos are processed only to provide the feature you request (performance of the service you asked for).
9. Changes
We will post any changes on this page and update the effective date above.