Effective date: 2026-08-12
Last updated: 2026-11-02
This policy describes how the Apps actually work today. If we change it in a way that matters, we will update it here and tell you in the app. Questions: privacy@aipictureframe.net.
This policy explains what AI Picture Frame ("we", "us") collects when you use the AI Picture Frame mobile app and the AI Picture Frame Display tablet app (together, the "Apps"), why we collect it, and who else sees it.
Controller: Omer Mazig (sole proprietor), Keren Kayemeth LeIsrael St 17A, Givatayim, Israel
Contact: privacy@aipictureframe.net
Photographs of people. If your uploads show identifiable people, that content may constitute sensitive personal data in some jurisdictions. Only upload photographs you have the right to use, and consider whether everyone depicted would consent to the processing described in Section 4.
When enabled, the Apps record a deliberately small set of events:
| Event | Meaning |
|---|---|
app_opened | The app was launched |
artwork_displayed | A piece of artwork was shown on a frame |
onboarding_step_entered | You reached a step in first-run setup |
onboarding_completed | You finished first-run setup |
onboarding_abandoned | You left first-run setup without finishing |
Each event carries only the platform (iOS/Android), the app version, and the event's own properties. There is no third-party analytics SDK, no advertising identifier, and no cross-app or cross-site tracking.
This is on by default and you can switch it off in Settings → Privacy → Share usage data. The setting is enforced on our servers, not just in the app, so turning it off stops collection rather than merely hiding it.
We use Sentry to capture crashes and errors so we can fix them. These reports can include device model, OS version, app version, and a technical stack trace.
| Purpose | Data used | Legal basis (UK/EU GDPR) |
|---|---|---|
| Create and secure your account | Account data | Performance of a contract |
| Generate artwork from your photos | Photographs, prompts | Performance of a contract |
| Show artwork on your frame | Artwork, pairing data | Performance of a contract |
| Notify you that artwork is ready | Push tokens | Performance of a contract |
| Take payment and manage your plan | Subscription data | Performance of a contract |
| Keep the service working and fix faults | Crash reports | Legitimate interests |
| Understand which features are used | Usage analytics | Legitimate interests, with an opt-out |
| Meet legal and tax obligations | Subscription records | Legal obligation |
We use the following processors. Your photographs are sent to the AI providers in this list in order to generate artwork.
| Recipient | What they receive | Why |
|---|---|---|
| Supabase | All account data, photographs, artwork, app records | Database, authentication and file storage |
| Amazon Web Services | Data in transit through our backend | Application hosting |
| Cloudflare (Workers AI) | Your photographs and prompts | AI image generation |
| Google (Gemini API) | Your photographs and prompts | AI image generation |
| Polar | Your email and billing details | Payment processing as merchant of record |
| Expo | Push notification tokens | Notification delivery and app updates |
| Sentry | Crash and error reports | Fault diagnosis |
Which AI provider handles a given request depends on the service tier you choose. Each provider processes the content under its own terms, and we recommend reading the privacy policy of any provider you are concerned about.
We do not sell your personal data and we do not share it with data brokers or advertisers.
Our database, authentication and file storage run on Supabase infrastructure
hosted in AWS ap-south-1 (Mumbai, India). Our application backend runs on
AWS in us-east-1 (N. Virginia, USA). Our processors listed in Section 4 may
process data in other countries, including the United States.
If you are in the UK or EEA, transfers outside your region rely on the safeguards offered by each processor, such as Standard Contractual Clauses.
| Data | Retention |
|---|---|
| Account data | Until you delete your account |
| Photographs and artwork | Until you delete them, or until account deletion |
| Push tokens | Until the device unregisters or the token goes stale |
| Usage analytics | 24 months |
| Crash reports | Per Sentry's retention, typically 90 days |
| Subscription and payment records | As long as tax and accounting law requires |
Depending on where you live, you may have the right to access, correct, delete, export, restrict or object to our processing of your personal data, and to withdraw consent where we rely on it.
If you are in the UK or EEA and you think we have handled your data badly, you may complain to your local supervisory authority.
California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not offer financial incentives for personal information.
The Apps are not intended for children under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
Data is encrypted in transit. Access to production systems is restricted. Passwords are stored only as hashes. No system is perfectly secure, and we cannot guarantee absolute security.
If we make a material change we will update the "Last updated" date above and, where the change significantly affects you, tell you in the app.
Omer Mazig
Keren Kayemeth LeIsrael St 17A, Givatayim, Israel