← Fondly

Privacy Policy

Effective date: October 21, 2026

This policy explains what the Fondly Android app (“the app”) and its server collect, why, and how long we keep it. The app is made by [DEVELOPER NAME] (“we”, “us”). We are responsible for your data (the “controller” under EU and UK data protection law). Questions? Email [SUPPORT EMAIL].

1. What we collect

• Account ID. When you first open the app, our server creates an account for you with a random ID (shown as “Your ID” at the bottom of the app’s home screen). The app gets a secret sign-in key and keeps it in secure storage on your phone. Our server stores only a one-way code (hash) of that key and when it was created and last used. We do not use your phone’s device ID, Android ID or advertising ID. Your account ID is not linked to your name, email or Google account unless you choose to save your credits with Google (see below). It lets our server know which photos, results and credits are yours.
• Google account (optional). Only if you tap “Save with Google” in the app. Google confirms your sign-in, and we then keep your Google account ID, email address and name with your account. We use them only to keep your credits after a reinstall or on a new phone. If that Google account is already saved from another install, the credits on this phone are moved to it.
• Photos you upload. Only the photo you choose in Android’s photo picker. The app cannot see the rest of your photos. Before upload, the app resizes the photo and saves it as a new JPEG file, which leaves out hidden file data such as camera or location tags. Photos are stored on our server.
• AI results. The restored or colorized images and the short videos made from your photos, stored on our server.
• Job records. For each request: the type (restore, colorize or video), its status, the time, the credits charged, whether it was your free restore, the time you confirmed you have the right to use the photo, and technical details (AI model used, processing time and AI cost).
• Credits. Your credit balance, whether you have used your free restore, and a history of credit changes (spent, refunded, bought, moved between installs, taken back after a Google Play refund).
• Purchase records. The product you bought, the number of credits, the Google Play order ID, whether it was a test purchase, and the time. We send the purchase token to Google Play to check that the purchase is real, and we store only a one-way code (hash) of the token so the same purchase is never credited twice. Google Play also tells our server when a purchase was refunded.
• Reports. If you report a result: your account ID, the job ID, the reason you chose (“Offensive or harmful” or “Looks wrong”) and the time.
• App usage events. The app sends a few usage events to our own server: first app open, restore started and done, paywall viewed, purchase (product, price, currency and Google Play order ID), video started and done, share (image, video or before/after, and the job ID) and report (the reason). Each event is stored with your account ID and the time. We do not use Google Analytics or any other analytics, advertising or crash reporting service. Events contain no device model, location or advertising ID.
• Technical data. Like any internet service, our server receives your IP address and basic technical details of each request (time, address requested and app information sent by your phone) when the app connects. Our server keeps short technical logs (for example IP address, account ID, job ID and errors) to fix problems and keep the service secure.
• Sign-up checks. When the app creates your account, Google Play Integrity checks that the request comes from the real Fondly app from Google Play on a genuine Android device. We use the result only to allow or refuse the sign-up, and we do not store it. To stop mass sign-ups, we also store a one-way code (hash) of your IP address for 1 day.

We do not collect: your name or email address (unless you choose Google sign-in), phone number, contacts, device ID, advertising ID, location, camera, microphone, or any photos other than the ones you pick.

2. How we use it

• To restore, colorize and animate the photos you choose, and to show you the results.
• To keep track of your credits, your free restore, purchases and refunds. If a job fails, your credit is refunded automatically. If Google Play refunds a purchase, we take that pack’s credits back (as many as are left).
• If you choose Google sign-in: to keep your credits after a reinstall or on a new phone. We do not use your Google account for anything else, and we never email you.
• To prevent abuse and fraud and keep the service secure (Play Integrity check and a sign-up limit per IP address, one free restore per account, a daily limit on free restores).
• To review reports of harmful or wrong results, as Google Play’s rules for AI-generated content require.
• To understand how the app is used (for example, how many people finish a restore) and to improve it, using the usage events above.
• To meet legal, tax and accounting duties.

We do not look at your photos or results, except to check a result you reported or when you ask us for help with a specific job. We do not use your photos to identify people or to create face templates.

Legal bases (EEA and UK): providing the service you ask for, including credits, purchases and optional Google sign-in (contract); security, abuse prevention, handling reports, usage events and improving the app (our legitimate interests; you can object); and keeping tax and accounting records (legal obligation).

3. AI processing by Google

• Our server sends your photo to Google’s Gemini API together with fixed instructions (for example, “restore this photo and keep every face the same”). Google sends back the result.
• Google acts as our service provider. We turn off the Gemini API’s option to store requests, so Google does not keep them for later use. Under Google’s paid API terms, Google does not use your photos or results to train or improve its models. Google may keep them for a limited time only to detect abuse and to meet legal duties.
• Google’s AI may refuse some photos, for example photos of children in the EU, UK or Switzerland, or photos it sees as sensitive. When that happens, or when a job fails for any other reason, your credit is refunded automatically.
• All images and videos made by Google’s AI carry SynthID, an invisible digital watermark that shows they were made with AI. Videos normally also carry a small visible “Made with Fondly” tag in the corner.

4. Your right to use each photo

Before you can process a photo, you tick “I have the right to use this photo”. We save the time you ticked it with the job record. Only upload photos that you own or have permission to use. Do not upload photos of other people unless you have the right to do so.

5. Who we share data with

We run the app’s server ourselves. These companies process data on our behalf:

• [HOSTING PROVIDER]: rents us the server in [SERVER LOCATION] that stores our database, your photos and results. They provide the machine and network only and do not use your data for their own purposes.
• Google Gemini API (paid tier): AI processing of your photos (see section 3).
• Google Play Integrity: checks that new accounts come from the real app (see section 1).
• Google Sign-In (optional): confirms your Google account when you choose to save your credits with Google.

Payments are handled by Google Play Billing under Google’s own privacy policy. We never see your card or bank details. We only receive the purchase details listed in section 1.

We may also share data if the law requires it, to protect our users or the service, or with a buyer if the app is sold (who must then follow this policy).

No ads, no selling. The app shows no ads. We do not sell your personal information, and we do not share it for targeted or cross-context advertising.

Learn more in Google’s Privacy Policy and how Google uses data from apps that use its services.

6. Where your data is stored

Our database, photos and results are stored on our own server, rented from [HOSTING PROVIDER] in [SERVER LOCATION]. To make your results, your photo is sent to Google’s Gemini API, which may process it in other countries where Google has facilities, including the United States. Google Play Billing, Play Integrity and Google Sign-In are also run by Google. If you live in the EEA, the UK or Switzerland, transfers to Google are protected by Google’s data processing terms, which include the EU Standard Contractual Clauses, and by Google’s certification under the EU-U.S. Data Privacy Framework.

7. How long we keep data

• Uploaded photos, AI results and job records: deleted automatically after 7 days. Cleanup runs once a day, so items are gone within a day after the 7 days have passed.
• Copies on your phone: the app keeps a temporary copy of results in its cache, which is removed when you uninstall. Copies you save to your gallery or share stay where you put them; we cannot delete those.
• Account ID, sign-in key hashes, credit balance and credit history: kept until you delete your account (we cannot tell when an account is no longer used).
• Google account details (optional sign-in): kept until you delete your account.
• App usage events: deleted automatically after 60 days.
• IP address hash for the sign-up limit: deleted automatically after 1 day.
• Purchase records: as long as needed for accounting, tax, refunds and other legal duties.
• Reports: kept until you delete your account.
• Server logs: up to 30 days.
• Backups: our database (not photos or results) is backed up every day, and each backup is kept for 14 days. Data you delete can stay in these backups until they are removed.

8. How to delete your data

• In the app (fastest): on the home screen, tap your credits at the top to open Your credits, then tap Delete my account and data at the bottom and confirm. This deletes right away your photos, results, job records, credit balance, credit history, reports, usage events and your account, including your sign-in keys and the link to your Google account if you made one. Older accounts from this phone whose credits were moved into this one are deleted too. Unused credits cannot be restored. Purchase records are kept for accounting, no longer linked to your account (see below).
• Photos and results: you do not need to do anything. They are deleted automatically after 7 days.
• Without the app: email [SUPPORT EMAIL] with the subject “Delete my data”. Unless you saved your credits with Google, we do not know your name or email, so please include something that lets us find your data: your account ID (shown as “Your ID” at the bottom of the app’s home screen; press and hold to copy it), the email of your Google account if you saved your credits with Google, or the Google Play order ID of a purchase (in your Google Play receipt email, or in the Play Store app under Profile → Payments & subscriptions → Budget & history).
• We will delete your photos, results, job records, credit balance, credit history, reports, usage events and account within 30 days. We keep purchase records only as long as the law requires. Deleting your data also removes any unused credits, and they cannot be restored.
• Usage events are linked to your account ID, so they are deleted with your account. Otherwise they are deleted automatically after 60 days.
• Deleted data is also gone from our database backups within 14 days.
• Uninstalling the app stops all data collection. Your sign-in key is kept only on your phone, so after uninstalling you may not be able to get back to your old account or its unused credits, unless you saved them with Google first. Data already on our server is deleted as described above.

9. Your rights

Depending on where you live (for example under the GDPR in the EEA, the UK GDPR, or the CCPA in California), you may have the right to:

• access the data we hold about you and get a copy of it;
• correct it;
• delete it;
• object to or restrict how we use it (for example, usage events);
• receive it in a portable format;
• not be treated differently for using these rights.

You can delete your account and data yourself in the app (see How to delete your data). To use any of these rights, email us at [SUPPORT EMAIL]. Include your account ID (shown as “Your ID” at the bottom of the app’s home screen), or a Google Play order ID, so we can find your data (see How to delete your data). Or simply wait 7 days: your photos and results are then deleted automatically. We reply within 30 days. You can also complain to your local data protection authority.

California residents: in the terms of the CCPA, we collect identifiers (account ID, IP address, and with optional Google sign-in your name, email address and Google account ID), commercial information (purchases), app activity (usage events and job records) and the photos you upload, for the purposes in section 2. We do not sell or share personal information.

10. Children

The app is for adults (18 and over). It is not directed to anyone under 18, and we do not knowingly collect data from them. If you believe a minor has used the app, email us and we will delete the data. Old family photos often show children: only upload them if you have the right to.

11. Security

• All connections use HTTPS, so data is encrypted on the way.
• Your photos, results and credits can only be reached with your account’s sign-in key, and we store only a hash of each key. Links to your photos and results are signed and stop working within 7 hours. Only our server can change credits or write results.
• The database cannot be reached from the internet; only our server software uses it.
• The AI key and our Google service keys are kept on our server, never in the app.
• Google Play Integrity blocks sign-ups that do not come from the real app.

No system is perfectly secure, but we work hard to protect your data.

12. Changes to this policy

We may update this policy. We will post the new version on this page and change the effective date at the top. If a change is important, we will also mention it in the app’s release notes on Google Play.

13. Contact

[DEVELOPER NAME]
Email: [SUPPORT EMAIL]