Privacy policy | Glimmry

1. Who we are

The data controller is bva Group LLC, a US limited liability company, 30 N Gould St, Sheridan, Wyoming 82801-6317, United States, which publishes the Glimmry app and the glimmry.com website.

For any question about your data: contact@glimmry.com.

2. In short

No password: your account is tied to your device. The campaign access application asks for your name and email address.
No targeted advertising, no trackers, no analytics tools, in the app or on the website.
We don’t sell your data or share it for advertising.
To generate images and videos, your choices, your studio texts and some images go through our AI provider.
Your creators (portraits, names, stories) are also saved on your iPhone.
You can delete everything from the app: Profile tab, “Delete my data”.

3. The data we process

3.1 Your device-bound account and security

Data: A random device identifier created by our servers; the identifier and public key of the App Attest key generated by your iPhone, its signature counter and environment; the dates your account was created and last used; the fingerprint (SHA-256) of your session tokens, never the token itself; single-use challenges.
Why: To check, using Apple’s App Attest, that requests really come from the Glimmry app on a genuine device, to open your session, to link your data to your device and to protect the service from abuse.
Legal basis: Performance of the contract (our terms of use) and our legitimate interest in keeping the service secure.
Retention: Challenges: 5 minutes, single use. Sessions: 30 days. Device: as long as your account exists.

3.2 Creating your creators

Data: The kind of creator (person, cat, dog or another animal) and the options you pick in the guided flow (for example age, skin tone, hairstyle or breed), your description of an animal, or the photo you import; the generated sheet of four portraits; the portrait you choose, cropped by our servers; its continuity sheet.
Why: To generate the portraits, then keep the same identity across videos.
Legal basis: Performance of the contract.
Retention: Portrait request (options and generation status): 14 days. Images and creator: as long as your account exists, unless you ask us to delete them.

You can create a character from the available options or import a photo of yourself (an adult) or your pet. After your confirmation, the selected photo is re-encoded without location metadata, stored on our servers and sent to the AI generation service to create the portraits and reference sheet. Their name and story are saved on your iPhone and sent to our servers when you create content.

3.3 The studio (creating content)

Data: Your idea (“Describe your video”), selected or edited hook, chosen angle, creator’s name and story; the promoted app or website link, name and description, and your Instagram or TikTok reference link and notes; the optional image you add (product, app screenshot, setting), re-encoded without its metadata, including location; the generated script and your edits, the generated voice, the opening frame and the video; the project’s status and dates.
Why: To write the script, generate the voice, the opening frame and the video, check that they follow our rules, and let you find your projects again.
Legal basis: Performance of the contract.
Retention: As long as your account exists, unless you ask us to delete it.

Provided links do not trigger automatic analysis of pages or videos. The information and notes you enter guide the script. Don’t put personal information in your idea or your creator’s story. Product images are separate from character reference photos: before a product image is sent, the app checks on your device, with Apple Vision, that it shows no face; this check sends nothing.

3.4 Campaigns

Data: Your campaign application: full name, date of birth, email address, country of residence, social handle and profile link, description of your content, submission date and manual review decision. A photo of your identity document is accessible only to our review team and never sent to AI generation services. It is deleted after the decision or, without a decision, within 30 days. Account deletion also deletes this document. Your sign-ups: campaign, creator and creator type, reserved rate and cap, status and date joined. Your publication links, view proofs, verified views and associated earnings; if you request a payout, your Whop user ID and username, amount, status, dates, and payment reference or decision reason.
Why: To process your campaign access application, reserve your spot and rate, prepare the video from the brief, verify views, and manually process payout requests.
Legal basis: Performance of the contract.
Retention: As long as your account exists, unless you ask us to delete it.

3.5 Technical data

Data: IP address, date and time, requested address and technical details of requests; daily usage counters per device.
Why: To route requests, limit their number (your IP address is used to limit attempts to open a session), apply daily quotas and troubleshoot errors. Our logs contain no tokens, keys or text from your requests.
Legal basis: Our legitimate interest in running and securing the service.
Retention: Daily counters: 2 days. Technical logs: deleted automatically after 7 days at most.

3.6 Support

Data: Your email address and the content of your messages, if you write to us.
Why: To reply and handle your requests, including requests to delete your data.
Legal basis: Our legitimate interest in answering requests; legal obligation when you exercise your rights.
Retention: Up to 3 years after our last exchange, then deleted.

Brand campaign requests

The campaign request form collects your name, work email, brand, product URL, category, audience, campaign goal, indicative budget, selected platforms and optional reference link. The Glimmry team uses these details to review your brief and contact you about setting up a campaign. Submitting the form does not publish your brief or create a paid campaign.

Requests are stored in our Cloudflare database and accessed through the private team console. They are not sent to AI generation services. We keep them for up to three years after the request or its last recorded review. A daily hash derived from the connecting IP address helps limit repeated submissions; the form does not store the raw IP address.

These requests are separate from an app account. To ask us to delete a brand request, email contact@glimmry.com from the address used to submit it.

4. What stays on your iPhone

Some data is stored on your device:

your creator library (portraits, names, chosen options and stories), in the app’s private storage;
your session token and the identifier of your App Attest key, in the iPhone keychain, not synced with your other devices;
your project files (video, voice, added screenshot) prepared for the preview, Photos and sharing, in the app’s cache, erased at launch beyond the 3 most recent projects or after 7 days without use;
your age confirmation and the progress of a portrait creation underway, in the app’s settings.

Photos: the app only asks for permission to add videos to your library. When you pick an image for the studio, the iOS photo picker only gives the app the image you selected.

In the app, Profile, “Delete my data” erases your data on our servers, then on your iPhone. Deleting a creator only erases it from your iPhone; deleting the app erases its local library. See the Delete your account page.

5. Service providers and AI

We don’t sell your data. It is only shared with the service providers the service needs, acting on our behalf:

Cloudflare, Inc. (United States): hosting for our server (Cloudflare Workers), database (Cloudflare D1), private storage for images and videos (Cloudflare R2), rate limiting and technical logs; and hosting for this website (Cloudflare Pages). The database and the file storage are hosted in Cloudflare’s Asia-Pacific region.
Kie.ai (operated by NEXUSAI SERVICES LLC and INNOLEAP AI LLC, Denver, Colorado, United States): the API platform that runs our generations. It receives the generation instructions built from your options, your idea, the angle, your creator’s name and story, the campaign brief where relevant, the script’s lines and the images needed (imported starting photo, chosen portrait, continuity sheet, opening frame, any image you added). The files we send are placed on its file host, which deletes them after 24 hours; results, including the voice, stay available at Kie for up to 14 days, and we keep a copy on our servers.
The AI models used through Kie.ai: Nano Banana Pro and Gemini 3.8 Flash (Google) for images and scripts, ElevenLabs for the voice, Seedance 2.0 (ByteDance) for video. Kie.ai sends each request to the provider of the model concerned, which processes it under its own terms, in the United States or in other countries where it operates.
Whop: signing in links your Whop user ID and username to your device. After withdrawal approval, Whop receives the recipient ID, amount and transfer reference. Your bank details stay with Whop; Glimmry does not receive them. Whop processes this data under its own privacy policy. On the Earnings page, Whop components let you verify your identity, add a payout method, view your personal balance and history, and withdraw funds. Verification documents go directly to Whop and its verification provider, without a copy held by Glimmry. With your authorization, OAuth access to these features is encrypted on our server for its validity, at most one hour, then purged at the next cleanup. No refresh token is kept. The components receive only a scoped access token lasting at most fifteen minutes, held in memory. Their optional usage analytics are disabled. You can revoke authorization through Whop.
Apple: App Attest (checking the app and the device) and app distribution. Apple processes this data under its own privacy policy.

Brands never receive your identity, your application, your earnings or your Whop account details. For a campaign, the brand may see, in a private report, the public link to your post, its platform, its date and its verified views. Videos are reviewed by the Glimmry team on the brand’s behalf.

We may also disclose data where the law requires it, or to establish or defend our rights.

6. Transfers outside the European Union

bva Group LLC and several of its service providers are located outside the European Union, notably in the United States, and our database and file storage are hosted in the Asia-Pacific region. Our transfers to Cloudflare are covered by its Data Processing Addendum, which includes the European Commission’s standard contractual clauses; Cloudflare is also certified under the EU-U.S. Data Privacy Framework. Sending your instructions and images to Kie.ai and to the AI model providers is necessary to carry out the generations you ask for in the app. You can ask us for more information about these safeguards.

7. Advertising, trackers and analytics

The app contains no advertising SDK or analytics tool and doesn’t track you across other apps: it doesn’t use your iPhone’s advertising identifier.

When you arrive through an influencer link, glimmry.com keeps a `glimmry_ref` cookie for 90 days to attribute that link and its offer code. The Earnings page keeps its withdrawal session in browser session storage; the token expires after 30 days. The site uses no advertising scripts or external fonts. Its host only processes the technical data needed to serve and protect it.

If we ever add analytics, it will be optional, subject to your consent and described here before it is switched on.

8. How long we keep data

App Attest challenges: 5 minutes, single use.
Sessions: 30 days.
Daily usage counters: 2 days.
Portrait requests (chosen options, generation status): 14 days.
Device, creators, images, studio projects, voices, videos and campaign sign-ups: as long as your account exists. There is no automatic deletion yet: this data is kept until you delete it, in the app or on request.
Files sent to Kie.ai: 24 hours on its file host; results: up to 14 days at Kie.
Technical logs: 7 days at most.
Support conversations: up to 3 years after our last exchange.

Identity documents are deleted after a decision, after no more than 30 days without a decision, or with the account. Application status and basic information are retained until account deletion. Payout requests and their references are deleted with the account. A record of a payout we have already sent may be kept in our accounting, outside the app, for as long as tax and accounting law requires.

9. Security

Encrypted connections (HTTPS); app and device checks with App Attest; session tokens stored only as fingerprints; private images and videos, available only with your device’s session; provider keys kept on our servers only; rate limiting and quotas; metadata removed from images you add.

No measure is foolproof. If an incident affected your data, we would handle it and report it as required by law.

10. Your rights

Depending on the law that applies to you (including the GDPR if you are in the European Union), you can ask to access, correct, erase or port your data, or to restrict its processing, and you can object to processing based on our legitimate interest.

You can erase all your data from the app (Profile, “Delete my data”). To exercise your other rights, or if you no longer have the app, email contact@glimmry.com. Because your access is tied to your device, we’ll ask for details that help us find your data: for example your creator’s name and type, roughly when you created it and a screenshot of its profile in the app. We reply within one month.

You can also lodge a complaint with a data protection authority, for example the CNIL in France (cnil.fr).

If you live in California or another US state with a privacy law, you have rights including access, correction and deletion. We don’t sell your personal information or share it for cross-context behavioural advertising.

11. Minimum age

Glimmry is for people aged 18 and over; the app asks at first launch. We don’t knowingly collect data about minors. If you think a minor is using the app, let us know.

12. Changes

We’ll update this policy as the service evolves, for example when social account connection or in-app purchases open. The last update date is shown at the top of this page; if a change is significant, we’ll let you know in the app.

13. Contact

bva Group LLC, 30 N Gould St, Sheridan, Wyoming 82801-6317, United States

contact@glimmry.com