Privacy Policy for Lightfable

Version date: November 10, 2026

Lightfable (package name: com.lightfable.vidflow, referred to below as "Lightfable" or "the Service") is operated by Hong Kong Kai Yi Long Technology Co., Limited. This page explains, category by category, what the Service receives, how each kind of data is used inside our systems, and what protection it receives. Keeping the Service installed, or returning to it after this page changes, means you accept this policy. If you do not accept it, uninstalling the Service ends the relationship.

1. Data the Service Handles

Most of what Lightfable touches never leaves your phone or tablet. What follows covers the rest.

What the Service does not ask for:

• No sign-up. No form asks for a legal name, a postal address, or a telephone number. The Service creates a guest seat on the device at first launch, and you can start creating right away.
• No lasting copy of your output. Results are not archived on our side after a job completes, and nothing inside them is forwarded.
• No attempt to identify you. We do not look for or store details that would tie a device to a particular individual — no name, no home address, no personal mailbox.

What the Service records while it runs:

• A device handle. The backend needs a stable yet impersonal label for each device. The Service constructs one locally: ANDROID_ID is joined with the package name and passed through an MD5 one-way hash. The result says nothing about who owns the device. If ANDROID_ID is unavailable, a random locally stored UUID takes its place. Firebase adds an anonymous installation marker. For installs attributed to a direct Meta campaign, the Facebook SDK adds a further marker, explained in Section 7.
• The guest seat. The seat is created at first launch and bound to that handle. It carries no password, no login, and no credentials. Working history and similar conveniences live there; nothing identifying is collected.
• Routine technical readings. Device model, system version, screen dimensions, language, time zone, and comparable values that keep rendering consistent across Android hardware.
• Usage events. A record of screens and features visited and how often. It shows where repairs are due and which features earn their place.
• The advertising ID (GAID). The Google Advertising ID may be read for attribution. Turning on "Limit Ad Tracking" or "Opt out of Ads Personalization" ends the read; the ID can also be reset in system settings whenever you like.
• Recordings from the in-app recorder. When the in-app recorder is open, the microphone audio from that take is sent to us. Collection happens only during the take and has one use: custom audio, including background music, for the video you are making. Section 3 covers the mechanics.
• Push tokens. A token is what lets a service message — a generation has finished, for example — find the device. Notifications can be switched off; no essential function relies on them.

2. Media and Prompts You Send

Some creation routes require source material: a photograph, a clip, or a video with sound. You pick files through the system photo picker or the system document picker, and only the chosen item becomes reachable by the Service. The handling is as follows:

• Purpose. The file is the raw input for the computation; your finished image or clip is made from it. It reaches our servers over an encrypted connection.
• Brief presence. The upload and the result derived from it sit on our servers only while the job is open. When the job closes, both disappear.
• No residue. Nothing you sent survives the job, and no identifying detail accompanies it.

3. Voice Recordings Made in the Service

The creation flow includes an optional recorder. Each press captures one take, capped at five seconds, and that take has a single destination: custom audio, such as background music, for an AI video.

• The permission follows the feature. The microphone prompt appears at runtime, when the recorder opens. You may decline then or revoke later in system settings.
• What bounds a take. You begin with a press; the Service must be in the foreground; one take is the entire scope of collection. Listening in the background is not part of the design.
• Destination. The sound layer of the video under construction, and no other place.
• Transport. On acceptance, the file departs over an encrypted channel and is consumed by the generation.
• Lifetime. Any server-side copy exists only while processing runs and is deleted at the end.
• No voice analytics. Takes are not run through speech recognition, speaker separation, or comparable biometric treatment.
• While a take is open. The take is held in a local cache. Clearing Service data in system settings removes it.

4. Facial Signals in Uploaded Media

Where uploaded material shows human faces, Lightfable extracts a narrow set of facial signals for its AI image and video features:

• What is extracted. Landmarks around the eyes, nose, and mouth, plus proportions such as outline and scale — only from media you chose to upload.
• What they enable. Personalized, high-quality imagery; steadier visual effects on their subject; a more faithful result.
• How long they live. Processing runs on encrypted servers. Once the result exists the signals have no further use and are wiped after delivery, normally inside 24 hours.
• Recipients. No outside party; face data is never shared.

5. Why Data Is Processed

The data above is processed for the following purposes:

• Operating the Service. Running and maintaining the features you opened the Service for.
• Service messages. Job status and release announcements.
• Improvement. Usage records steer fixes, refinements, and new features.
• Security. Stopping fraud, abuse, and unauthorized entry.
• Attribution and measurement. Determining where installs originated and how campaigns performed.

We do not sell, rent, or release your data to third parties for their own marketing.

6. Purchase Information

When a payment is made inside the Service:

• Transaction data. Purchase tokens, product identifiers, order references, and subscription state are stored so the purchase can be fulfilled.
• Google holds the payment details. Every charge runs through Google Play Billing. Card numbers and payment methods never reach us; that ground is covered by Google's privacy policy.
• Membership status. Active, expired, or cancelled status is tracked so member features turn on and off at the correct time.
• Retention. Transaction records remain for as long as fulfilment duties, statutes, and dispute handling require.

7. Outside Providers

Lightfable uses these outside services:

• Google Play Services. Distribution, in-app purchases, and subscription administration. What Google collects is governed by Google's privacy policy.
• Google Play Billing. Every purchase and membership passes through this rail; tokens and transaction records ride on it.
• Firebase Analytics. Anonymous usage figures and interaction patterns; device details, events, and anonymous markers may be collected. See Firebase Privacy Information.
• Firebase Installations. Issues the unique anonymous installation label the Service relies on.
• Firebase Cloud Messaging (FCM). The transport under the Service's own push line for generation status and service notices. Device settings can silence every alert. See Firebase Privacy Information.
• Google Play Install Referrer. The route by which the Service learns how it arrived; used for attribution and measurement only.
• Google Advertising ID. Read for attribution and nothing else; it goes unread once ad tracking is limited.
• Facebook SDK (Meta). Has one assignment: measuring installs from our direct Meta (Facebook) campaigns. It ships inactive and stays entirely at rest — no initialization, no reporting — unless an install is judged to be direct-campaign traffic. Only then does it deliver the install/activation event and an anonymous device marker to Meta. Our backend receives the same marker and uses it with Meta's server-side Conversions API to measure conversions. Purchases travel by the server route alone. Facebook login, sharing, and deep links are not part of the Service. Details: Meta Privacy Policy.

Every provider above maintains its own privacy policy describing what it handles, and each merits a read.

8. Attribution and Campaign Measurement

To assess marketing and improve the Service, Lightfable may combine:

• Attribution data. Install-referrer payloads, advertising identifiers, and anonymous device fingerprints (model, manufacturer, resolution, language, time zone, carrier, network type) held for marketing attribution.
• Direct-campaign measurement (Meta). Where an install is judged to be direct Meta campaign traffic, the Facebook SDK may wake and send Meta the install/activation event plus an anonymous device marker for conversion measurement. Under any other finding it remains asleep.
• Analytics data. Anonymous usage figures, feature-interaction counts, and performance numbers carried by Firebase Analytics.
• IP address. An IP may be observed in passing for attribution; connecting it to a person is not part of the task.
• Opting out. Settings > Google > Ads offers "Opt out of Ads Personalization"; the advertising ID can be reset whenever you choose.

9. No Sale of Personal Data

Personal data is never sold, traded, or otherwise transferred to third parties for their own marketing. Anonymized, aggregated figures may reach the services named in Section 7 for the purposes stated here and no others. Disclosure may also occur where the law demands it or where defending our rights requires it.

10. Protection of Data

These safeguards shield your data:

• HTTPS encryption on every leg of the journey;
• encrypted storage on our side;
• entry checks and security monitoring at the doors.

No protection is perfect. Reasonable measures are applied, yet data in transit always retains some residual risk.

11. How Long Data Is Kept

Retention follows the purposes above, category by category:

• Uploaded media, voice takes, facial signals: removed once processing ends, normally inside 24 hours.
• Device handles and session data: kept while the Service remains on your device.
• Transaction records: kept as statutes and dispute handling require.
• Analytics data: held only as anonymized aggregates.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child's data has reached us, write to the address below and removal will begin promptly.

13. Your Controls and Rights

These controls stay in your hands:

• Access and correction. Request a summary of what we hold, and ask for changes or erasure.
• Erasure. One message to the address below starts removal. Because finished images, videos, and personal data are not kept in long-term custody, there is usually little to erase; most data stays on the device.
• Limited tracking. Turn down ad tracking in system settings and reset the advertising ID at any time.
• Notifications. Each alert obeys the on/off choice you made.
• Subscriptions. Memberships are managed or cancelled through your Google Play Store account.
• Uninstall. Remove the Service at any time; collection stops and local storage leaves with it.

14. Cross-Border Processing

Servers may be located beyond your home country. Appropriate safeguards accompany the data wherever processing occurs.

15. Revisions to This Policy

When the Service, its features, or the law changes, this policy changes too, and the version date at the top is updated. A periodic glance keeps you current.

16. Contacting the Publisher

Questions or objections about this policy, or about how your data is handled, may be addressed to:

Registered entity: Hong Kong Kai Yi Long Technology Co., Limited

Registered office: Rm 903A, 9/F, Cameron Commercial Centre, 458-468 Hennessy Road, Causeway Bay, Hong Kong

Email: clairepierce1958@gmail.com