Privacy Policy

1. Controller

Spoofly (Mulhouse, France) is the data controller for personal data processed through the Spoofly website and application. Contact: [email protected].

2. Your media stays local

The photos and videos you process are never uploaded to our servers. All processing happens locally on your device. We have no access to your content.

3. Data we process

• Account data — via Google Sign-In: your name, email address, and profile picture, used to identify your account.
• Subscription data — your plan status, subscription and customer identifiers from Stripe. We do not store your card details.
• Usage data — for free-plan accounts, a count of monthly generations, used solely to enforce the free quota.
• Technical data — minimal logs needed to operate and secure the Service.

4. Purposes & legal bases

• Providing the Service and your account — performance of contract.
• Processing payments and managing subscriptions — contract.
• Enforcing free-plan limits — legitimate interest.
• Security and fraud prevention — legitimate interest.

5. Processors

• Supabase — authentication and database (account, subscription, and usage data).
• Stripe — payment processing and subscription management.
• Google — sign-in (OAuth) identity verification.

6. Retention

We keep account and subscription data for as long as your account is active and as required to meet legal and accounting obligations. You can request deletion of your account at any time.

7. Your rights

Subject to applicable law (including the GDPR), you have the right to access, rectify, erase, restrict, and port your data, and to object to certain processing. To exercise these rights, contact [email protected]. You may also lodge a complaint with your local data-protection authority.

8. Cookies

We use only the cookies strictly necessary to keep you signed in and to operate the Service. We do not use advertising cookies.

9. Changes

We may update this policy; material changes will be reflected here with an updated date.