Privacy Policy

Effective date: October 15, 2026

This Privacy Policy explains what information the Viral Factory iOS app and this website collect, why, and the choices you have. Viral Factory is developed by Rıdvan Uyan, an individual developer, who is the controller of your information for the purposes described here.

Information we collect

We do not use advertising trackers, and the app does not request Apple’s App Tracking Transparency permission.

• Account identifiers — a random device identifier created the first time you open the app, used for your guest account on that device; if you sign in with Apple or Google instead, we receive your name, email address (or a private relay email) and the provider account ID.
• Content you provide — prompts and text you write; photos, videos or links you upload or paste, such as a reel link to remake, a reference photo for the Character or Cameo studios, or a screen recording to analyze.
• Generated content — the media, scripts and captions the app creates for you, and your generation and credit-transaction history.
• Purchase information — subscription and credit-pack purchases are handled by the App Store; RevenueCat processes purchase and entitlement events on our behalf. We never receive your card number.
• Social account connections — if you connect TikTok, Instagram or YouTube to publish content, we receive that account’s basic profile info (handle, display name, avatar) and store an encrypted access token so the app can publish on your behalf.
• Analytics — we use Mixpanel and PostHog to understand how the app is used. PostHog session replay is enabled for interaction analysis, but all on-screen text and images are masked before capture, so replay never shows your prompts, photos or generated media. Analytics uses a separate, random installation identifier — never your guest account identifier.
• Device and diagnostic data — app version, general device model and operating system, and language settings. Our analytics and purchase providers may also derive an approximate location (such as country or region) from your IP address; the app does not request your device location. We also keep the IP address and user agent of your sign-in sessions for security.
• Crash and performance diagnostics — we use Sentry (EU region) to find and fix crashes and errors. Reports include stack traces, device model and operating system, app version, a trail of recent app events such as screen navigation, and performance timings for a sample of sessions. They are linked to your Viral Factory account ID, not to your email address or name.
• Notification preferences — whether you have turned on the daily-idea reminder, stored locally on your device.

How we use your information

• to operate the app and generate the content you request
• to authenticate you and maintain your account and credit balance
• to process purchases and manage subscriptions
• to publish or schedule content to social accounts you explicitly connect
• to deliver the daily hooks feature and, if enabled, a local reminder notification that never leaves your device
• to understand product usage, fix bugs and improve features
• to detect abuse, fraud and violations of our Terms of Use
• to respond to support requests you send us

AI generation and third-party processors

Content and reference material you submit are sent to fal.ai, our AI infrastructure provider, solely to generate the output you requested. Depending on the request, fal.ai routes the job to model providers that currently include OpenAI, Google (Gemini), Anthropic (Claude), Kling, ElevenLabs, Topaz and OmniHuman. We do not hold separate direct accounts with these providers — fal.ai is the processor we contract with. We do not use your content to train our own models. Our AI infrastructure provider, fal.ai, processes your content only to generate the output you requested, under its own terms and privacy policy (fal.ai/privacy).

Uploaded photos, videos and the media we generate are stored with your projects until you delete them or delete your account. Reference links you paste — for example, a reel to remake — are analyzed only to write your storyboard; the reference video itself is not stored in your library.

Generated media is stored on Amazon Web Services (S3) and, for some assets, Supabase Storage, and delivered through a content delivery network. Application data (accounts, projects, credit ledger) is stored in MongoDB. Our backend is hosted on DigitalOcean.

Sharing

We share information only with:

• the service providers above, to the extent needed to run the app (AI generation, hosting, storage, analytics, purchase processing);
• the social platforms (TikTok, Instagram, YouTube) you explicitly connect and choose to publish to;
• a buyer or successor, if we are ever involved in a merger, acquisition or asset sale, subject to this Policy;
• law enforcement or others, if required by law or to protect our rights, users or the public.

What we don’t do

We do not sell personal data, and we never share your prompts, uploads or generated content with other users unless you explicitly choose to make something public.

Data retention

Your account and generated content are retained while your account is active. Uploaded photos, videos and generated media are stored with your projects until you delete them or delete your account. Deleting your account (Profile → Settings → Delete Account) removes your account data and stored media. You can delete individual generations in the app at any time.

Deleting your account

You can permanently delete your account at any time in the app: Profile → Settings → Delete Account. This immediately and permanently deletes your account, credit history, videos, characters, prompts and connected social accounts, and revokes the Sign in with Apple grant if used. It does not cancel an active App Store subscription — cancel that separately in your Apple ID settings. See our Delete Account page for full, step-by-step instructions, including how to request deletion by email if you no longer have the app. Copies already held by our analytics, crash-reporting, purchase and AI providers (Mixpanel, PostHog, Sentry, RevenueCat and fal.ai) are not removed by the in-app deletion; email us to request their deletion.

Your rights under the GDPR (EEA, UK, Switzerland)

If you are located in the EEA, UK or Switzerland, you have the right to access, correct, delete and receive a copy of (portability) your personal data, and to object to or restrict certain processing. We process your data based on: performance of a contract (providing the app), your consent (for example, session-replay analytics), and our legitimate interests (security, abuse prevention, improving the service). To exercise any of these rights, email ridvan.uyn@gmail.com; we will respond within one month.

California residents (CCPA/CPRA)

California residents may request to know, delete or correct the personal information we hold about them, and to opt out of its “sale” or “sharing” — we do not sell personal information and do not use cross-context behavioral advertising trackers. Send requests to ridvan.uyn@gmail.com.

Children

Viral Factory is not directed to children under 13 (or the minimum age required in your country) and we do not knowingly collect their information. If you believe a child has provided us with personal information, contact us and we will delete it.

International data transfers

We and our service providers may process your information outside the country where you live, including in the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.

Security

We use industry-standard safeguards — including encryption in transit, encrypted storage of social-platform access tokens, and access controls on our systems — to protect your information. No method of storage or transmission is 100% secure.

Changes to this Policy

We may update this Policy from time to time. The effective date above reflects the latest revision; material changes will be reflected on this page.

Contact

Rıdvan Uyan (data controller) — ridvan.uyn@gmail.com