ActivArt Privacy Policy: How We Protect Your Data

ActivArt ("we", "us", "our") is built on a simple principle: your data stays on your device. This policy explains exactly what information is accessed, where it goes, and what we never do.

1. What We Access

Activity data: activity name, start time, duration, distance, and (where available) route, elevation, and pace data from Intervals.icu, Strava, Health Connect, or Apple Health. Used only to identify the time window for photo matching and to render in-app statistics and videos on your device.
Device photo gallery: photos whose capture timestamp falls within an activity's time window. The app reads pixels only when you explicitly trigger photo processing.
Account authentication: when you sign in with Google or Apple, we receive your email address. This is stored in our VPS database (encrypted with AES-256-GCM; a keyed hash is used as the lookup key so the plaintext is never exposed to SQL queries) and is used solely to identify your account for quota management and account deletion.
Usage tracking: local and cloud-synced usage counts for AI generations, stats overlays, custom logos, and video generations, used to enforce free-tier allowances and Premium quotas. Linked to your account email but contains no other personal data.
Subscription identifier: to manage ActivArt Premium and Custom Logos purchases via RevenueCat, we use a randomly generated anonymous identifier (a UUID) as your "App User ID". This identifier is never your Firebase UID or your email address.
Logo overlays: custom logo images and their positions, stored securely in the app's local private storage. Never transmitted to our servers.
Support inquiries: when you use our contact form, we collect your name, email address, and message content to respond to your request. This data is used solely for support.

2. What We Do NOT Collect

We do not collect your name or any personal identifiers beyond your email address (required for account authentication) and what you explicitly provide via the support form.
We do not store your photos on ActivArt servers. Photos are transmitted to the AI backend only during image-to-image generation and are discarded immediately after.
We do not store your account credentials, only short-lived OAuth tokens or platform-provided health access.
We do not use advertising SDKs or track your location.

3. Third-Party Services

ActivArt integrates with official APIs from Intervals.icu, Strava, Apple (Apple Health, sign-in with Apple), and Google (Health Connect, Firebase, sign-in with Google). Subscription and one-time-purchase management is handled via RevenueCat. AI image processing is handled by third-party AI service providers. Usage data collected by these services is handled in accordance with their respective privacy policies.

Note: We use Firebase Analytics and Crashlytics on Android to improve app stability. These tools collect technical device data and anonymized event logs, but do not access your photos or activity details. Our website (activart.app) uses Google Analytics, only with your consent, to understand aggregate visitor traffic and which pages are useful. Analytics cookies are not set until you accept them in the website's consent banner. This applies to the website only, not the app, and collects no photos or activity data.

4. AI Photo Processing

When you apply an AI effect to an existing photo (image-to-image), your photo is transmitted to the configured AI backend for processing. The image is used solely to generate the result and is not retained or stored after generation completes. When generating a brand-new image from your activity type (text-to-image), no photo data is sent at all, only a text prompt describing your activity and style preferences. If you enable the statistics overlay, selected activity figures (such as distance and time) are included as text in that prompt so the AI can render them into the image.

Your photos and your activity data are used only to produce the specific result you request. They are never used to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model, ours or a third party's. In particular, we do not use data obtained through the Strava API to train AI or ML models.

4a. Video Generation (On-Device)

GPS-route and elevation-profile videos are rendered entirely on your device. No video data, and no constituent photos used in the video, is uploaded to our servers or any third-party AI backend during video generation. The finished MP4 lives only on your device until you choose to share it.

5. Data Retention

All core app data (tokens, style preferences, custom logos) is stored locally on your device. Deleting the app removes this data. Subscription usage counts sync to our VPS and are retained while your account is active. When you delete your account, your data is permanently removed from our servers after a 30-day grace period (see Section 6).

6. Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have the following rights regarding your personal data:

Right to erasure (Art. 17 GDPR): You can delete your account at any time via Settings → Account → Delete Account in the app, or via activart.app/account on the web. You will be signed out immediately. Your data is permanently deleted from our servers after a 30-day grace period. Signing back in within 30 days cancels the deletion and fully restores your account and quota.
Email security: Your email address is stored encrypted (AES-256-GCM) on our servers. It is never stored in readable form in the database. A keyed HMAC-SHA256 hash is used for all lookups.
Right to access / data portability: To request a copy of the data we hold about you, contact us at [email protected].
Lawful basis: We process your email address on the basis of legitimate interest, specifically to enforce per-account AI generation quotas and prevent abuse.