Privacy Policy

This privacy policy is applicable to the Episodfy app for mobile devices and web browsers, together with any related services operated by 14AI Marcin Plata (collectively, the “Application”). 14AI Marcin Plata is hereinafter referred to as the “Service Provider”.

Episodfy is a private media journal: you can create series and episodes (photos and videos), share them with friends, comment and like content, optionally tag locations, find friends via contacts, and use optional AI image filters. Free accounts may see advertising; paid subscriptions remove ads and unlock additional features.

Data Controller Information

14AI Marcin Plata acts as the Data Controller responsible for the processing of your personal data.

• Name: 14AI Marcin Plata
• Address: Mieszczańska 25/43, Wrocław, 50-201, Poland
• Email: [email protected]

For data protection inquiries and to exercise your GDPR rights, please contact the Data Controller using the contact information above.

EU Representative: Marcin Plata, [email protected]

What information does the Application obtain and how is it used?

The Application and related services acquire the information you supply when you download, access, or register for the service. Registration with the Service Provider is not mandatory. However, you might not be able to use some of the features offered by the service unless you register. In practice, Episodfy’s core features (creating and sharing series and episodes) require an account.

Information you may provide includes:

• Account and profile: email address; password (if you register with email); display name / full name; nickname; phone number and country code (optional); country; preferred app language; avatar image; onboarding status.
• Authentication via third parties: if you sign in with Google or Apple, we receive identifiers and profile details those providers share with us (such as email and name), subject to your settings with that provider. For Sign in with Apple, we may store an Apple refresh token solely to revoke Apple access when your account is deleted.
• User-generated content: photos, videos, episode and series metadata, captions or titles, comments, likes, friend connections, and invitations you send (including email invites).
• Location you attach to content: when you choose to tag where an episode took place, we store location data you associate with that episode (see location section below).
• Contacts (optional): if you grant Contacts permission and use friend-finding, identifiers from your address book (such as phone numbers and email addresses) are sent to our servers to match existing Episodfy users. Matching uses cryptographic (HMAC) hashes of normalized identifiers; we do not use your address book for advertising.
• Support requests: messages you send to [email protected], including account restoration requests during the deletion grace period.
• Purchases and sharing: subscription and entitlement information linked to your account when you subscribe through the App Store or Google Play (processed via RevenueCat and the store). If you use a family / shared plan, we store sharing relationships needed to grant access to invited members.

Purposes of processing

We process personal data to:

• create and manage your account and authenticate you;
• provide core features (series, episodes, media upload/delivery, comments, likes, friends, invitations);
• match contacts and help you find friends when you choose that feature;
• tag episode locations when you choose that feature;
• apply optional AI image filters you request;
• manage subscriptions, entitlements, credits, and plan sharing;
• show advertising to free users (and personalize ads only where permitted / consented);
• send push notifications you enable and important service notices;
• analyze usage and diagnose crashes to improve reliability and product quality;
• secure the service, prevent fraud and abuse, and enforce these policies;
• process account deletion and restoration;
• comply with legal obligations and respond to lawful requests.

The Service Provider may also use the information you provide to send important information, required notices, and, where permitted by law, marketing communications.

Legal basis for processing your personal data

Where the GDPR applies, the Service Provider relies on one or more lawful bases to process your personal data, including:

• Contract performance: processing necessary to provide the Application or fulfil a contract with you (including account, content hosting and delivery, friend sharing, subscriptions and entitlements, account deletion and restoration).
• Consent: where you have given explicit consent to processing, including for marketing, analytics, or optional features (such as camera, photo library, location for tagging, contacts, notifications, and personalized advertising / tracking where required). You may withdraw consent at any time without affecting processing that occurred before withdrawal.
• Legitimate interests: where processing is necessary for the Service Provider’s specific legitimate interests, such as maintaining network and information security, preventing fraud and abuse, or improving the Application’s core functionality through analytics, provided those interests are not overridden by your data protection rights or fundamental freedoms.
• Legal obligation: to comply with laws or government requests.

Cookies and similar technologies

The Application or its third-party SDKs may use cookies, SDKs, pixels, local storage, and similar technologies to support functionality, analytics, advertising, crash reporting, subscriptions, and service delivery. Where required by law, the Service Provider will obtain your consent before using non-essential tracking technologies, including personalized advertising.

Automated decision-making and profiling

If the Application uses automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, you have the right to request human review, express your point of view, and contest the decision. Information about the logic involved and the likely consequences of that processing will be provided where required by law.

Episodfy does not currently use automated decision-making that produces legal or similarly significant effects concerning you. Ad personalization by Google AdMob, where enabled, is advertising-related profiling controlled through consent / App Tracking Transparency settings and Google’s tools.

What information does the Application collect automatically?

In addition, the Application may collect certain information automatically, including, but not limited to, the type of mobile device or computer you use, your device’s unique device ID or identifier, the IP address of your mobile device or computer, your operating system, the type of browser you use, and information about the way you use the Application.

For Episodfy specifically, automatically collected information may also include: app version and language; Firebase Authentication user ID; advertising identifiers where permitted (for example IDFA on iOS after App Tracking Transparency authorization, or Android advertising ID); usage events via Firebase Analytics (for example creating series or episodes, navigation, paywall interactions, likes, and comments); crash and diagnostic data via Firebase Crashlytics; push notification tokens (FCM); and local caches and preferences on your device (for example language and offline-related state).

Does the Application collect precise real time location information of the device?

This Application may collect your device’s location when you grant location permission and choose to tag where an episode took place. Location is used only for that episode-tagging function. It is not used for continuous background tracking, geofencing, or unrelated personalization or advertising. You can deny location permission and still use Episodfy without tagging locations. Location attached to an episode is stored with that content and shared with users who can see that series or episode according to your sharing settings.

Camera, photos, and media

With your permission, Episodfy accesses the camera and photo library so you can capture or select photos and videos for episodes. Media you upload is stored as described under “Where we store data”.

Advertising

Free (non-Pro) accounts may be shown Google AdMob native ads in places such as the episode wall and series list. Pro and Pro Family subscribers do not see these ads under the current plan design.

Where required (including in the EEA/UK), we use Google’s User Messaging Platform (UMP) to obtain consent before personalized ads. On iOS, we may request App Tracking Transparency (ATT) permission to use the advertising identifier for personalized ads. If you do not consent or do not allow tracking, you may still see non-personalized or limited ads where allowed.

Ad requests may involve device and advertising identifiers, IP address, and coarse technical data processed by Google and its advertising partners under their policies.

Does the Application use Artificial Intelligence (AI) technologies?

The Application uses Artificial Intelligence (AI) technologies to enhance user experience and provide certain features. For Episodfy, optional AI image filters (and related collage-style features) send the image you choose, together with related processing parameters, to our AI filter backend so a transformed image can be returned to you. AI is used to provide these creative features when you request them. Filter usage may consume in-app credits where applicable.

The AI components may process user data in the following ways:

• Personalized Content: AI may analyze your usage patterns to deliver content tailored to your preferences and behavior.
• Recommendations: AI may suggest features, services, or content based on your interactions within the Application.
• Automated Functionalities: Certain app features may be powered by AI to automate tasks or improve efficiency (including the image filters described above).
• Data Protection: All AI processing is performed in accordance with this privacy policy and applicable laws, ensuring your data is handled securely and responsibly.

Episodfy does not use AI to sell your content, and does not use AI for automated decision-making that produces legal or similarly significant effects concerning you.

Do third parties see and/or have access to information obtained by the Application?

Only aggregated, anonymized data is periodically transmitted to external services to aid the Service Provider in improving the Application and their service. The Service Provider may share your information with third parties in the ways that are described in this privacy statement. In addition, operating Episodfy requires sharing necessary data with the processors and service providers listed below (on our instructions or, in some cases, as independent controllers for their own services, such as ad networks and app stores).

International Data Transfers

The Service Provider or its third-party service providers may transfer personal data outside the European Economic Area (EEA). Where such transfers occur, the Service Provider will use an appropriate transfer mechanism required by GDPR Chapter V.

• Adequacy decisions by the European Commission (including the EU–US Data Privacy Framework where a provider is certified)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Other safeguards or derogations recognized under GDPR Chapter V, including consent where legally permitted

Countries outside the EEA may not provide the same level of data protection as the EEA. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

Please note that the Application utilizes third-party services that have their own Privacy Policy about handling data. Below are the links to the Privacy Policy of the third-party service providers used by the Application:

• Google Play Services
• AdMob
• Google Analytics for Firebase
• Firebase Crashlytics
• Expo
• RevenueCat
• Google Firebase (Authentication, Firestore, Cloud Functions, Cloud Messaging; legacy Storage where still used)
• Apple (Sign in with Apple; App Store billing)
• Cloudflare (Workers and R2 object storage; media CDN)
• Algolia (user search)

The Service Provider may disclose User Provided and Automatically Collected Information:

• as required by law, such as to comply with a subpoena, or similar legal process;
• when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.

Where the GDPR applies, the Service Provider enters into Data Processing Agreements (DPAs) with third-party service providers that process personal data on its behalf, as required by Article 28 of the GDPR. These DPAs impose the same data protection obligations on those service providers as described in this Privacy Policy.

Where we store data

• Account, social graph, and content metadata: Google Firebase Firestore (and related Firebase services), hosted by Google.
• Photos and videos: primarily Cloudflare R2 object storage, accessed through a Cloudflare Worker that verifies your Firebase authentication token; media may be served via our media CDN (media.episodfy.14ai.tech).
• Search index: Algolia indices used to find other users.
• Subscriptions: RevenueCat and Apple/Google, with entitlement snapshots stored on your user profile.
• On device: local caches and preferences (for example language and offline-related state).

What are my opt-out rights?

You can stop further collection of information from your mobile device or computer by uninstalling the Application. Uninstalling will stop the Application from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties.

You can stop further collection of information from your device by ceasing to use the website. Ceasing to use will stop the website from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties.

You may also:

• revoke device permissions (camera, photos, location, contacts, notifications, tracking) in system settings;
• manage ad consent via the UMP consent interface where presented, and App Tracking Transparency on iOS;
• adjust advertising preferences in your device or Google account settings where available;
• cancel subscriptions in the App Store or Google Play (uninstalling does not cancel billing).

To request deletion of your personal data, withdraw consent, or exercise any of your rights, contact the Service Provider at [email protected].

What is the data retention policy and how can you manage your information?

The Service Provider retains personal data based on its necessity for the stated purposes:

• User Provided Data: Retained for the duration of your use of the Application plus 12 months thereafter, unless longer retention is required by law
• Automatically Collected Data: Retained for up to 24 months from collection, unless longer retention is required for legal compliance or security purposes
• Aggregated and Anonymized Data: Retained indefinitely as it no longer identifies you
• Data required for legal compliance: Retained as long as required by applicable law

For Episodfy account deletion specifically: after you request deletion, soft-delete is immediate; remaining account and content data are retained for a 30-day grace period for possible restoration, then hard-purged as described below, unless longer retention is required by law. Support correspondence is retained as needed to handle your request and for legitimate business records. Residual backup copies may persist for a limited additional period.

You have the right to request deletion of your personal data at any time, except where retention is required by law. If you’d like the Service Provider to delete User Provided Data that you have provided via the Application, please contact them at [email protected] and they will respond within the time required by applicable law. Please note that some User Provided Data may be required in order for the Application to function properly.

Data Deletion

You can request deletion of your personal data or account by contacting the Service Provider at [email protected]. The Service Provider will process your request within the timeframes required by applicable law.

You can also delete your account in the Application (Settings → Delete account) or follow the public instructions at https://14ai.tech/episodfy/delete-account/.

When you request deletion from the Application:

1. Immediate soft-delete: your login is disabled, you are signed out, public profile fields are scrubbed (for example shown as a deleted user), push tokens are cleared, and you are removed from user search. Access ends right away.
2. 30-day grace period: photos, videos, comments, likes, friend connections, and series membership are retained so we can restore the account if you contact [email protected] in time.
3. Hard purge after the grace period: we permanently delete your authentication account, profile, media objects (including from Cloudflare R2 where applicable), comments and likes associated with your content as implemented in our deletion pipeline, friend links, related subscription records we control, and related server-side tokens (including Sign in with Apple refresh tokens where stored).

Upon verification of your identity, the Service Provider will delete your personal data from its systems, except where retention is required for legal compliance or legitimate business purposes.

Subscriptions are billed by Apple or Google. Deleting your Episodfy account does not cancel an active store subscription; you must cancel it in the App Store or Google Play.

How does the Application address children’s privacy?

The Application is not intended for children under 16 years of age, or where a higher age of digital consent is established under applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.

Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. The Service Provider does not knowingly collect personally identifiable information from children under 16 years of age, or where a higher age of digital consent is established by applicable law, in violation of applicable law. In the event the Service Provider discovers that a child has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider ([email protected]) so that they will be able to take the necessary actions.

How is your information kept secure?

The Service Provider is committed to safeguarding the confidentiality of your information. The Service Provider implements physical, electronic, and procedural safeguards to protect information it processes and maintains. For example, access is limited to authorized employees and contractors who need to know that information to operate, develop, or improve the Application. For Episodfy, safeguards also include encrypted transport (HTTPS/TLS), authenticated access to media storage, access controls on backend systems, and hashed contact identifiers for matching. However, no security system can prevent all potential security breaches.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, the Service Provider will also notify you without undue delay, providing information about the nature of the breach, the categories of data affected, and the measures taken or proposed to address the breach.

How will you be informed of changes to this Privacy Policy?

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at [email protected].

This privacy policy is effective as of 2026-08-01

What are your GDPR data protection rights?

Under the GDPR, you have the following rights:

• Right of Access: You can request access to your personal data.
• Right to Rectification: You can request correction of inaccurate data.
• Right to Erasure: You can request deletion of your personal data (the “right to be forgotten”), including via in-app account deletion.
• Right to Restrict Processing: You can request that the Data Controller limits how they use your data.
• Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: You can object to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you can withdraw it at any time. Withdrawal is as simple as toggling preferences in the Application’s settings or contacting the Data Controller. You may also change device permissions and ad / tracking consent where available.
• Rights Regarding Automated Decision-Making: You have rights related to automated decisions that affect you.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority. Contact details for each country’s Data Protection Authority can be found at: https://edpb.ec.europa.eu/about-edpb/members_en

In Poland you may contact the President of the Personal Data Protection Office (UODO) at https://uodo.gov.pl/. In Germany you may contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI) at https://www.bfdi.bund.de. If you are located in the United Kingdom, you may contact the Information Commissioner’s Office at https://ico.org.uk

What are your California privacy rights (CCPA/CPRA)?

If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:

• Right to Know: You can request disclosure of the categories and specific pieces of personal information the Service Provider has collected about you.
• Right to Delete: You can request deletion of personal information the Service Provider has collected from you, subject to certain exceptions.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Opt-Out: You can opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: You can limit the use of your sensitive personal information to essential purposes.
• Right to Non-Discrimination: The Service Provider will not discriminate against you for exercising any of your CCPA/CPRA rights.

Categories of personal information we may collect include identifiers (such as email, user ID, advertising ID, IP address); customer records information you provide in your profile; commercial information related to subscriptions; internet / electronic activity (app usage and diagnostics); geolocation data when you tag episodes; audio/visual information you upload; and inferences used only as needed for product features (not for selling profiles).

Episodfy does not sell personal information for money. Personalized advertising via AdMob may constitute “sharing” under California law. You can opt out by refusing ATT / ad personalization consent, adjusting device ad settings, and contacting [email protected].

To exercise any of these rights, please contact the Service Provider at [email protected]. The Service Provider will verify your request using the information you provide and respond within the timeframes required by law. You may designate an authorized agent to make a request on your behalf.

How do you give your consent?

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action (for example granting a system permission, accepting the ad consent form, allowing App Tracking Transparency, or opting into marketing). You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases, including contract performance, legitimate interests, or legal obligations, is carried out as described above.

How can you contact the Data Controller?

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at [email protected].

To request deletion of your personal data or to exercise any of your rights, contact the Service Provider using the details provided above, or use in-app account deletion. The Service Provider will respond within one month of receiving your request, extendable by up to two months where necessary due to the complexity or volume of requests, as permitted by applicable law.