Apex Era

Privacy Policy

Last updated: 14 September 2026 (rev. 4)

This Privacy Policy explains how samko labs, s. r. o., with registered seat at Trnková 451/12, 040 14 Košice – mestská časť Košická Nová Ves, Slovak Republic (IČO: 53928881, DIČ: 2121532600) ("we", "us", "our"), processes personal data when you use the Apex Era app. We are the data controller under the EU General Data Protection Regulation (GDPR).

1. What we process

• Face photos — processed transiently to generate a restyled portrait (see below). They are never persisted by us.
• Generated portraits & app data (your saved looks, chosen eras, settings) — stored locally on your device. We do not receive a copy.
• Credit balance — a counter of remaining generations, keyed to the anonymous transaction identifier Apple issues for your subscription. It contains no photo, no generated image, and no record of which eras you chose. (Our analytics records do hold era-level usage — that is a separate system, described in section 5.)
• Subscription data — when you purchase or change a subscription, Apple sends us signed subscription lifecycle events (e.g. purchase, renewal, cancellation, refund) containing transaction identifiers, product ID, and status. We store these to operate the service, prevent fraud, provide support, and meet legal and accounting obligations.
• Push notification token — if you turn notifications on, Apple issues your copy of the App a device token, which we store so we can send you a notification. We store the token itself, whether it belongs to Apple's production or sandbox notification service, and — optionally — your language setting and the App version, so a message can be sent in the right language to the right App version. Where you are also a subscriber, the token may be linked to the anonymous transaction identifier Apple issues for your subscription, so that an offer meant for subscribers isn't sent to non-subscribers and vice versa. The token is a per-installation identifier, not a name, an email address or a device serial number; it contains no photo, no generated image, and no record of which eras you chose — though the same installation identifier is used for analytics, which does record that (sections 4 and 5). See section 4.
• Usage analytics — a record of how you use the App: sessions and screens you open, onboarding steps, which eras you pick and generate, the quality tier you choose, credits spent, paywall views and plan choices, purchases (product, price, currency, whether a trial applied), your AI-consent decisions, whether a generation succeeded or failed and how long it took, and when you save, share or delete a result. Each event carries the installation identifier described in the next bullet, so sessions join up across launches. It never contains your photo, any image data, anything derived from a photo, file names or paths, your email address, your push token, the era prompts, or any text you typed. Processed by Amplitude in the EU — see section 5.
• Installation identifier — a short identifier for your installation of the App. It is used in two places: it is attached to every analytics event (previous bullet), and, if you turn notifications on, it is stored with your push token. It comes from the anonymous app-transaction identifier Apple issues your Apple Account for this App (Apple issues one even if you never pay for anything); where the App cannot read that, it makes up a random identifier and keeps it on your device instead. We are telling you plainly what this is: unlike the push token, it survives reinstalling the App, and where it comes from Apple it is the same value on your other devices signed in to the same Apple Account. We use it to recognise an installation: so a notification about a new era or an offer reaches you once and not three times, so that people who have never subscribed can be reached at all (the subscription identifier above, by definition, cannot identify them), and so that your analytics events form one continuous history instead of a new stranger every launch. Because it is also the analytics identity, your era-by-era usage history is associated with it — we are not going to pretend otherwise. It is not shared with advertisers or data brokers, is not used to track you across other apps or websites, and is not sold. It is not a name, an email address, an advertising identifier or a device serial number, and it carries no photo, no generated image and nothing derived from a photo. See sections 4 and 5 for deletion.

2. How photos are processed

Your photo is transformed using OpenAI's image generation API. The image is transmitted to OpenAI solely to produce the styled portrait you requested. It is not used by us to identify you, and OpenAI does not use data submitted through its API to train its models. We do not claim generation happens on-device — it cannot; the photo must leave your phone for the App to work.

This only happens with your permission. The first time — and every time after, unless you choose “Don’t ask me every time” — the App shows a full consent screen naming OpenAI as the recipient, showing the exact photo that would be sent, and asking you to agree. If you turn that screen off, the App still names OpenAI on screen before each generation, so you are always told where the photo is going before it leaves your phone. If you decline, no photo is sent and no image is generated. You can withdraw or grant this consent at any time in Settings → Privacy inside the App; withdrawing also restores the full consent screen.

3. Face data: collection, use, sharing, and retention

• What face data we collect: the photo you submit, and the AI-generated portrait produced from it. We do not create or store biometric identifiers, faceprints, or facial-geometry templates, and we do not use face data to identify or recognise you.
• How we use it: solely to generate the single styled portrait you asked for and return it to your phone. Face data is never used for advertising, marketing, identification, or AI model training by us.
• Who it is shared with: with your consent, the photo is sent over an encrypted connection to our server (hosted by Cloudflare), which forwards it to OpenAI acting as our processor to generate the image. It is shared with no other third party.
• Where it is stored: the photo and the generated image are held only in memory on our server for the duration of that single request and are never written to disk, database, cache, or logs. Your photos and generated portraits are stored locally on your device only; we keep no copy.
• How long it is retained: photos sent for generation are retained for zero time beyond the request — they are discarded as soon as the image is returned. OpenAI may retain API request data for a limited period for abuse monitoring under its own policy. On-device photos and generated portraits remain on your phone until you delete them (Settings → Delete All Data) or uninstall the App.

4. Push notifications

Notifications are entirely optional. Nothing is collected under this section unless you allow notifications when iOS asks you to.

• What we store: the Apple push token for your installation of the App, the notification environment it belongs to, optionally your language setting and App version, and an identifier for your installation (next bullet). Where the App has an active subscription at the moment it registers, the token is linked to the anonymous subscription transaction identifier.
• The installation identifier, plainly: a short, anonymous string stored alongside the push token. It is normally the app-transaction identifier Apple issues your Apple Account for this App — issued even for a free download — and where the App cannot read that, a random identifier the App generates and keeps on your device. It is a stronger identifier than the push token and we would rather you heard that from us: a push token changes when you reinstall, whereas this one survives a reinstall, and the Apple-issued form is the same value across your devices signed in to the same Apple Account.
• Why we keep it: so we can recognise an installation. That lets us send a message about a new era or a credit-pack offer once rather than repeatedly to the same person, stop sending to someone who has already taken up the offer, and reach people who have never subscribed — who have no subscription identifier and are otherwise invisible to us. That is the whole of it. We do not share it with advertisers or data brokers, we do not use it to track you across other apps or websites, and we do not sell it. It is not linked to any photo or any generated image. Being straight about one thing: the same installation identifier is also the identity on your analytics events (section 5), so your era-by-era usage history sits under the same identifier as your notification record. The two are held in different systems and we do not join them, but we are not going to claim it is impossible.
• How long: for as long as the App is installed and notifications are on. We delete the token when you remove it (below), and we discard tokens that Apple reports as no longer valid — which is what happens when you uninstall the App.
• How to remove it: turn notifications off for Apex Era — in the App, or in iOS Settings → Notifications → Apex Era — and the App asks us to delete the token. The installation identifier is stored in the same record and is deleted with it; there is no way to delete one and keep the other. Deleting your app data (Settings → Delete All Data) does the same. You can also email samo@vrablik.eu and we will delete it.
• Legal basis: your consent (Art. 6(1)(a) GDPR) — the permission prompt iOS shows you — withdrawable at any time by the steps above.

5. Usage analytics

To decide what to build and what to fix, we measure how the App is actually used. This is done with Amplitude (Amplitude, Inc.), acting as our processor, with the data region set to the European Union — events are sent to and stored on Amplitude's EU infrastructure.

• What is collected: app launches and sessions, screens you view and deep links you open, your progress through onboarding, which eras you browse and generate, the quality tier you choose, credits spent, paywall views and which plan you select, purchases (product identifier, price, currency, and whether a free trial applied), your AI-consent decisions, whether a generation succeeded or failed and how long it took, and when you save, share or delete a result. Events carry the installation identifier from section 1 as the identity, plus the ordinary technical context an analytics SDK collects — app version, device model, operating-system version, language and country.
• What is never collected — plainly: your photo or any image data; anything derived from your photo; file names or paths; your email address; your push notification token; the era prompts; and any free text you type. An era is reported as its short identifier (for example miami-1984), nothing more.
• Why: product decisions. Which eras are worth keeping, where people get stuck in onboarding, whether a generation failure is rare or common, whether a price makes sense. It is not advertising, it is not profiling that produces legal or similarly significant effects, and there is no automated decision-making about you under Art. 22 GDPR.
• What we do not do with it: we do not sell it, we do not share it with advertisers or data brokers, and we do not use it to track you across other companies' apps or websites. Amplitude processes it only on our instructions under a data-processing agreement and may not use it for its own purposes.
• How long: event-level analytics are retained for up to 24 months and then deleted or aggregated into figures that no longer identify an installation.
• Legal basis: our legitimate interest in understanding and improving our own product (Art. 6(1)(f) GDPR). We chose this rather than consent because the processing is first-party, pseudonymous, kept in the EU, never sold and never used for cross-app advertising — and because a consent box here would compete with the one that genuinely matters, the AI-photo consent in section 2. The trade-off is that you get an unconditional right to object.
• How to object or erase: email samo@vrablik.eu and say you object to analytics. We will stop processing your analytics data and delete the events held for your installation — you do not have to give a reason and it does not affect your use of the App. One caveat we would rather state than hide: where the installation identifier is the one Apple issues, reinstalling the App or deleting your app data does not change it, so it is the request to us — not a reinstall — that actually removes your analytics history.

6. Legal bases (GDPR)

• Consent (Art. 6(1)(a), Art. 9(2)(a)) — cloud AI processing of your face photo, asked in-app before every generation and revocable anytime in Settings → Privacy.
• Performance of a contract (Art. 6(1)(b)) — to generate the images, track your credit balance, and provide the subscriptions and features you request.
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, security, and product improvement, including the usage analytics described in section 5. You may object to analytics at any time, with no reason and no loss of functionality.
• Consent (Art. 6(1)(a)) — push notifications, given through the iOS permission prompt and withdrawable in iOS Settings → Notifications.
• Legal obligation (Art. 6(1)(c)) — tax and accounting records for purchases.

7. Who we share data with

• Apple — processes all payments, sends us subscription events, and operates the Apple Push Notification service that delivers any notification you have agreed to receive.
• OpenAI — generates the styled portrait from the transient image.
• Cloudflare — hosts our backend and processes subscription data on our behalf.
• Amplitude — our product-analytics processor. Receives the usage events in section 5 (including which eras you generate), keyed to your installation identifier, stored in Amplitude's EU data region. It never receives your photo, any image, anything derived from a photo, your email address or your push token, and it may not use the data for its own purposes.
• Meta / Facebook — the App may use the Facebook SDK for measurement and analytics.

We do not sell your personal data. Each of these parties acts as our processor under a data-processing agreement that binds them to confidentiality, to use the data only on our instructions for the purpose described above, and to security and privacy protections equal to those set out in this policy. Some processors may transfer data outside the EEA under appropriate safeguards such as the EU Standard Contractual Clauses.

8. Retention

Photos and generated images: not retained by us (in-memory only, discarded after each generation request — see section 3). On-device data: kept until you delete it or uninstall the App. Push notification tokens and the installation identifier stored with them: kept while notifications are on, and deleted together when you turn them off, delete your app data, or Apple tells us the token is no longer valid (see section 4). Free-portrait counters: a running count of how many free portraits the App has generated, as random identifiers with timestamps. They are not linked to you, your device or your Apple Account, hold no photo and nothing derived from one, and say nothing about what was generated. Usage analytics: event-level records kept for up to 24 months, then deleted or reduced to figures that no longer identify an installation, and deleted sooner on request (see section 5). Subscription and credit records: kept for the life of the account and for as long as required by tax and accounting law.

9. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. To exercise these rights, email samo@vrablik.eu. Because our usage analytics rely on legitimate interests, your objection to them (Art. 21(1)) is honoured without question: say the word and we stop processing and delete the analytics events held for your installation. You also have the right to lodge a complaint with the Slovak Data Protection Authority (Úrad na ochranu osobných údajov Slovenskej republiky) or your local supervisory authority.

10. Children

Apex Era is not directed to children under 16. We do not knowingly process their data.

11. Changes

We may update this Policy; material changes will be reflected by the "last updated" date above.

12. Contact

samko labs, s. r. o., Trnková 451/12, 040 14 Košice – mestská časť Košická Nová Ves, Slovak Republic. Email: samo@vrablik.eu.

---