TamashiiDrop :: Privacy Policy

This Privacy Policy explains how we collect, use, share, and protect information when you use Tamashii Drop / TamashiiDrop (the "Service").

----------------------------------------

1. Who we are (controller)

Controller:
Serhii Bedzhyk (Serhii Viaslavych Bedzhyk / Беджик Сергій Вячеславович), individual entrepreneur registered in Ukraine.

Contact:
Email: admin@dudes.company

Address for correspondence / privacy requests:
Serhii Bedzhyk (FOP)
Abonentska skrynka (mailbox) № 142
vul. Khreshchatyk, 22
Kyiv, 01001
Ukraine

----------------------------------------

2. What we collect

2.1 Account data (authentication)

We use Clerk for authentication. Depending on how you sign up, this may include:
- email address
- username/display name (if provided)
- authentication identifiers (e.g. Apple/Google sign-in identifiers)

2.2 Photos and generation data
- photos you upload (including face photos/selfies)
- derived character traits used for generation (e.g. hair/eye colour and skin tone parameters you can tweak)
- generated Stickers and related metadata (e.g. timestamps, plan/pack identifiers, storage keys)
- quality flags/reports you submit

2.3 App and device data
- crash reports and diagnostic data (via BugSnag)
- product analytics and usage data (via PostHog), such as feature usage patterns, session data, and interaction events

2.4 Communications
- emails you send us (support, complaints, licensing requests, privacy requests)

2.5 Cookies and tracking technologies

The App does not use cookies. We use BugSnag for crash reporting and PostHog for product analytics. We do not serve ads and do not share data with advertising networks.

----------------------------------------

3. How we use your data

We use your data to:
- provide the Service (create your character sticker, generate sticker packs, deliver weekly drops where applicable)
- support re-rolls and regeneration (we retain your uploaded photo while your account is active so we can generate new versions)
- operate coins and plan entitlements
- review generated Stickers before delivery (currently human review)
- detect, prevent, and investigate abuse, fraud, and security issues
- debug and improve reliability (crash reporting and product analytics)

3.1 Legal basis for processing (where applicable)

Where data protection law requires a legal basis (such as the GDPR), we rely on:
- Contract performance: processing necessary to provide the Service you signed up for (account management, photo processing, Sticker generation and delivery, subscription management);
- Legitimate interest: processing for security, fraud prevention, crash reporting, product analytics, and service improvement, where our interest does not override your rights;
- Consent: where you opt in to specific features (such as allowing generated Stickers to be used for service improvement, as described in Section 5.2).

You may withdraw consent at any time via Settings in the App without affecting the lawfulness of processing carried out before withdrawal.

----------------------------------------

4. Third-party AI processing (photo sharing to provide the Service)

To generate Stickers, we transmit your uploaded photo to our third-party AI provider(s) (currently including Replicate and possible future fallbacks for reliability purposes) for processing, solely to provide the Service.

----------------------------------------

5. Improvement and training (future) and your choices

5.1 Uploaded photos are not used for training

Uploaded photos are used only to provide the Service (generation and re-rolls) and are not used for model training or fine-tuning.

If we ever decide to use uploaded photos for training in the future, we will ask for your explicit opt-in first.

5.2 Generated stickers and internal prompts (future)

We may use generated Stickers and our internal prompts to improve TamashiiDrop (for example, by evaluating quality or training/fine-tuning models) if we introduce those improvement methods in the future.

You can opt out in Settings at any time. If you opt out, we will stop using new generated Stickers going forward. We may not be able to undo improvement/training that has already occurred.

We do not sell your personal data.

----------------------------------------

6. Sharing and processors (we do not sell data; no third-party marketing)

We do not sell your personal data. We do not share your personal data with third parties for their own marketing.

We share data with service providers ("processors") who help us operate the Service, including:
- Clerk (authentication)
- Railway (application hosting; Europe region)
- Hetzner Cloud (application hosting; Europe)
- Storj (file storage; EU-WEST-1)
- BugSnag (crash reporting)
- PostHog (product analytics)
- Apple (App Store distribution, In-App Purchase billing, Apple Push Notification service)
- Expo (push delivery tooling)
- Replicate (AI image generation; your uploaded photo is transmitted to generate Stickers)

----------------------------------------

7. International access/transfers

We are based in Ukraine. Our hosting/storage is in Europe, but we may access and process data from Ukraine to operate and support the Service. Where required by law, we use appropriate safeguards.

----------------------------------------

8. Retention

8.1 While your account is active: we retain your uploaded photo(s), derived traits, and generated Stickers so we can provide re-rolls, ongoing generation, and access.

8.2 When your subscription expires or is cancelled (account remains): we may retain your data for a grace period of up to ninety (90) days following expiry. During this period, your data remains on our servers but you will not have access to active features. After the grace period, your uploaded photos, generated Stickers, and associated metadata are subject to archivation and/or permanent deletion at our discretion. We are under no obligation to maintain, serve, or restore this data after the grace period.

8.3 When you delete your account in-app: we delete your account data and associated Stickers/photos from our primary systems promptly.

8.4 Backups: deleted data may persist in backups for a limited time, typically up to 90 days.

8.5 Accounting/audit: we may retain anonymised transaction/audit logs for compliance/bookkeeping (e.g. up to 7 years), without direct identifiers.

----------------------------------------

9. Your rights and controls

9.1 Delete your account

You can initiate account deletion in the app.

9.2 Other rights

Depending on your location, you may have rights to access, correct, delete, restrict, object, and data portability. To exercise rights, contact admin@dudes.company. We may ask you to verify your request.

Data export: We do not currently offer self-serve export in the app. You may request a copy of your data by email.

----------------------------------------

10. Security

We use reasonable technical and organisational measures to protect your data. No system is 100% secure, and we cannot guarantee absolute security. You are responsible for securing your device and account access.

----------------------------------------

11. Photos and third-party likenesses

The Service only accepts photos in which the uploading user is the depicted individual. You must not upload images of any other person. By uploading a photo, you represent that you are the person shown and that you have the right to submit it for processing.

If we determine that uploaded content depicts someone other than the account holder, the account will be terminated immediately and the content permanently deleted, with no refund, credit, or right of appeal.

----------------------------------------

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will try to notify you of material changes (e.g. in-app notice). The "Effective date" shows when it was last updated.

----------------------------------------

13. Children's privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13 without parental consent, we will take steps to delete that data promptly. If you believe a child under 13 has provided us with personal data, please contact us at admin@dudes.company.