Privacy Policy
Last updated: April 30, 2026
YuzuFam ("we", "us", or "our") operates the GlowGram mobile application ("Service"). This Privacy Policy describes the personal data we collect, how we use and share it, and the rights and choices available to you. By using the Service, you consent to the practices described below.
1. Data We Collect
- Account information — When you sign in with Google (Google OAuth — our only authentication method), we receive your Google account email address, profile photo, and Google account identifier. We do not collect or store your Google password.
- Generated content — AI-generated personas, avatar animations, photos, and videos you create are stored on our servers under your account.
- AI generation inputs — Prompts, persona attributes (gender, ethnicity*, age range, face vibe, body type, skin style, custom prompt text), shot-type selections, and reference images or videos you submit. *Ethnicity may constitute sensitive personal information under applicable law (e.g., GDPR Article 9, CPRA). It is collected solely to fulfill your persona generation request.
- Reference video links — URLs you submit (YouTube, TikTok, Instagram) for download as motion references.
- Usage data — Credit balance, generation history, generation status, subscription state, and feature interaction logs.
- Trending feed interactions — Videos you view, like, comment on, or use as references within the trending feed.
- Device token — FCM (Firebase Cloud Messaging) push token for generation-completion notifications. Optional; revocable via device settings.
- Purchase data — In-app purchase receipts processed via Google Play and RevenueCat, including transaction ID, product ID, and timestamp. We do not collect, store, or have access to payment card numbers, CVV, or banking details.
- Diagnostic data — Crash reports and minimal telemetry to fix bugs and improve the Service.
2. How We Use Your Data
- Authenticate your account and provide the Service
- Generate, store, and serve your AI personas, avatars, photos, and videos
- Download reference videos from third-party platforms on your behalf
- Display the trending feed and process your interactions (likes, comments)
- Manage credit balances, subscriptions, renewals, and refunds
- Send push notifications when generations complete (if enabled)
- Diagnose, prevent, and respond to abuse, fraud, and security incidents
- Comply with legal obligations (tax, accounting, law-enforcement requests, court orders)
- Improve the Service and develop new features (using anonymized, aggregated data only)
We do not use your generated content, prompts, or persona attributes to train AI models — neither our own models nor those of third-party providers.
3. Third-Party Services (Sub-processors)
We share the minimum data necessary with the following third-party processors, each subject to contractual data-processing obligations.
- Google Sign-In — Authentication. Google Privacy Policy
- Supabase — Database, authentication backend, and file storage. Data is stored on US-based servers.
- fal.ai — AI image and video generation (photos, avatar animations, and videos). Your prompts, persona attributes, and reference images/videos are transmitted to fal.ai for processing. fal.ai does not use your inputs to train AI models.
- OpenAI — AI image generation for persona candidates. Persona attribute inputs are transmitted for processing. OpenAI does not use your inputs to train AI models under our API agreement.
- RevenueCat — In-app purchase and subscription management. RevenueCat Privacy Policy
- Firebase / Firebase Cloud Messaging (Google) — Push notifications.
- cobalt.tools — Reference video download from YouTube, TikTok, and Instagram. URLs you submit are sent to cobalt.tools for processing.
- Google Gemini via OpenRouter — First-frame analysis of submitted reference videos for shot-type classification. The first frame is transmitted for inference and is not retained beyond the request.
- Apify & EnsembleData — Trending content discovery from public social-media data sources (we do not transmit your personal data to these services; they supply data to us).
4. Legal Basis for Processing (GDPR-aligned)
- Performance of contract — Account creation, content generation, payment processing, delivering the Service.
- Legitimate interests — Fraud prevention, abuse mitigation, service improvement using aggregated data, security.
- Legal obligation — Tax records, financial records, responding to lawful requests.
- Consent — Push notifications and any optional data collection clearly identified as consent-based at the time of collection.
5. Data Retention
We retain your account data and generated content for as long as your account remains active. You may delete your account and associated content at any time via the in-app deletion flow (Settings → Support → Delete Account) or as described on our Account Deletion page.
After account deletion, residual backups are purged within 30 days, except where retention is required by law (see §13 for Korean statutory retention periods). Anonymized, non-identifiable aggregate analytics may be retained indefinitely.
6. Children's Privacy
GlowGram is intended exclusively for users aged 18 and older. We do not knowingly collect personal information from anyone under 18. If we discover that we have inadvertently collected data from a person under 18, we will delete it promptly and terminate the associated account. If you believe a minor has created an account, contact us immediately at [email protected].
7. AI-Generated Content & Facial Data
- Your AI generation inputs (prompts, persona attributes, reference images, reference videos, first-frame extracts) are transmitted to third-party AI inference providers (fal.ai, OpenAI, OpenRouter, Google Gemini) for the sole purpose of producing your generated outputs and classifying inputs. Reference videos you submit are also transmitted in full to fal.ai for AI video generation processing.
- Downloaded reference videos and generated content are stored on Supabase servers located in the United States.
- We do not use your generated content, inputs, or facial data to train AI models.
- Ethnicity as sensitive data: Persona attributes include ethnicity, which may constitute sensitive personal information under applicable law (e.g., GDPR Article 9, CPRA). We collect and process this data solely to fulfill your persona generation request and do not use it for any other purpose. You provide this information voluntarily as part of the persona creation process.
- Third-party faces in reference videos: Reference videos you submit may contain faces or likenesses of third parties (e.g., content creators). Such videos are processed by AI video generation services solely to extract motion data. You are solely responsible for ensuring you have the right to use any reference video containing third-party likenesses.
- Facial data & biometrics: We process facial characteristics within AI-generated images solely for content generation. We do not perform biometric identification, facial recognition, 1:1 face matching, 1:N face search, liveness detection, or create biometric templates or identifiers from any image processed through the Service. We are not a biometric service provider as defined under BIPA, Illinois 740 ILCS 14, or analogous statutes.
8. Your Rights
- Request a copy of your personal data
- Request correction of inaccurate personal data
- Request deletion of your account and data via the Account Deletion page
- Withdraw consent for any processing based on consent
- Opt out of push notifications at any time via device settings
- Lodge a complaint with a supervisory authority (see §13 and §10)
9. Security
We employ industry-standard administrative, technical, and physical safeguards including TLS-encrypted transmission, encrypted storage at rest where supported by our infrastructure providers, scoped access controls, audit logs, and the principle of least privilege. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for safeguarding your Google account credentials.
10. International Data Transfer
Your data may be processed in the United States and other countries where our third-party processors operate. By using GlowGram, you consent to such transfer. Where required by applicable law (e.g., GDPR Standard Contractual Clauses), we rely on appropriate transfer mechanisms with our sub-processors.
11. California Residents (CCPA / CPRA)
If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:
- Categories of personal information collected: Identifiers (email, profile photo, Google ID), commercial information (purchase history, credit balance, subscription status), internet/network activity (trending feed interactions, generation history), inferences drawn from the above, visual information (reference images and generated images), and sensitive personal information — specifically racial or ethnic origin (ethnicity attribute used for persona generation only).
- We do not sell or share your personal information for cross-context behavioral advertising. We do not engage in the sale of personal information as defined under the CCPA.
- Right to know — Request disclosure of categories and specific pieces of personal information collected.
- Right to delete — Request deletion of your personal information, subject to legal exceptions.
- Right to correct — Request correction of inaccurate personal information.
- Right to limit use of sensitive personal information — Where applicable.
- Right to non-discrimination — We will not discriminate against you for exercising your rights.
- To exercise any right, contact [email protected]. We may verify your identity using the Google account email associated with your GlowGram account.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via the App or by email. Your continued use after the effective date of the revised policy constitutes acceptance.
13. Korean Statutory Retention & Rights (Republic of Korea)
In addition to the general retention policy in §5, the following records are retained for the periods required by Korean law:
- Contract or withdrawal records: 5 years (Act on Consumer Protection in Electronic Commerce)
- Payment and supply records: 5 years (Act on Consumer Protection in Electronic Commerce)
- Consumer complaint or dispute records: 3 years (Act on Consumer Protection in Electronic Commerce)
- Login records: 3 months (Protection of Communications Secrets Act)
- Tax-relevant records (purchase receipts): up to 7 years (Korean Commercial Act / tax law)
Under the Personal Information Protection Act (개인정보보호법), you have the right to:
- Request access to your personal information (Article 35)
- Request correction or deletion (Article 36)
- Request suspension of processing (Article 37)
- Withdraw consent at any time
To exercise these rights, contact [email protected]. We will respond within 10 days.
You may also file a complaint with:
14. Data Protection Officer
- Name: Juhwan Park
- Role: Representative / Data Protection Officer
- Email: [email protected]
15. Contact
Questions, requests, or concerns regarding this Privacy Policy: [email protected]
Business Information
- Company: YuzuFam
- Representative: Juhwan Park
- Business Registration No.: 690-21-00467
- Mail Order Business No.: 2026-Goyang Deogyang-0761
- Address: 102-1305, Hillstate Eco Deogeun, 110 Utteum-ro, Deogyang-gu, Goyang-si, Gyeonggi-do, Republic of Korea
- Email: [email protected]
© 2026 GlowGram ·
Privacy Policy ·
Terms ·
Delete Account ·
[email protected]