Privacy Policy

Last Updated: August 7, 2026

1. Introduction

PhantomBuild OÜ builds privacy into its products from the start. This policy explains, in plain language, what information our apps handle, how it is used, where it is processed, and how it is protected. It is written to apply generally across all of our apps; specific features may collect or process only a subset of what is described here. This policy should be read alongside our Terms & Conditions.

2. Information We Handle

Most of our products operate primarily on-device without requiring accounts or registration. What is handled varies by feature and may include:

  • Submitted Content: Depending on the feature, the content you submit can include text, messages, documents, images, or photos. Some features process this content entirely on your device. When a feature needs external processing to work, the app discloses this before you submit, and only the content needed for that feature is transmitted (see Section 4). We do not claim that all photos always remain on your device — whether content stays on device depends on the specific feature.
  • Anonymous Usage Analytics: We use TelemetryDeck to collect anonymous, content-free usage data such as feature usage, screen views, and interaction patterns. Analytics never include user-entered text, submitted content, or AI-generated message bodies — only operational and product metadata. TelemetryDeck does not collect personally identifiable information, does not use cookies, and does not track users across apps.
  • Purchase Information: Apple processes all App Store transactions. We use RevenueCat to manage your purchase status. RevenueCat may process an anonymous app user identifier together with purchase, entitlement, transaction, device, and storefront-related metadata needed to manage subscriptions. It does not receive your name, email, or Apple ID.
  • Device Sensor Data: Certain products may access device sensors such as the camera or microphone. Sensor data is processed on your device in real time and is not recorded, transmitted, or stored by us unless a feature explicitly requires external processing or you choose to save it within the app.
  • Location Data: Certain products may request optional location access to enhance saved data. Location access is optional, requested only when relevant, and the data remains on your device.
  • Locally Stored Data: Any information you choose to save within our apps is stored locally on your device using on-device storage. This data is not synced to any cloud service or external server unless a feature explicitly states otherwise.
  • Infrastructure and Security: Where a feature communicates with external services, we use Cloudflare for infrastructure, network delivery, and security. Cloudflare may process connection metadata (such as IP address) to route traffic securely and protect against abuse.
  • Communications: If you contact us directly, we may receive information such as your message content and contact details.

3. Information We Do Not Collect

We do not collect your name, email address, phone number, or account credentials through our apps. We do not use advertising SDKs, tracking pixels, or fingerprinting technologies. We do not perform facial recognition, identity inference, or biometric template extraction, and we do not derive, store, or transmit facial landmarks, face embeddings, face geometry, or any biometric identifier from submitted content. We do not store your submitted content on our own servers — content that needs external processing is handled transiently by our processors to deliver the requested feature and is not retained by us.

4. AI-Powered Features

Certain features use third-party artificial intelligence services to process content you submit, which may include text, messages, documents, images, or photos. When you use these features:

  • The content required for the feature is sent to our AI provider (OpenAI) in order to deliver the requested result. The app discloses when external processing is involved before you submit.
  • Content is processed to deliver the feature and is not stored on our own servers.
  • OpenAI processes API submissions under their data usage policy (https://openai.com/policies/api-data-usage-policies). API inputs and outputs are not used to train their models, and OpenAI may retain them for up to 30 days for abuse monitoring before deletion, unless a different approved configuration applies.
  • No facial recognition, identity matching, or biometric template extraction is performed. The AI processes the submitted content only to produce the requested output — not to identify individuals.
  • AI-generated output can be inaccurate, incomplete, or a possible interpretation. You should review it before relying on or sending it, and it is not professional advice.

5. How We Use Your Information

We use the information we collect to:

  • Maintain, operate, and improve our products
  • Understand usage patterns through anonymous analytics
  • Process and manage purchase entitlements
  • Deliver AI-powered features when you request them
  • Respond to your support requests and communications
  • Comply with legal obligations

6. Information Sharing and Disclosure

We do not sell your personal information. We share data only in the following circumstances:

  • Service Providers: We work with the following privacy-focused service providers, none of which receive personally identifiable information:
    • TelemetryDeck — anonymous, content-free usage analytics
    • RevenueCat — subscription and purchase management using an anonymous app user identifier and purchase-related metadata
    • OpenAI — processes submitted content for AI-powered features, subject to OpenAI's API data usage policy
    • Cloudflare — infrastructure, network delivery, and security
  • Legal Requirements: When required by law, court order, or governmental authority.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, where your data would remain subject to this privacy policy.

7. Data Retention

  • Anonymous analytics data is retained by TelemetryDeck according to their retention policies.
  • Purchase-related data is retained by RevenueCat for as long as needed to manage your purchase status.
  • Content submitted to AI features is not retained by us. OpenAI may retain API inputs and outputs for up to 30 days for abuse monitoring before deletion, unless a different approved configuration applies.
  • Cloudflare retains limited connection metadata for security and delivery according to its retention practices.
  • Content you save within an app is persisted in local app storage on your device until you delete the individual record or uninstall the app.
  • Locally stored app data remains on your device until you delete it or uninstall the app.
  • We maintain no databases of user personal information.

8. Legal Basis and Your Rights

Where the GDPR or similar laws apply, we rely on the following legal bases: performing the feature you request (contract), operating and improving our apps and keeping them secure (legitimate interests), your consent where a permission is optional (such as camera, microphone, or location), and compliance with legal obligations. Because our apps operate largely on-device and we do not maintain user accounts or databases of personal information, we typically hold little or no personal data about you.

Subject to applicable law, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. You can exercise many of these directly:

  • You can delete locally stored app data at any time through app settings.
  • You can deny or revoke sensor permissions (camera, microphone, location) at any time through your device settings.
  • You can choose not to use AI-powered features, in which case no content is transmitted for external processing.
  • For any request relating to the limited data our processors handle on our behalf, you can contact us through our website contact page, and you also have the right to lodge a complaint with your local data protection authority.

9. Security

We minimize data collection, and the majority of your data remains on your device, which significantly reduces the attack surface for personal information. Analytics and purchase data transmitted to third-party services use encrypted connections. Content sent to AI services is transmitted over encrypted connections. However, no method of electronic transmission is 100% secure.

10. Children's Privacy

Our products are not directed to individuals under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children.

11. International Data Transfers

TelemetryDeck, RevenueCat, OpenAI, and Cloudflare may process data in countries outside your country of residence. These services comply with applicable data protection regulations.

12. Third-Party Links

Our products may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties.

13. Changes to This Privacy Policy

We may update this policy from time to time. Changes will be posted and the date at the top updated accordingly. Your continued use of our products after changes constitutes acceptance of the updated policy.

14. Contact Us

PhantomBuild OÜ
Tallinn, Estonia
contact[at]phantombuild.io