ViralMotion Privacy Policy

Last updated: 12 September 2026

ViralMotion ("we", "us") is operated by Erdem Yıldırım under the ERDOVA brand. This policy explains what we collect when you use the ViralMotion mobile app, why, who else sees it, and how to get rid of it.

1. What we collect

Your account. If you sign up with email we store your email address and a hashed password. If you continue as a guest we create an account identified by a random account id. Our service providers also process technical connection data needed to provide and secure the service, such as IP addresses and request logs.

Your profile. A display name and avatar if you set one, your credit balance, your subscription status, your referral code, and a per-day counter of how many videos you have generated.

The photos you upload. Stored privately, in a bucket where each file sits under your own user id. They are never public. The app reaches them only through links that expire after one hour.

The videos we generate for you, and a thumbnail image of each one. Same private storage, same expiring links.

Optional text you type. Effects work without it; if you add a description, we store it with the generation.

Your credit ledger. Every credit added, spent and refunded, with a timestamp and a reason. This is how we can show you where your money went, and it is the record we use to resolve a billing dispute.

Diagnostics. Crash reports and a fixed list of product events — which screen you opened, which effect you chose, whether a generation succeeded. Photos, prompts and file links are stripped before anything leaves your device.

We do not collect your contacts, your location, your browsing history, or your device's advertising identifier. We do not use tracking for advertising and we do not sell or share personal information for advertising purposes.

2. Why we collect it

To create the video you asked for. This is the whole product, and it requires sending your photo to our AI provider.
To run the credit system, so you are charged once and refunded when a render fails.
To keep your videos available to you across sessions and devices.
To stop abuse — the per-day counter and the spend ceiling exist so one account cannot exhaust the service or our budget.
To fix crashes and understand which parts of the app do not work.

The legal basis, where the GDPR applies, is performance of our contract with you for everything needed to deliver a video, and our legitimate interest in a working, non-abused service for diagnostics.

3. Who else sees your data

Supabase — our database, storage and authentication. Receives everything: your account, profile, photos, videos and ledger. Hosted in the EU (Frankfurt).
Replicate — runs the AI model that generates your video. Receives your uploaded photo and the effect's prompt, as links that expire in one hour.
RevenueCat — manages subscriptions and validates receipts. Receives your account id and your purchase events.
Sightengine — checks uploaded photos for sexual content and indicators that a depicted person may be a minor. Receives the private, time-limited image links needed to perform that check.
Google Play — processes the payment. Google receives your payment details; we never see your card.
PostHog — analytics. Receives product events tied to your account id. No photos, prompts or file links.
Sentry — error tracking. Receives crash reports tied to your account id, with photos, prompts and links stripped out first.

We do not sell your personal information. We do not share it with anyone else except where the law requires it.

4. How long we keep it

Your photos, videos and account data stay until you delete them. Delete a single video in the app and the file is removed from storage. Delete your account and the content and ordinary account records described below are removed.

Diagnostic data is retained for troubleshooting and security under the retention settings of the relevant service provider. You can contact us to request deletion of diagnostic data linked to your account, subject to the limited exceptions below.

We may keep a minimal purchase record after account deletion when tax and accounting law requires it. We also retain the store transaction id, former internal account id, product id, purchase start time and number of credited installments needed to prevent the same payment from being replayed by another account. This anti-fraud record does not contain your photos, videos, email, profile or payment-card details.

5. Deleting your account

In the app, use Settings → Delete account. Once the request completes, your account, profile, uploaded photos, generated videos, thumbnails and ordinary generation history are deleted. If processing or storage cleanup is still pending, the service may need to finish that cleanup before deletion is complete.

You can also request deletion without installing or signing in to the app: email erdovasuupport@hotmail.com with the subject ViralMotion account deletion from the email address associated with your account. We verify ownership before deleting data. Do not send your password or payment-card details. We respond within 30 days and explain any data that must be retained under section 4.

Deleting your account removes access to unused credits. It does not automatically cancel a Google Play subscription; cancel that subscription in Google Play as well. Store refund policies and mandatory consumer rights still apply.

6. Your rights

Depending on where you live you may have the right to access, correct, export or delete your data, to object to or restrict processing, and to complain to a data protection authority.

Deletion is built into the app. For anything else, write to erdovasuupport@hotmail.com and we will respond within 30 days.

If you are in California, we do not sell or share personal information as those terms are defined by the CCPA, and we do not discriminate against you for exercising your rights.

7. Children

ViralMotion is intended for adults aged 18 and over. We do not knowingly collect children's data or allow photos of minors to be animated. If you believe a child has used ViralMotion, or that a photo of a child has been uploaded, write to erdovasuupport@hotmail.com and we will delete the account and the content.

8. Security

Your photos and videos are in private storage, reachable only through links that expire in an hour. Access rules are enforced by the database itself: a request cannot name a file outside its own account's folder and have it succeed. Payment details never reach our servers.

No system is perfectly secure, and we will not pretend otherwise. If we discover a breach affecting your data we will notify you and the relevant authority as the law requires.

9. Changes

If we change this policy materially we will tell you in the app before the change takes effect. The date at the top always reflects the current version.