Privacy Policy

This policy explains what Poze collects, why we collect it, who we share it with, how long we keep it, and what you can do about all of that. We have named the actual data fields rather than hiding behind "and other information", because a policy you cannot check against reality is not much of a policy.

1. Scope and who we are

Poze is an AI creation app (Android package `ai.pozex.app`) and the website at poze-6383a.web.app. This policy covers both.

Poze is operated by a company incorporated in the Hong Kong Special Administrative Region, which is the data user (controller) for the personal data described here. Our registered entity details are published on the App Store and Google Play listings for Poze, which identify the developer of record. For any privacy matter, support@yes366.com reaches a person who can act on it.

Because we have users in several regions, this policy is written to satisfy Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) and, where they apply to you, the EU and UK GDPR and US state privacy laws. Where one of those gives you more than another, you get the more generous treatment.

It does not cover what happens after you take content out of Poze. If you post a video you made to another platform, that platform's policy applies to it there.

2. The short version

Question	Answer
Who runs Poze?	A company incorporated in Hong Kong. The developer of record is named on the App Store and Google Play listings.
Where is my data stored?	Singapore. See §9.
Do you sell my data?	No. We do not sell personal information, and we do not share it for cross-context behavioural advertising.
Do you train AI on my photos?	No. Your uploads and results are not used to train models. If that ever changes we will ask you first, separately, and give you a way to say no.
Can I use it without an account?	Yes. Guest mode is fully featured. We still need device identifiers so your work survives a reinstall.
Do you store my card details?	No. Payment happens inside the App Store or Google Play. We only learn whether a subscription is active.
Can I get my data out?	Yes — Settings → Account → Export my data.
Can I delete everything?	Yes — Settings → Account → Delete account. It cannot be undone.

3. What we collect

3.1 What you give us

• Creation material — photos, videos and audio you upload or record, together with the prompts, scripts, titles and settings you write.
• Profile — nickname and avatar. If you sign in, the email address you use, or the account identifier and email returned by Google or Apple.
• Voice recordings — only when you deliberately use voice cloning. See §5.
• Things you send us — feedback, bug reports, content reports and support email, including anything you attach to them.
• Redemption codes — promotional codes you enter.

3.2 What we collect automatically

We collect these in guest mode too. They are how your work and your purchases survive reinstalling the app.

Category	Specific fields	Why
Device identifiers	iOS: IDFV, and IDFA only if you allow tracking. Android: advertising ID (GAID) and Android ID. Both: a random ID we generate on first launch and store on your device.	Recognising the same device so a guest account can be recovered; ad attribution where you consented.
Device fingerprint	model, brand, OS version, screen resolution and density, CPU core count, total memory, language, time zone.	Used only when none of the identifiers above are available, to judge whether this is the same device. It is deliberately a weak signal — see §3.5.
App and network	app version and build number, platform, OS version, language, time zone, distribution channel, IP address, user agent.	Compatibility, forced-update checks, abuse prevention, approximate region.
Usage events	which screens you opened, which tool you used, whether a job succeeded or failed, paywall views and taps, share and download actions. Each event has a name, a timestamp and a small set of properties.	Understanding which features are worth keeping, and measuring whether changes helped.
Job records	which capability and model you used, the settings, credits charged or refunded, queue and processing time, failure reasons.	Running the job, billing it correctly, refunding it when it fails, and supporting you when it goes wrong.
Diagnostics	crash stack traces, error messages, request timings.	Fixing crashes and slow endpoints.

Approximate location only. We derive a country or region from your IP address and read the time zone your device reports. We do not request or collect GPS or precise location, and we do not scan Wi-Fi or cell networks for positioning.

3.3 What we receive from other companies

• Ad attribution (SolarEngine) — if you installed Poze after seeing an ad, our attribution provider tells us the channel, campaign, ad group, creative, the click and install timestamps, the country and the language, plus whether it was a re-engagement campaign. We store these fields on your account and keep the raw payload for troubleshooting. We use them to decide what the home screen shows you first, and to work out which ads are worth paying for.
• Subscription status (RevenueCat, App Store, Google Play) — whether a subscription is active, which product, when it renews or expires, whether you are in a trial, and refund or billing-problem events. We never receive your card number, bank details or billing address.
• Sign-in providers (Google, Apple) — when you choose to sign in with them, the account identifier, and the email address and display name you agree to share. Apple's Hide My Email relay address works fine here.
• Install referrer (Android) — the referrer string Google Play passes to the app on first launch.

3.4 Aggregated and de-identified data

We produce aggregate statistics — how many jobs ran, how often a model fails, which tools are popular. Once data is aggregated it no longer identifies you and this policy stops applying to it. We do not attempt to re-identify data we have de-identified.

3.5 What we deliberately do not collect

Naming these is useful, because several of them are things comparable apps do collect:

• Precise GPS location.
• Your contacts or address book.
• A list of the other apps installed on your device.
• The contents of your photo library. We only ever receive the specific files you pick.
• Card numbers or bank details.
• Biometric templates used for identification. Face detection produces geometry we use to crop and align a picture — we do not build a faceprint that could identify you across accounts. See §5.

4. Why we use it

Purpose	What it uses	Legal basis (where GDPR applies)
Running the features you asked for	creation material, prompts, settings, avatars, voices	Performance of a contract
Keeping your account and recovering it after a reinstall	device identifiers, device fingerprint	Performance of a contract; legitimate interests
Credits, subscriptions and refunds	job records, subscription status, wallet history	Performance of a contract; legal obligation (financial records)
Content safety and legal compliance	uploads, prompts, generated results, reports, enforcement history	Legal obligation; legitimate interests in keeping the service lawful and safe
Preventing abuse, fraud and quota farming	device identifiers, IP address, usage patterns	Legitimate interests
Fixing and improving the product	usage events, diagnostics, aggregate statistics	Legitimate interests
Deciding what to show you first	attribution channel, language, which tools you have used	Legitimate interests; consent where tracking consent is required
Notifications you turned on	push token, notification preferences	Consent; performance of a contract for service messages
Measuring advertising	attribution data, advertising identifiers	Consent
Answering you when you write in	your message, account identifier, relevant job records	Performance of a contract; legitimate interests

Where we rely on consent, you can withdraw it at any time and we stop that processing going forward. Withdrawing does not make what we already did unlawful. Where we rely on legitimate interests, we have weighed our interest against your rights, and you can object — see §12.

Sensitive data (GDPR Article 9). Face geometry and voice characteristics can be sensitive data depending on how they are used. We process them only on your explicit consent, given by choosing to use a feature that needs them and, for voice cloning, by confirming the recording is your own. See §5.

5. Faces and voices

This is the part of an app like Poze most worth reading carefully, so it gets its own section.

5.1 Faces

• When you upload a photo for an avatar, face swap, retouch or template feature, we run face detection on it. That returns how many faces are present, where they are, a set of landmark points, and a suggested crop.
• We use that to align and crop the image, and to tell you up front whether the photo will actually work — no face, several faces, or a face too small to use.
• The detection result is stored alongside the uploaded file and deleted with it.
• We do not use it for identification. We do not build a faceprint, we do not match faces between users, and we do not look faces up against any external database.

5.2 Voices

• We process voice characteristics only when you deliberately use voice cloning.
• Before you can submit, you must confirm that the recording is your own voice. We store that confirmation, with a timestamp, as a record of consent.
• A cloned voice is private to your account. It is not offered to other users.
• You can delete a cloned voice at any time, which deletes the model derived from it.

5.3 What we ask of you

6. AI models and your content

To produce a result, your material and prompts are sent to the model provider that runs the model you selected. They act as our processor: under contract they may use it only to return the result to us, and for nothing else — in particular not to train their own models on it.

• We do not train models on your private material. Not your uploads, not your prompts, not your results.
• If we ever want to, we will ask for separate, specific consent, and it will be off by default.
• We do use aggregate signals that are not personal data — for example, that a particular model fails more often than another, or that a setting is rarely used.
• Content you deliberately publish to the community is visible to other people. That is the point of publishing it, and it is a decision you make per item.

7. Cookies, local storage and tracking signals

7.1 This website

This site sets no cookies at all. It uses browser local storage for exactly one thing: remembering whether you chose light or dark mode. Nothing on this site is sent to an advertising network, and there are no third-party analytics scripts.

7.2 The app

The app does not use cookies. The equivalents are the device identifiers in §3.2 and preferences stored locally on your device. A web view opens only when you tap an external link, and the destination site's own rules then apply.

7.3 Web beacons and pixels

We do not embed tracking pixels in email. If we later send product or marketing email that measures opens or clicks, we will say so here first and it will be something you opted into.

7.4 Do Not Track and Global Privacy Control

Browsers send a `Do Not Track` header inconsistently and there is no agreed meaning for it, so this site does not respond to it — there is nothing for it to turn off. We do honour Global Privacy Control signals where law requires it; since we neither sell nor share personal information for advertising, the signal changes nothing in practice.

7.5 Your controls

• iOS tracking: Settings → Privacy & Security → Tracking. If you say no, we never receive the IDFA and attribution falls back to weaker signals.
• Android advertising ID: Settings → Privacy → Ads, where you can reset or delete it.
• This site: clearing site data removes the theme preference. Nothing else is stored.

8. Who we share with

We do not sell personal information. We do not share it for cross-context behavioural advertising. Below is everyone who touches it and why.

8.1 Service providers acting for us

These process data on our instructions, under contract, with confidentiality and security obligations, and may not use it for their own purposes.

Provider category	What they receive	Purpose
AI model providers	the material and prompts for the job you submitted	Producing the result
Cloud hosting and database	everything stored by the service	Running the service
Object storage and CDN	uploaded files and generated results	Storing and delivering media
Content moderation	uploads, prompts and results awaiting review	Safety and legal compliance
Crash and performance monitoring	diagnostics, device and app metadata	Diagnosing faults
Push delivery	push token and the notification text	Delivering notifications you enabled
Attribution and analytics	device identifiers and usage events	Measuring advertising and product use
Payment platforms	purchase and subscription events	Taking payment and managing entitlements
Email and support tooling	your message and contact address	Replying to you

8.2 Other people, when you choose

Your public profile and anything you publish to the community are visible to other users. A work stays private until you publish it. If you share a result outside Poze, whoever you send it to has it.

8.3 Legal and safety disclosures

We disclose personal data when a valid legal request requires it, and where we reasonably believe disclosure is necessary to investigate a serious violation, to protect someone from harm, or to establish or defend a legal claim. We review requests for validity and scope rather than handing over everything asked for, and we will try to tell you first unless we are legally prohibited or telling you would defeat the purpose.

Material that appears to involve the sexual exploitation of children is an exception: we preserve it and report it to the appropriate authority without notifying the account holder.

8.4 Business transfers

If Poze is merged, acquired, or its assets sold — or in insolvency — personal data may transfer with the business. We will notify you beforehand through the app or by email, identify the recipient, and require them to keep honouring this policy. If they want to use your data for a materially different purpose, they must ask you separately.

8.5 Affiliates

Group companies may process data on the same terms as the providers in §8.1, for the same purposes, and are bound by the same obligations.

9. Where your data lives

We are established in Hong Kong. Our servers and primary database are in Singapore. Using Poze therefore means your information is transferred to and processed in Singapore, and is handled by a Hong Kong company. Some providers in §8.1 operate infrastructure in other countries, including the United States and the European Union.

Privacy law differs between countries. Where we move personal data out of a region whose law restricts that, we rely on a recognised safeguard:

• EEA and Switzerland: the European Commission's Standard Contractual Clauses, with a transfer risk assessment where one is required.
• United Kingdom: the UK International Data Transfer Addendum.
• Hong Kong: we apply the Personal Data (Privacy) Ordinance's data protection principles to transfers out of Hong Kong, and bind recipients contractually to a comparable standard.
• Elsewhere: the mechanism local law provides, or your explicit consent where no other route exists.

In every case we transfer the minimum needed, bind the recipient contractually, and hold them to the retention limits in §10.

10. How long we keep things

We keep personal data only as long as it is doing a job. When it stops being useful we delete it or de-identify it.

What	How long	Why that long
Uploaded material and generated work	until you delete it; within 30 days of account deletion	It is yours, and you decide
Account profile	while the account exists	Running the account
Device identifiers	while the account exists; deleted immediately on account deletion	Account recovery
Credit and purchase records	retained after account deletion for as long as financial record-keeping and tax law require	We are legally obliged to keep these, and they settle refund disputes
Usage events and diagnostics	up to 24 months, then aggregated or deleted	Year-on-year comparison, then it stops being useful
Raw attribution payloads	up to 12 months	Troubleshooting ad delivery
Moderation decisions and enforcement history	up to 24 months	Recognising repeat violations; handling appeals
Voice-cloning consent records	for as long as the cloned voice exists, plus 24 months	Demonstrating that consent was given
Support correspondence	up to 24 months	Context if you write in again
Backups	rolling, overwritten within 35 days	Disaster recovery

Deleting something removes it from the live service straight away. Backups are overwritten on their own schedule, so a copy can persist for up to 35 days before it is gone.

11. How we protect it

11.1 Technical measures

• Everything in transit uses HTTPS.
• Stored data is encrypted at rest by the managed database and object storage we use.
• Uploads go straight from your device to object storage using a short-lived, single-purpose URL. Files never pass through our application servers.
• API requests are signed and protected against replay, so a captured request cannot be resent or altered.
• Every decision about credits, entitlements and access happens on the server. Nothing security-relevant is decided by the app on your device.

11.2 Access control

• Production access is limited to service accounts and to the small number of people who need it.
• Internal operational endpoints are not reachable from the public internet — they sit behind identity-based access control.
• Administrative access is logged.

11.3 People and suppliers

• Anyone with access is bound by confidentiality obligations.
• We assess providers before sending them personal data and bind them by contract.
• We collect the minimum that makes the feature work, and delete on the schedule in §10.

11.4 If something goes wrong

If a breach affects your personal data we will notify the relevant supervisory authority and, where the law requires it, you — within the statutory deadline. The notice will describe what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

11.5 The honest limit

No system is perfectly secure, and we will not pretend otherwise. Choose a strong, unique password on any account you link, keep your device locked, and think before you publish something to the community — once other people have seen it, we cannot unsee it for them.

12. Your rights and how to use them

12.1 What you can do in the app, right now

You want to	Where
See or export your data	Settings → Account → Export my data
Correct your profile	Settings → Edit profile
Delete a specific work, avatar or voice	Long-press the item → Delete
Unpublish something from the community	Open it → ⋯ → Unpublish
Delete your account and data	Settings → Account → Delete account
Turn notifications off, by category	Settings → Notifications
Withdraw tracking consent	Your device's system privacy settings

12.2 Rights you have under data protection law

• Access — a copy of the personal data we hold about you, and information about how we use it.
• Rectification — correction of data that is wrong or incomplete.
• Erasure — deletion, where we no longer have a lawful reason to keep it.
• Restriction — a pause on processing while a dispute about accuracy or lawfulness is resolved.
• Objection — to processing based on legitimate interests, including profiling. If you object to direct marketing we stop, full stop, with no balancing test.
• Portability — the data you gave us, in a structured, machine-readable format — which is what the export produces.
• Withdraw consent — at any time, for anything we do on the basis of consent.
• Complain — to your supervisory authority. We would rather you came to us first, but it is your right either way.

12.3 Hong Kong residents

Under the Personal Data (Privacy) Ordinance you may make a data access request — asking whether we hold personal data about you and for a copy of it — and a data correction request where that data is inaccurate. Use the same route in §12.5; you do not need a special form. We respond within 40 days, which is the statutory deadline, and usually faster.

We may charge a fee for complying with a data access request, which the Ordinance permits. In practice we do not, because the in-app export in §12.1 gives you the same thing for free and instantly. If a request is unusual enough that a fee would apply, we will tell you the amount before doing the work.

We collect personal data only for lawful purposes directly related to running Poze, keep it no longer than necessary, and do not use it for a new purpose without your consent. We do not use your personal data in direct marketing, and we do not provide it to anyone else for their direct marketing — so there is nothing here for you to opt out of. If that ever changes we will ask for your consent first, in writing, as the Ordinance requires.

If you are unhappy with how we handled a request, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD). We would rather you came to us first, but it is your right either way.

12.4 California residents

You may request the categories and specific pieces of personal information we collected, the categories of sources, the business purposes, and the categories of third parties we disclosed to, for the preceding 12 months; ask us to delete it; ask us to correct it; and limit the use of sensitive personal information. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no "Do Not Sell or Share" link to click. We will never give you worse service, or a worse price, for exercising these rights. You may use an authorised agent, with written proof of authorisation.

12.5 How to make a request

1. Email support@yes366.com with the subject line "Privacy request".
2. Tell us which right you are exercising and what you want.
3. Include the UID shown at the bottom of the Settings screen. It is how we find your account without asking you for more personal data than necessary.

We acknowledge within 7 days and respond within 30 days. If a request is genuinely complex we may extend that once, and we will tell you why before the first 30 days are up. There is no charge, unless a request is manifestly unfounded or repetitive, in which case we will tell you the fee before doing the work.

12.6 Verifying that it is you

We have to be sure we are not handing your data to someone else. Usually the UID plus the email address on the account is enough. If we cannot verify you to a reasonable standard we will say so rather than guess, and we will not collect new identity documents just to run the check.

12.7 When we may decline, in whole or part

• We cannot verify that the request comes from you or someone you authorised.
• Complying would disclose another person's personal data, and we cannot reasonably separate it.
• The data is subject to a legal hold, or law requires us to keep it — financial records are the usual case.
• The request is manifestly unfounded or repeats one we have already answered, with nothing changed.
• The information is legally privileged, or relates to an ongoing investigation of abuse where disclosure would defeat the point.

When we decline we tell you which ground applies and how to challenge it, rather than going quiet.

12.8 Appeals

If you disagree with our decision, reply to the same thread and ask for it to be escalated, or write to support@yes366.com with "Privacy appeal" in the subject line. A different person will look at it. You can also go straight to your supervisory authority.

13. Automated decisions

Some decisions in Poze are made automatically, without a person looking first. You are entitled to know which, and to challenge them.

Decision	What it does	Your recourse
Content moderation	Automatically classifies uploads, prompts and results, and blocks what appears to breach the Content Policy.	Ask for human review — see the Content Policy. A blocked job is not charged, and a job blocked at the output stage is refunded.
Abuse and quota-farming detection	Flags patterns that look like scripted activity, and may limit features.	Write in. A person will review the account.
Device matching	Decides whether a device belongs to an existing guest account.	If your work does not come back after a reinstall, write in with your UID.

Automated moderation is deliberately cautious and it does misfire. That is exactly why every automated block can be escalated to a person, and why we would rather hear about a false positive than not.

We do not use automated processing to make decisions that produce legal effects concerning you, and we do not profile you for credit, employment, insurance or similar purposes.

14. Children and young people

Poze is for people aged 16 and over. Where local law sets a higher age for using a service like this without a parent, that higher age applies.

• We do not knowingly collect personal data from anyone under 16.
• We do not direct Poze at children, and we do not knowingly show advertising to them.
• If we learn that an account belongs to someone under 16, we disable it and delete the data, keeping only what we must to show we handled it properly.
• We never sell or share a minor's personal data, target advertising at them, collect precise location, or make their content public by default.

Parents and guardians: if you believe your child has given us personal data, write to support@yes366.com with enough detail to find the account. We will delete it. You can also withdraw consent on their behalf at any time.

Generating content that depicts minors in a sexualised way is prohibited outright, is blocked by moderation, and is reported to the appropriate authority. There is no appeal process for that, and there should not be one.

15. Links to other services

Poze links out — to app stores, to a payment flow, to a social platform when you share, and to any URL that appears in content. We do not control those destinations and this policy does not cover them. When you follow a link, the other operator's terms and privacy policy apply. It is worth a look before you hand them anything.

16. Changes to this policy

When we update this policy we change the effective date at the top and keep the current version on this page.

• Minor changes — clearer wording, a new provider in an existing category — take effect when published.
• Material changes — a new purpose, a new category of data, a change in who we share with — are announced in the app before they take effect, with at least 14 days' notice where we can reasonably give it.
• If a change needs your consent, we ask for it. We do not treat continued use as consent for anything that legally requires a real yes.

17. Contact us

For anything in this policy — questions, requests, complaints — write to support@yes366.com. Putting "Privacy" in the subject line routes it faster, and including your UID from the Settings screen saves a round trip.

If you think we have handled your data badly you may complain to a regulator: the PCPD in Hong Kong, your supervisory authority in the EEA or the UK, or your state Attorney General in the United States. You do not have to come to us first — but most things, we can simply fix.

Where the law requires us to appoint a local representative or a Data Protection Officer for a region we serve, we will do so and name them here.