// Legal · Privacy
Privacy Policy
// Effective 2026-11-08 · v1.11 · GDPR-compliant
// New in v1.11: the iPhone app's birthday cake (microphone level), photo button, text templates and 3D packs
// Translations of this document are provided for convenience. If a translation and the English version differ, the English version applies.
We're a small studio and we don't want your data either. This page tells
you exactly what we collect, why, and how to make us delete it. It's
written to comply with the EU General Data Protection Regulation
(GDPR) and Lithuanian data protection law.
Data controller
Piruz Afruz, MB (data controller)
Registration code: 306655229
Laisvės pr. 60, LT-05120 Vilnius, Lithuania
Privacy contact:
privacy@popmagics.com
What we collect
| Data | Lawful basis | Why we need it | How long |
|---|
| Email address |
Contract performance (Art. 6(1)(b) GDPR) |
Send your licence; reset access |
Until account deletion |
| Name (optional) |
Contract performance |
Personalise emails & receipts |
Until account deletion |
| Stripe payment ID and billing country |
Legal obligation (tax law) |
Reconcile refunds; tax records |
10 years (Lithuanian tax law) |
| Hashed machine fingerprint and computer name |
Legitimate interest (Art. 6(1)(f), anti-piracy) |
Enforce your plan's machine limit; list your machines in your account |
Until licence expires + 90 days |
| Website analytics (Google Analytics) |
Consent (Art. 6(1)(a)), only if you press Accept |
Understand which pages help people buy |
Up to 14 months |
| Ad measurement (Google Ads) |
Consent (Art. 6(1)(a)), only if you press Accept |
See which of our Google ads lead to a download. Ads are never tailored to you |
Up to 90 days |
| Newsletter subscription |
Consent (Art. 6(1)(a)) |
Send "lab notes" updates |
Until you unsubscribe |
| App usage statistics (optional) |
Consent (Art. 6(1)(a)), off until you switch it on |
Learn which features people use. Sent with a random ID, never your key, email or fingerprint |
Until you ask us to delete it |
| Account activity: the dates you sign in and the dates the app starts with your account, with how you signed in, app version, system, country and a short code that tells one of your computers from another |
Legitimate interest (Art. 6(1)(f)) |
Help you when something does not work; keep accounts secure; see whether the app works for new accounts |
12 months |
| IP address |
Legitimate interest (Art. 6(1)(f), security) |
Stop spam and password guessing; count downloads by country (stored shortened) |
Until you ask us to delete it |
| Messages and applications you send us |
Steps you ask us to take (Art. 6(1)(b)) |
Answer you; review Creator Pass, partner and Asset Master applications |
Until you ask us to delete it |
| Partner referral code |
Legitimate interest (Art. 6(1)(f)) |
Credit the partner whose link brought you here, if you subscribe. The code is kept in your browser; no cookie is set |
60 days in your browser; with your account until deletion |
| Partner earnings and payouts (partners only) |
Contract performance; legal obligation (tax law) |
Work out and pay your commission |
10 years (Lithuanian tax law) |
What we don't collect
- Your card number, Stripe handles all payment data; we never see it.
- Your raw hardware identifiers. The app hashes them on your machine before anything is sent.
- Your video or audio. Ever. Neither is sent to us. When you stream, they go only to the platform you choose.
- Cookies that tailor ads to you. Analytics and ad-measurement cookies are set only after you press Accept.
The phone app
Pop Magics for iPhone works on your phone.
- The app sends us nothing. It has no account and no sign-in, and it contacts no server of ours. It contains no analytics, no advertising and no tracking.
- What Apple passes on. Apple gives every developer crash reports and usage figures from people who agreed, in their iPhone settings, to share them with app developers. If you test the app through TestFlight, Apple also shows us that you installed it, how often you opened it, your phone's model and iOS version, the address you were invited by, your crash reports, and any feedback or screenshots you choose to send.
- Subscription. You can subscribe to Pop Magics Mobile in the app. Apple takes the payment and keeps the record of it; the app asks Apple, on your phone, whether your subscription is active. Apple gives us sales figures without your name or contact details. 3D packs you buy in the app are paid through Apple in the same way; we receive no payment details and no personal data.
- Camera. The app shows the camera picture so that you can place content in the room. The picture is processed on your phone. iOS works out, on your phone and for each frame, which part of the picture is a person and, with the back camera on phones that have a depth sensor, the shape of the room. The app uses both to place content in the picture. Nothing of either is kept, apart from the room map described below. The colour picker reads a small patch in the middle of the picture to take a colour; only the colour is kept, as the object's colour, and no picture.
- Front camera and face tracking. With the front camera the app runs Apple's face tracking (the TrueDepth camera, on phones that have one). On phones that can, this tells the app where the phone is. The app reads nothing about your face: not its position, its expression or its shape. No face data is stored, sent or shared.
- Microphone. The microphone is on only while you record. What it hears is kept in that recording, and you can leave it out. While you record, the app also measures how loud the sound is, only to notice when you blow out the candles on a birthday cake; nothing of that measurement is kept. Tapping the cake works without the microphone.
- Photos and files. You choose a picture, a video or a file with Apple's own picker. The app receives a copy of that one item and cannot see the rest of your library. It may only add to your Photos: each recording is put there when it ends, and each film you save in the editor. A sound file you choose for a film is copied into the app, put under the film, and deleted when you remove it or close the editor (or, if the app was shut meanwhile, the next time you open the editor).
- Photo button. A photo you take with the photo button is added to your Photos, like a recording, and a copy is kept in the app so that it shows in Edit videos. Deleting it in the app removes only the app's copy; deleting the app removes that copy too.
- Text templates. Dates, clocks, countdowns, handles, QR codes, barcodes and shop signs are made on your phone. A QR code or barcode is made on the phone from the words you type, without going online.
- What stays on your phone. Your scenes (the items in them and where the phone stood; with the back camera also a map of the room: points and the surfaces the phone found, no pictures), your clips and edited films (in the app's temporary storage, which iOS may clear), copies of the pictures, videos and 3D files you brought in, the 3D objects you made on the phone with the logo picture they were made from, the photos you took or chose for the faces of a 3D object, a few settings (whether content is turned left to right, how many videos you saved, when the app last offered the subscription or asked for a rating, and which of your clips end with the Pop Magics card), and a log of the app's own measurements such as clip lengths and battery level. Deleting the app deletes all of it. One thing remains: the date you first used the app, kept in the phone's keychain and not synchronised, so the app knows it was used on this phone before.
- Your iCloud. Videos in your Photos, and the app's files in a backup of your phone, may be stored in your own iCloud if your settings say so. That is between you and Apple.
If a later version adds sign-in, or sends anything, this section changes before that version is released.
Third parties (sub-processors)
These services process data on our behalf. We have data-processing
agreements (DPAs) with each, and they are GDPR-compliant.
We do not sell, rent or give away your personal data. It goes only to the services listed here, for the purposes listed here.
| Service | Purpose | Region |
|---|
| Stripe, payments | Process card payments | Ireland (EU) for EU customers |
| Postmark, email | Send licence and account emails | USA (Standard Contractual Clauses) |
| Buttondown, newsletter | Manage opt-in newsletter | USA (SCCs); only if you subscribe |
| Google, analytics, ads & email | Website analytics and ad measurement (only if you accept); our email inbox | EU / USA (SCCs) |
| Hetzner, hosting | Host the website and licence server | Germany (EU) |
Your rights under GDPR
You have the right to:
- Access, get a copy of all data we hold about you.
- Rectification, correct inaccurate data.
- Erasure ("right to be forgotten"), have us delete your data.
- Restriction, limit how we process your data.
- Portability, receive your data in a machine-readable format.
- Object, to processing based on legitimate interests.
- Withdraw consent, for newsletter or other consent-based processing.
- Lodge a complaint with the Lithuanian State Data
Protection Inspectorate (vdai.lrv.lt) or your local supervisory authority.
To exercise any of these rights, email
privacy@popmagics.com. We
respond within 30 days as required by GDPR Article 12(3),
usually within one working day.
What we keep after deletion
If you ask us to delete your account, we erase everything except:
- Stripe payment records (10-year retention required by Lithuanian
tax law). Tied to a payment ID, not your contact details.
- Aggregated, fully-anonymised stats with no PII linked.
Children
Our products are not directed at children. We do not knowingly collect
personal data from anyone under 16. If a parent or guardian believes a
minor has provided data to us, contact privacy@popmagics.com and we'll
delete it without delay.
International transfers
When we transfer EU personal data to non-EU sub-processors (Stripe, Postmark, Buttondown, Google), we rely on
Standard Contractual Clauses (SCCs) approved by the European Commission,
plus supplementary measures appropriate to the data involved.
Security
We use industry-standard practices including HTTPS everywhere,
Ed25519-signed licences, hashed machine fingerprints, two-step sign-in
for staff, and least-privilege access controls. If a breach puts personal
data at risk, we report it to the supervisory authority within 72 hours
of becoming aware of it (GDPR Article 33) and tell affected users without
undue delay when the risk to them is high (Article 34).
Changes to this policy
If we change anything material, we'll email everyone with an active
licence and post a notice on this page. The version number above
indicates the current revision.
Contact
Privacy questions, deletion requests, complaints:
Piruz Afruz, MB · Reg. 306655229
Laisvės pr. 60, LT-05120 Vilnius, Lithuania
Email: privacy@popmagics.com
Lithuanian supervisory authority:
State Data Protection Inspectorate (VDAI)
· A. Juozapavičiaus g. 6, LT-09310 Vilnius
