Privacy Policy

Introduction

Welcome to Gotcha. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our iOS application.

1. Information We Collect

Personal Information:

• Apple ID (handled securely through Apple's Sign In with Apple authentication)
• Email address (if provided through Apple Sign In)
• Name (if provided through Apple Sign In)
• Credit balance and purchase history (stored securely in Firebase)
• Referral codes and referral history
• Support Communications: When you contact us for support, we collect your email address and any information you provide in your messages.

Content You Create:

• Photos you upload for prank photo generation
• Generated prank images (automatically deleted after 7 days, cannot be stored or accessed by us after deletion)
• Creation metadata (timestamps, template selected, model used)
• Generation history

Technical Information:

• Device information (iOS version, device model)
• App usage data and crash reports (via Firebase Crashlytics)
• Network information for service delivery
• Purchase transaction data (via RevenueCat and Apple)

2. Face Data & Photo Processing

Gotcha uses AI-powered image generation to create prank photos. When you upload a photo containing a face, the following applies:

2.1 Face Data Is Not Retained

Gotcha does not retain, store, or collect any face data, facial geometry, biometric identifiers, or facial recognition data. We do not extract, analyze, or create face maps, face prints, or any biometric templates from the photos you upload. The uploaded photo is used solely as a visual input for AI image generation — not for facial recognition or identification purposes.

2.2 How Face Data Is Used

When you upload a photo containing a face, the photo (including any facial features visible in the image) is transmitted to our third-party AI provider for the sole purpose of generating your requested prank image. The AI processes the visual appearance of the photo to produce a modified or transformed version. No facial recognition, face mapping, or biometric analysis is performed.

2.3 Duration of Face Data Processing

Your uploaded photo is processed in real-time (typically within 10–60 seconds). The uploaded photo is automatically and permanently deleted immediately after processing is complete. No copy of the original uploaded photo is retained by Gotcha or any third party after the AI generation is finished. The generated output image (which is a new AI-created image, not your original photo) is stored for up to 7 days to allow you to view and download it, after which it is also automatically deleted.

2.4 Third Parties That Receive Face Data

The only third party that receives your uploaded photos (which may contain face data) is:

• fal.ai — Our AI image generation provider. fal.ai receives only the uploaded photo required for generation. No personal identifiers, names, email addresses, user IDs, or account information are sent to fal.ai alongside the photo.

2.5 Why Face Data Is Shared with fal.ai

Face data is shared with fal.ai solely because fal.ai provides the AI image generation service that powers Gotcha's core functionality. The photo is required as a visual input for the AI to generate the prank image. There is no other reason for sharing this data, and the data is not used for advertising, analytics, profiling, or any secondary purpose.

2.6 fal.ai's Face Data Practices

fal.ai does not retain, store, or keep any face data or uploaded photos after processing is complete. Specifically:

• fal.ai processes images in real-time and deletes them immediately upon completion of the generation task.
• fal.ai does not use uploaded images for model training, improvement, or any other purpose.
• fal.ai does not extract, store, or create facial recognition data, biometric identifiers, or face templates.
• fal.ai does not share uploaded images with any other third parties.
• For more details, see fal.ai's Privacy Policy.

3. How We Use Your Information

We use the collected information to:

• Provide and maintain our AI-powered prank photo generation services
• Process your payments and manage credits
• Manage referral rewards and daily credits
• Improve app performance and user experience
• Provide customer support
• Send important updates about the service
• Ensure security and prevent fraud
• Comply with legal obligations

4. Data Storage and Security

Local Storage:

Your credit balance, referral data, and generation history are stored securely in Firebase Firestore, accessible only to you through your authenticated account.

Cloud Processing & Third-Party AI:

When you initiate a photo generation, your uploaded photo(s) are sent to our third-party AI provider, fal.ai, for image processing. This is the only data shared with fal.ai — no personal identifiers, names, email addresses, or account information are sent. Only the image data required for generation is transmitted.

Photos sent to fal.ai are processed in real-time and are automatically deleted immediately after processing is complete. fal.ai does not retain, store, or use your images for any other purpose, including model training. No face data, facial recognition information, or biometric data is retained or stored by Gotcha or fal.ai.

By uploading a photo and initiating a generation, you consent to your image being temporarily processed by fal.ai for the sole purpose of creating your requested AI-generated prank image. You must accept this Privacy Policy during account creation before using any generation features.

Abuse Prevention:

We may temporarily retain uploaded content for a limited period (up to 72 hours) solely for the purpose of detecting, preventing, and investigating abuse, illegal activity, or violations of our Terms of Service. This data is automatically deleted after this period and is never used for any other purpose.

Generated Content Storage:

Generated prank images are automatically deleted 7 days after creation. After this period, the content cannot be stored or accessed by us. You can delete any generated content at any time through the app before the 7-day period expires.

Security Measures:

We implement industry-standard security measures including:

• End-to-end encryption for data transmission
• Secure API communications (HTTPS)
• Firebase Authentication with Apple Sign In
• Firebase Security Rules to protect user data
• Secure payment processing through Apple and RevenueCat

5. Third-Party Services

We use the following third-party services:

• Firebase (Google): For authentication, data storage (Firestore), file storage (Firebase Storage), and crash reporting (Crashlytics). Data shared: authentication tokens, user account data, generated image URLs, and crash/analytics data.
• fal.ai (External AI Provider): Our sole third-party AI integration for image generation. Data shared: only user-uploaded photos required for generation — no personal identifiers, names, or account data. Images are deleted immediately after processing and are not used for model training.
• RevenueCat: For in-app purchase management. Data shared: anonymized user ID, purchase transactions, and credit balance.
• Apple: For authentication (Sign In with Apple) and payment processing (App Store). Data shared: as required by Apple's authentication and payment frameworks.

Each third-party service has its own privacy policy. We encourage you to review their policies:

• Firebase Privacy Policy
• fal.ai Privacy Policy
• RevenueCat Privacy Policy
• Apple Privacy Policy

6. Data Retention

• Generated prank images: Automatically deleted 7 days after creation. After this period, we cannot store or access this content.
• Credit balance: As long as you use the app
• Purchase history: Retained for accounting and legal compliance purposes
• Support communications: Up to 2 years
• Uploaded photos: Deleted immediately after processing (within seconds)

7. Your Rights

You have the right to:

• Access your personal data: View your account information, credit balance, and generation history through the app
• Request data deletion: Delete your account and all associated data via Settings → Delete Account in the app
• Opt-out of data collection: You can stop using the app at any time
• Request data portability: Contact us to request a copy of your data
• Withdraw consent: You can withdraw consent at any time by deleting your account

8. Children's Privacy

Gotcha is not intended for users under 18 years of age. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child under 18, please contact us immediately.

9. International Data Transfers

Gotcha operates globally. Your information may be transferred to and processed in countries other than your own, including the United States where our service providers (Firebase, fal.ai, RevenueCat) are located. By using Gotcha, you consent to such transfers.

10. California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your privacy rights

11. European Union (GDPR) Rights

If you are located in the European Union, you have additional rights under GDPR:

• Right to access your personal data
• Right to rectification (correction of inaccurate data)
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by:

• Posting the new policy in the app
• Updating the "Last Updated" date
• Notifying you through the app or via email if the changes are significant

Your continued use of Gotcha after changes constitutes acceptance of the new policy.

13. Contact Us

By using Gotcha, you agree to the collection and use of information in accordance with this privacy policy.