MaybeReal – Privacy Policy

Last updated: 2025-12-25

This Privacy Policy explains how 3DATA ("we", "us", "our") collects, uses, and protects your information when you use the MaybeReal mobile application (the "App").

1. Information we collect

1.1 Account and authentication information

• Email address and/or authentication identifiers (for login and account management).
• Basic profile information if you sign in with a third-party provider (e.g., Apple, Google), as allowed by that provider.

1.2 Content you upload and generated content

• Images and other media that you upload to use the App's features (enhancement, upscaling, filters, colorization, etc.).
• Generated outputs produced by the App (processed images, thumbnails/previews).
• Technical processing metadata needed to run the service (e.g., request identifiers, processing status, timestamps).

1.3 Face data (images containing faces)

The App may process images that contain a face to apply visual effects (filters, enhancement, upscaling, colorization, alignment, artistic transformations).

What we collect:

• Images uploaded by you that may contain faces. The "face data" is the image content itself.
• We do not extract, create, or store separate biometric identifiers (such as face templates, embeddings, or faceprints).

How we use face data:

• Solely to apply visual effects and AI transformations requested by you.
• If face detection is used (e.g., for alignment or positioning), any derived data (bounding boxes, landmarks) is used only during real-time processing and is not stored.
• We do not use face data to identify or authenticate any person.
• We do not use face data for advertising, marketing, or user profiling.

Sharing:

• Images containing faces are shared with our AI processing providers solely to perform the requested transformations. See Section 3.3 for details.
• Face data is never shared for advertising, marketing, or profiling purposes.

Storage and retention:

• Uploaded images are stored temporarily in Supabase Storage using time-limited signed URLs.
• Uploaded images are retained for up to 1 hour, then automatically deleted.
• Generated results are retained for up to 24 hours, then automatically deleted.
• We do not retain face data beyond these timeframes.

1.4 Purchase and subscription information

• We use RevenueCat to manage in-app purchases and subscriptions.
• RevenueCat receives a unique anonymous user identifier to track your subscription status.
• We do not receive or store your full payment card details. Payments are processed by Apple (App Store) or Google (Play Store).

1.5 Usage and device data

• Technical information: device model, operating system version, app version, approximate timestamps of use.
• Non-identifying information about how you use the App (e.g., which features are triggered).

2. How we use your information

We use the information we collect to:

• Provide and operate the App's core features (image enhancement, upscaling, colorization, filters, etc.).
• Authenticate you and secure your account.
• Store content temporarily so you can retrieve your results.
• Manage your subscriptions and in-app purchases.
• Monitor performance and improve the App.
• Prevent abuse, spam, fraud, and misuse of the service.
• Comply with legal obligations and enforce our terms (where applicable).

3. Third-party services

We rely on third-party providers to operate the App. Below is a comprehensive list:

3.1 Supabase (backend, database, authentication, storage)

We use Supabase for backend services, database, authentication, and storage. Your account data and your uploaded images and generated results may be stored and processed on Supabase infrastructure.

Uploaded images and generated results are stored in Supabase Storage and access is controlled using time-limited signed URLs.

Privacy Policy: https://supabase.com/privacy

3.2 Google Cloud Run (infrastructure)

We use Google Cloud Run to host backend processing services. Your images may be temporarily processed on Google Cloud infrastructure.

Privacy Policy: https://policies.google.com/privacy

3.3 AI service providers (image processing)

To generate the requested results (e.g., enhancement, upscaling, restoration, colorization, filters, and other AI transformations), we use external AI service providers acting as data processors, including:

• Fal.ai – https://fal.ai/privacy
• Replicate – https://replicate.com/privacy
• ByteDance – https://seed.bytedance.com/en/privacy-policy

For this purpose, your uploaded images (which may contain faces) are shared with these providers so they can process the content and return the requested output. We share only what is necessary to perform the processing.

AI Provider Use of Content

Uploaded content (including images that may contain faces) is processed by third-party artificial intelligence service providers in order to deliver the App’s functionality. In certain cases, these providers may also use such content for the training and improvement of their AI systems, in accordance with their respective privacy policies referenced in this document. This means that images you submit through the App may be retained and reused by those providers beyond the scope of your individual request.

By continuing to use the App, you agree that your uploaded content may be processed in this manner by our AI service providers. Please review their privacy policies for further details regarding such processing.

3.4 RevenueCat (subscription and purchase management)

We use RevenueCat to manage in-app subscriptions and purchases. RevenueCat receives an anonymous user identifier and information about your subscription status. RevenueCat does not receive your images or other content.

Privacy Policy: https://www.revenuecat.com/privacy

3.5 Apple / Google (platform services)

If you choose to sign in using Apple or Google, those providers process certain information under their own privacy policies. Purchases and subscriptions made through the App Store or Play Store are processed by Apple or Google respectively. We do not receive your full payment card details.

4. Legal bases (if you are in the EU/EEA)

We process personal data under the following legal bases:

• Contract: to provide the App and deliver requested features.
• Legitimate interests: to secure, maintain, and improve the service, prevent fraud, and troubleshoot issues.
• Consent: where required (e.g., access to photos/camera permissions depending on your device settings).
• Legal obligations: where we must comply with applicable laws.

5. Data retention

• Account data is kept for as long as your account remains active. You may request deletion at any time.
• Uploaded images are retained for up to 1 hour to allow our AI service providers to retrieve and process them, then automatically deleted.
• Generated results are retained for up to 24 hours so you can view and download them, then automatically deleted.
• Subscription data is retained by RevenueCat as long as necessary to manage your subscription.
• Logs and technical data are kept only as long as necessary for troubleshooting, security, and improving the service (typically no more than 90 days).

6. Data security

We implement reasonable administrative, technical, and organizational measures designed to protect your information, including:

• Restricted access controls to backend systems and storage.
• Use of signed, time-limited URLs for temporary access to uploaded images and results.
• Encryption in transit (HTTPS/TLS) for all communications.
• Regular review of our security practices.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work to protect your data.

7. Your rights

Depending on your location, you may have rights regarding your personal data, including:

• Access: request a copy of your data.
• Correction: request correction of inaccurate data.
• Deletion: request deletion of your data and account.
• Portability: request your data in a portable format.
• Objection: object to certain processing of your data.
• Withdraw consent: where processing is based on consent.

To exercise your rights, contact us using the email address in the Contact section below.

8. Children

The App is not intended for children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will take appropriate steps to delete that information.

9. International transfers

Your information may be processed in countries other than your own, including the United States and other countries outside the European Union, especially when using third-party service providers. Where required by law, we rely on appropriate safeguards for such transfers, including standard contractual clauses where applicable.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above. Material changes will be communicated through the App or by other means. Your continued use of the App after an update means you accept the updated Privacy Policy.

11. Contact

If you have any questions about this Privacy Policy, want to exercise your rights, or have concerns about how we handle your data, contact us at: maybereal.app@gmail.com.