Privacy
policy

In short

ARVE builds a short reel out of your long video. To work out what happens in that video, it sends a working copy of it to a Google cloud service (the Gemini API). The phone builds that copy: the picture is no taller than 480p and no faster than 15 frames per second, and it carries no audio track at all — from version 1.0.15 on, the sound of your video does not leave the phone. Google's answer — which parts of the video to use in the reel, with short text notes on them — comes back through our server and is normally kept there for up to 72 hours. Everything else — the assembly, the filter, the sound, the history — happens on your phone. If you do not sign in with Google, you have no account and we do not know who you are. If you do (on Android this is needed only to buy minutes), we keep your Google account's identifier to tie the minutes you bought to it — until you delete your data. On an iPhone there is no sign-in: purchases are tied to an identifier issued by the App Store. Records of purchases and of minutes spent we keep for 5 years, as Kazakhstan's tax legislation requires, and the identifier of your install of the app with no time limit; the details are under «How long we keep data». Signing in with Google and buying minutes are, for now, available only in test versions of the app: everything said about them below applies to the versions that have them.

No sign-in, no account

The app does not ask you to register and does not ask for an e-mail address, a phone number or a name. Until you sign in with Google you have no account: the server knows only a random identifier of your install of the app, not tied to your identity. Signing in is needed only to buy minutes — what is kept then is described in the next section.

Signing in to keep bought minutes

Minutes you buy in ARVE are kept on our server, so that they survive a reinstall and a new phone. To know whose minutes they are, the app links them to an identity your store already has — and only that:

• On an iPhone — the App Store's identifier of your download of ARVE (an «app transaction» identifier that belongs to your Apple Account and to this app only). The app reads it by itself, with no sign-in screen. We do not receive your Apple Account's name or e-mail.
• On Android — you sign in with Google by tapping «Sign in with Google». We keep only the identifier of your Google account. Google also sends your e-mail address, name and picture with the sign-in; we discard them unread and never store them.

We store that identifier together with your purchases and the minutes spent from them, and nothing else about you. How to delete it is described below.

Buying minutes

The payment itself is handled not by our server but by the app store: Google Play on Android, the App Store on an iPhone. Your card number, payment method and any other payment details never reach us at all — only Google or Apple see them. After payment the store hands the app a purchase receipt; the app forwards that receipt to our server, and we verify it directly with Google or Apple before crediting the bought minutes. Later we check with Google or Apple again to find out whether the purchase was refunded. About the purchase itself we keep: which store, the store's transaction identifier, which product was bought, how many seconds were credited or spent, and when. For Google Play purchases we also keep the receipt itself (the purchase token) — encrypted, readable only with our key: it is what we use to ask Google again about a refund. We keep it for no longer than 12 months after the purchase or, if the purchase is refunded, only until the refund, and then delete it; after that only a hash of the receipt remains, from which the receipt cannot be recovered. We do not keep App Store receipts.

On top of that, the stores themselves send our server notifications about purchases and refunds. We keep the full text of each such notification exactly as the store sent it — for Google Play that includes the purchase token itself. It is stored encrypted: it is the proof of purchase in case of a dispute or a refund, and it can only be read with our key.

All of that, together with the identifier described above, is what a «purchase» linked to your account consists of.

Proving a request is genuine (App Check)

Before answering a request from the app, our server checks that the request really came from a genuine, unmodified copy of ARVE. It uses Google Firebase App Check for this: on Android it relies on Play Integrity, on an iPhone on Apple's own App Attest feature. The app gets a short-lived token from Firebase and attaches it to every request to our server; the server checks that token's signature against Google's keys and stores it nowhere. The token proves the device and the app build are genuine, not who you are: it holds no name, no e-mail and no account identifier. To issue such a token, Google (and on an iPhone, Apple) receives technical details about the device and the app from the phone — for example the phone model and the system version. What exactly they see and how long they keep it on their side is governed by Google's and Apple's rules, not ours.

What leaves the phone

What goes out is not your video file. Before anything is sent, the phone builds a separate working copy of it, and that copy is what travels. The copy is always the same: the picture is no taller than 480p and no faster than 15 frames per second, and no audio track is included at all. There is nothing to choose and no more detailed version of it. It exists only so the model can work out what is going on in the video, and it comes out many times smaller than the original.

Versions before 1.0.15 let you select by hand a third, most detailed level, at which the original audio track travelled with the picture. If you used it, that copy stays with Google until it expires on a schedule Google sets itself; the app does not delete it separately.

How it works. The Gemini API access key exists only on our server — there is none in the app. The server hands the phone a one-time upload address, and the phone uploads the copy to that address straight into Google: the copy itself never passes through our server, which neither sees nor stores it. Our server then asks Gemini, on the developer's behalf, to analyse the uploaded copy and receives the answer — a list of parts of the video with timecodes and short text notes on what happens in them. The server passes that answer to the app and keeps it (for how long — see «How long we keep data»). Because those notes describe what is in your video, they can mention the people, actions and words that appear in it.

The requests run on the paid Gemini API plan. For paid usage Google's own terms state that submitted content is not used to train Google's models, and that prompts and responses are logged only for a limited period — to detect violations of the usage policy and for cases where disclosure is required by law. That is a quotation from Google's terms as of 17 August 2026, and it rests on the developer's paid plan rather than on a promise from us: Google can change those terms, and we do not control that.

Once it has been sent there are two copies, and they live differently. The one on the phone sits in the app's temporary folder and is deleted once it is no longer needed. The one already uploaded to Google is not deleted by the app: it sends no delete command — it remembers the uploaded copy and reuses it on later attempts, until it expires on a schedule Google sets itself.

Apart from what is described here — the copy of the video, requests to our server, the App Check check and signing in with Google — the app sends nothing anywhere by itself. The one exception is yours to make: the «send logs» button in the settings opens the system share sheet with the app's technical log, and you choose the recipient — e-mail, a messenger or anything else. Unless you press that button, the log does not leave the phone.

What we do not collect

• No analytics, no visit counters.
• No automatic crash reporting.
• No advertising libraries; the device's advertising identifier is not read.
• Your contacts, location, installed-app list and clipboard are never requested.

This is not a promise on paper: we have not put a single such library into the app. One caveat: the Google Play billing library that purchases on Android go through may itself send Google technical details about how payments work — that is part of the Google Play platform and governed by Google's rules.

What we hold ourselves, and what we do not

We do have a server of our own — but not for your video. Your source video never reaches this server, and neither do the working copy built for analysis (it goes from the phone straight to Google), your finished reels or your history of attempts — all of that stays on the phone (see «What stays on the phone» below).

The server keeps:

• The identifier of your install of the app. On first launch the server issues the app a random secret and a public install number; the server itself keeps only a hash of the secret, the public number, which app it is (Android or iPhone) and when the number was issued. It is not tied to your identity until the install is linked to a Google sign-in on Android or to the App Store identifier on an iPhone.
• Records of analysis runs: which install the run belongs to, whether it was paid or free, the service name of the uploaded copy at Google (of the form files/… — not the name of your file: the file name on the phone is never sent to our server), the video's length in seconds, the hash of the payment receipt used, if any, a service hash by which the server recognises the run as yours, and a «fingerprint» of the video — a SHA-256 hash the phone computes from the source video's content together with the chosen analysis level; it lets the server recognise a repeat analysis of the same video, and the video cannot be recovered from it. Alongside that: the state of the run (in progress, done, failed) and the error code, if there was one.
• Gemini's answer for the run — the parts with timecodes and text notes described above.
• Records of minutes spent: how many seconds were charged, when, for which run, from free or bought minutes, and which install or account they belong to; plus technical accounting of how much processing at Google each run used.
• Purchase records, store notifications and the account link described above.
• Daily run counters — to enforce daily limits.

When something goes wrong on the server (for example, an analysis run fails), the server sends the developer a service alert in Telegram: the run's number, whether it was paid or free, the video's length, the error code and description, and, in alerts about purchase problems and refund checks, the store's order number. We do not put videos, Gemini's notes or account data into these alerts.

Once a day a backup copy of the server's database is taken; it is kept on the server itself and in the developer's Google Drive cloud storage. It contains everything that was in the database at the moment of copying — including records that were later deleted from the working database.

Our server is physically hosted in Germany (Nuremberg), with the hosting provider Netcup. Connections to the server and to this website pass through the Cloudflare network. Any connection reveals your IP address: our server does not record it, and what Cloudflare keeps in its own logs is governed by Cloudflare's rules.

How long we keep data

• Records of an analysis run and Gemini's answer — deleted automatically 72 hours after the run; that period is set in the server's code, not only on paper. Exception: if a run got stuck halfway and the server never learned how it ended, or if the developer had to decide something about the run by hand (for example, whether to give back the minutes spent), that record — with the answer, if there was one — is not deleted automatically and is currently kept with no time limit.
• The install identifier — no time limit. «Delete my data» does not erase it.
• Records of minutes spent and processing accounting — 5 years: they are the record of what money or free minutes were charged for, and Kazakhstan's tax legislation sets how long they are kept. After «Delete my data» they stay linked to the install identifier, but no longer to your Google or Apple account.
• Purchase records and store notifications — 5 years: they are financial records and proof of purchase, and Kazakhstan's tax legislation sets how long they are kept. After «Delete my data» they remain, with no account attached.
• The Google or Apple account link — until you delete your data (see «How to delete everything» below).
• Daily counters — deleted once the day is over and the 72-hour period has passed.
• Database backups — 30 days, after which they are deleted automatically, both on the server and in Google Drive. For as long as a backup is kept, it still holds data that has already been deleted from the working database.
• The server's technical logs — short-lived: they are written in a fixed-size rotating cycle (about 30 MB per container) and overwritten. Sign-in tokens, purchase receipts and store-linking codes are never printed in full — a dedicated function always strips them out; your Google account's e-mail address and name never reach the logs at all, because the server never reads them. The logs never contain your video's content.

What stays on the phone

• The source video — where you shot it: the app reads it in place, modifies nothing and copies it nowhere.
• The assembled reels and the markup files — in the app's own folder.
• The temporary working copy used for the markup — in the app's cache, for as long as it is needed.
• The history of attempts — it is built out of those same files.
• The chosen interface language.
• The app's technical log — of limited size, older entries pushed out by newer ones. The app strips secrets and tokens out of it before anything is written to disk. It leaves the phone only if you press «send logs» yourself (see above); the «clear the log» button erases it.

A reel you saved additionally goes into the phone's gallery — that is you pressing «save». The «share» button hands the file to whatever app you choose yourself.

How to delete everything

Delete an attempt in the app and its files go with it. Uninstall the app and its whole folder goes: reels, markup, history, settings, log. Reels you saved to the gallery stay in the gallery — they are yours, and the app does not dispose of them.

All of that concerns the phone only. The working copy already uploaded to Google is removed by neither deleting an attempt nor uninstalling the app: the app cannot recall it — it goes away by itself when the term Google set for it runs out. So you can delete everything on your side, but you cannot erase the uploaded copy at Google's end.

To delete the link between your Apple or Google account and your bought minutes: in the app, Settings → Delete my data; for a Google account you can also do it on the web, on the Delete my data page. The account identifier is erased and every phone signed in with that account is signed out in ARVE. Unspent paid minutes are forfeited.

What stays on the server after that: records of purchases that were made, and the stores' notifications about them — as financial records, with no account attached, for 5 years; records of minutes spent — linked to the install, but not to the account, also for 5 years; the install identifier — with no account attached; run records and Gemini's answers — until their normal period ends (see «How long we keep data»); backups taken before the deletion — for no longer than 30 days.

Who is responsible for your data

The party responsible for processing your personal data (the controller under the EU General Data Protection Regulation, GDPR) is the developer of ARVE, a private individual: Alexandr Sukhoterin, Almaty, Kazakhstan. For any question about your data, write to postmaster@alxforge.com.

On what basis we process data

The GDPR requires naming a legal basis for each kind of processing. We do not rely on consent for anything — so there is nothing to withdraw.

• Performance of a contract with you (GDPR Art. 6(1)(b)) — everything needed for the app to do what you ask it to: sending the working copy of the video (without sound) to the Gemini API, keeping the run record and Gemini's answer while the app collects them, linking a Google account or the App Store identifier to bought minutes, verifying purchases, crediting and charging minutes.
• Legitimate interest (GDPR Art. 6(1)(f)) — protecting the service against abuse and fraud: checking that the app and the device are genuine (Firebase App Check with Play Integrity or App Attest), the install identifier and daily run limits, the server's technical logs, backups, service alerts about failures, and keeping store notifications as proof of purchase in case of a dispute. Our interest is that a service people pay for keeps working, is not used up by someone else, and does not lose buyers' money. You have the right to object to this processing (see «Your rights»).
• Legal obligation (GDPR Art. 6(1)(c)) — keeping records of purchases and minutes spent as accounting and tax records for 5 years, as the tax legislation of the Republic of Kazakhstan requires.

We make no automated decisions that have legal effects on you: the video analysis only suggests parts for the reel.

Who processes data on our behalf

• Google — the Gemini API (analysis of the video's working copy), Firebase App Check and Play Integrity (checking the app is genuine), Sign in with Google, Google Play (payment, purchase verification, purchase notifications), Google Drive (storing backups of the server's database).
• Apple — the App Store (payment, purchase verification and notifications, the app transaction identifier) and App Attest (checking the app is genuine on an iPhone).
• Netcup (Germany) — hosting of our server.
• Cloudflare — the network connections to our server pass through, and hosting of this website.
• Telegram — delivering service alerts about server failures to the developer (no videos, Gemini notes or account data).

We do not hand your data to anyone else, and we do not sell it.

Where data is stored, and transfers outside the EU

Our server and its database are in Germany (Nuremberg, hosted by Netcup); the server's backups are kept there too, on the server, and a second copy of each is in the developer's Google Drive. Connections to the server and to this website pass through the Cloudflare network. Google, Apple, Cloudflare and Telegram may also process data outside the European Union, including in the United States. What such transfers rest on — as the companies themselves state publicly:

• Google — Google LLC is certified under the EU-U.S. Data Privacy Framework; where that does not apply, Google uses the EU Standard Contractual Clauses.
• Cloudflare — certification under the EU-U.S. Data Privacy Framework; for other transfers, the EU Standard Contractual Clauses.
• Apple — the EU Standard Contractual Clauses.
• Telegram receives only the service alerts described above; where and how Telegram keeps them is governed by Telegram's rules.

Your rights

You have the right to know what data we hold about you and to get a copy of it; to have inaccurate data corrected; to have data erased; to restrict processing; to receive the data processed under the contract in a machine-readable form; and to object to processing based on legitimate interest. Deleting the account link is available right away — in the app or on the Delete my data page; for any other request, write to postmaster@alxforge.com. We answer within one month.

An honest caveat: if you never signed in with Google and have no App Store purchases, the server knows only a random install number and cannot connect it to you. In that case we generally cannot tell which records are yours (GDPR Art. 11) — and may ask you to confirm the request from within the app itself. Some records we do not delete even on request, for as long as keeping them is required or needed to defend against claims: records of purchases and of minutes spent.

You also have the right to lodge a complaint with a data protection supervisory authority — in the country where you live or work, or where you believe your rights were infringed.

Children

The app is not intended for children and knowingly collects nothing from children. The store's age rating will be set by the owner at publication.

Changes

When this document changes, the date at the bottom changes with it. We will not describe as a fact, after the event, something that has not been done.

Contact

Write to postmaster@alxforge.com.

In effect since 8 October 2026

← Back to the main page · Terms of use