Privacy Policy

1. Information We Handle

• Account Data: Email address, an opaque account ID, the name supplied by your sign-in provider when available, authentication records, and account status.
• Photos & Media: Images you import or capture, local edit state, Gallery records, and images explicitly submitted for Cloud processing.
• Purchases: Product, platform, transaction or purchase-token identifiers, subscription status and expiry, lifetime entitlement sources, credit grants, reservations, consumption, refunds and delivery records. RNDMFLM does not receive your full payment-card details.
• Diagnostics: Cloud quota counters, share-reward state, app/device diagnostics, performance data, crash data, and security logs. Sentry uses a random installation identifier and records app interactions, such as control taps and navigation, to help diagnose failures. These diagnostics run automatically; the app currently has no diagnostics opt-out. Sentry crash and performance diagnostics are not tagged with your RNDMFLM account ID, email, or name; server quota and security records may remain associated with the account when required to operate and protect the service.

2. Local Editing and Storage

Roll rendering, tone and color edits, History, and the in-app Gallery are stored and processed on your device unless you choose a Cloud feature. Ordinary sign-out does not erase this local creative data. Account deletion starts a best-effort purge of local Gallery records, preview cache, and RNDMFLM settings on that device.

3. Cloud Processing

When you request a Cloud frame or Looks preview, RNDMFLM sends the selected source image, crop or face reference when required, and processing instructions through our Supabase service to Runware for generation. The result is returned to your app. Do not submit an image unless you are comfortable having it transmitted to these processors for the requested operation.

4. Pending Cloud recovery

Before sending a full Cloud request, the app saves one undelivered request per account on the device, including its request identifier, prepared upload image, saved crop, recipe, prior Cloud result and an existing baked STACK image when needed. The cache does not contain your bearer token or Store receipt. It supports the original request rather than a new generation.

A pending record is eligible for recovery for 24 hours from its first save. Expired records are cleared on the next cache access; accepted delivery or account deletion clears the corresponding local work. Ordinary sign-out keeps account-owned pending work on that device. Clearing app data removes this cache. Server job and accounting records retain bounded status and result references; this does not create an archive of your original photo. Provider storage and availability follow the provider's policies.

5. Optional Supporter recognition

Special Thanks stores a nickname you explicitly choose, publication consent, review status and revision against your account. We do not copy your sign-in name, email or Store identity into the public list. Only an approved nickname and a random public entry key are exposed, while consent and a valid production Supporter purchase remain in effect.

You can change or withdraw the nickname in Special Thanks. A new nickname requires review. Withdrawal, final Supporter revocation or account deletion removes eligibility from the public projection; refund reversal does not publish it again. Public views refresh periodically and may briefly display a previously loaded name. The app does not persist nickname lists on the device and clears its displayed data when the view closes, the account changes or the app goes into the background.

5a. Support and Cloud reports

When you choose Send report while signed in, we send your report category, message (up to 300 characters), recent Cloud job and request references when available, and app version, build and platform to our Supabase backend, associated with your account. This report feature does not attach a photo, provider image URL, Store receipt or payment-card details. Do not include passwords or sensitive personal information in your message.

We use these reports to investigate content problems, handle support requests and prevent abuse. Access is restricted to authorised support operators. The app clears an unsent message when you close the Support sheet. In-app report records are removed when your RNDMFLM account is deleted. If you choose email instead, your email provider also handles the message under its own policies.

6. Why We Use Information

We use information to authenticate accounts, render requested results, enforce FREE and PRO quotas, verify purchases, restore entitlements and credit balances, deliver optional Supporter recognition, save or restore your local work, diagnose failures, prevent abuse, secure the service, and meet legal obligations. We do not sell personal information or use your photos for third-party advertising.

7. Service Providers & Disclosure

RNDMFLM uses service providers including Supabase for authentication and backend data, Runware for requested Cloud image processing, Sentry for restricted diagnostics, and Apple or Google for sign-in, distribution, billing, and subscription management. We require providers that receive user data to provide the same or equivalent protection described in this policy and required by applicable law; their processing is also governed by their applicable terms and privacy notices. We may disclose information when required by law or to protect users and service integrity.

8. Retention and Deletion

Local photos and Gallery records remain on your device until you remove them, clear app data, or delete the account using the in-app control. Account deletion removes the RNDMFLM account and associated personal service data, except records retained as needed to prevent fraud, settle Store transactions, secure the service, or meet legal requirements. Cloud providers may retain operational records according to their policies.

9. Your Controls

You can avoid Cloud processing and continue using local editing. You can manage photo permissions in device Settings, sign out without erasing local creative data, restore purchases, manage subscriptions through the Store, delete Gallery items, and request account deletion inside RNDMFLM. You may contact us to ask about access, correction, or deletion rights available in your jurisdiction.

10. Security, Children, and International Processing

We use access controls, encrypted transport, server-side purchase verification, and restricted service credentials. No system is perfectly secure. RNDMFLM is not directed to children below the digital-consent age in their country. Service providers may process data outside your country subject to applicable safeguards.

11. Changes and Contact

We may update this policy as features, providers, or laws change. Material changes will be reflected by a new effective date.

If you have privacy questions or rights requests, contact rndmflm@gmail.com.