Privacy Policy

Effective date: October 6, 2026 · Last updated: October 6, 2026

This Privacy Policy explains how Upcraft ("Upcraft", "we", "us") collects, uses, shares and protects information when you use the Upcraft iOS app and the website at upcraft.art (together, the "Service"). Upcraft is a free AI toolbox for video creators. Its first tools generate thumbnails and analyze the visual style of your YouTube channel.

The short version. You don't create an account with a password. We use an anonymous ID to keep your work together. If you connect YouTube, we read only public channel and video information, with read-only access, and we delete it within 30 days unless it's refreshed. Photos you upload and prompts you write are sent to our AI providers only to make or analyze your thumbnails. We don't sell your personal information. Meta advertising measurement uses your device's advertising identifier only if you allow tracking.

1. Information we collect

Information created automatically when you use the app

Anonymous account ID. On first launch we create an anonymous Firebase Authentication ID. It isn't tied to your name, email or phone number.
Device identifier for fair use. We generate a random identifier and store it in your device's secure keychain. We use it only to enforce the free daily limits, so the Service stays free for everyone. It isn't your Apple advertising identifier.
App and crash diagnostics. Crash reports, performance data and app usage events (for example "thumbnail generated" or "style analyzed") from Firebase Crashlytics and Google Analytics for Firebase. These include device model, OS version, app version, and approximate country derived from IP address.
Push notification token. If you allow notifications, we store a Firebase Cloud Messaging token so we can tell you when a thumbnail is ready.

Information you give us

Preferences. Your content niche (for example gaming or finance) and whether you make long-form videos, Shorts or both.
Thumbnail requests. The video titles, topics, hooks, on-image text and instructions you type.
Photos you upload. Up to three selfies for thumbnails that feature you, plus any product or object photos you add to a request or upload for grading.
Generated images. The thumbnails the Service creates for you, and their edits.
Support messages. Anything you send us by email.

Information from YouTube (only if you connect a channel)

See YouTube API Services below.

2. YouTube API Services

Upcraft uses YouTube API Services to let you connect your channel. By connecting a channel you agree to be bound by the YouTube Terms of Service. Your information is also subject to the Google Privacy Policy.

There are two ways to connect:

Sign in with Google. We request a single read-only permission, youtube.readonly. The app uses it on your device to read your channel's public details. We can't upload, edit, delete or comment on anything, and we don't use Google sign-in as your Upcraft login. Your Google access token stays on your device and is never sent to our servers.
Enter a @handle. We look up the channel's public information using our own YouTube API key. No Google sign-in is involved.

YouTube data we access: channel name, handle, profile picture, subscriber and video counts, and, for your most recent public videos (up to 50), the titles, publish dates, durations, view/like/comment counts and thumbnail images.

How we use it: only to show your channel in the app, to analyze the visual style of your thumbnails ("Style DNA"), to highlight videos that performed above your channel's median, and to use your own thumbnails as style references when you generate new ones. Style insights are produced by AI and labeled in the app as Upcraft insights, not YouTube data.

Storage and refresh: we store this YouTube data for no more than 30 days. Before that, it's either refreshed (when you open the app) or deleted automatically, together with the style analysis based on it. You can disconnect your channel at any time in Settings → YouTube channel → Disconnect, which deletes it right away.

Revoking access: if you signed in with Google, you can revoke Upcraft's access at any time on the Google security settings page. If you ask us to delete your data, we delete stored YouTube data within 7 days.

We don't sell YouTube data, use it for advertising, or share it with anyone except the service providers described below who help run the analysis.

3. How we use information

To provide the Service: generating, refining, storing and showing your thumbnails, and analyzing channel style.
To enforce fair-use limits and prevent abuse, fraud and automated access (including through Firebase App Check and Apple App Attest).
To send you notifications you've allowed, such as "your thumbnail is ready".
To understand usage in aggregate, fix crashes and improve the app.
To measure how our advertising performs, with your permission (see Analytics, ads and tracking).
To respond to support requests and meet legal obligations.

Where the GDPR or UK GDPR applies, our legal bases are: performance of our contract with you (providing the Service), our legitimate interests (security, abuse prevention, product improvement), and your consent (AI processing of photos, advertising tracking, notifications). You can withdraw consent at any time.

4. AI processing

Upcraft uses third-party AI services. Before anything is sent, the app asks for your consent and names these providers:

fal.ai (Features & Labels, Inc.) hosts the models we call.
OpenAI image models (GPT Image) generate and edit thumbnails through fal.ai.
Anthropic (Claude) and Google (Gemini) models, accessed through fal.ai, analyze thumbnails, suggest on-image text and write image prompts.

What's sent: your request text, your style profile, and the images needed for that request (for example your selfies, a product photo, your channel's public thumbnails or an image you asked us to grade). These are sent only to fulfill your request. We don't use your photos or prompts to train AI models, and we use these providers under terms that restrict how they use the data. Temporary copies of uploaded inputs on fal.ai are set to expire after about one hour.

AI output can be inaccurate. Style analysis and grades are suggestions, not guarantees of performance.

We share information only with service providers who process it for us:

Provider	What for	Data involved
Google Firebase (Google LLC)	Anonymous sign-in, database, file storage, cloud functions, App Check, Crashlytics, Analytics, Cloud Messaging	Anonymous ID, device identifier, preferences, uploads, generated images, diagnostics, push token
fal.ai and the model providers above	AI generation and analysis	Request text, style profile, images for the request
Google / YouTube	YouTube API Services	Channel lookup requests
Meta Platforms, Inc.	Measuring app installs and advertising (Meta SDK)	App events, and the advertising identifier only with your permission
Apple	App distribution, App Attest, push delivery	As described in Apple's privacy policy

We may also disclose information if the law requires it, to protect the rights, safety and security of our users or the Service, or as part of a merger or acquisition (and this policy would continue to apply). We don't sell your personal information or "share" it for cross-context behavioral advertising, except Meta advertising measurement when you allow tracking.

6. Analytics, ads and tracking

The app includes the Meta (Facebook) SDK, which logs app events such as installs, app opens, finishing onboarding and generating a thumbnail. This lets us measure whether our ads on Meta platforms lead to installs.

On iOS we ask for permission through Apple's App Tracking Transparency prompt. Only if you tap "Allow" may your device's advertising identifier (IDFA) be shared with Meta to attribute installs and measure ad performance.
If you choose "Ask App Not to Track", we tell the Meta SDK that tracking isn't allowed and the IDFA isn't collected. Meta may still receive limited, non-identifying events for aggregated measurement, as Apple allows.
You can change your choice at any time in iOS Settings → Privacy & Security → Tracking.

Google Analytics for Firebase is configured without access to the advertising identifier.

7. How long we keep information

YouTube data and the style analysis based on it: up to 30 days, then refreshed or deleted.
Selfies and uploaded photos: until you remove them in the app or delete your data.
Generated thumbnails and request history: until you delete them or your data. Inactive anonymous accounts may be deleted after 12 months.
Usage counters for daily limits: up to 90 days.
Crash and analytics data: according to Firebase retention settings (up to 14 months for Analytics, 90 days for Crashlytics).
Support emails: as long as needed to resolve your request, then up to 2 years.

8. Your choices and deleting your data

Delete everything: in the app go to Settings → Delete my data. This permanently deletes your anonymous account, preferences, uploads, generated thumbnails, style analysis and stored YouTube data. Most data is removed immediately, and everything (including backups) within 30 days. YouTube data is always gone within 7 days. More at upcraft.art/delete-data.
Disconnect YouTube: Settings → YouTube channel → Disconnect, and revoke Google access on the Google permissions page.
Remove selfies: Settings → Your photos.
Notifications and tracking: change these in iOS Settings at any time.
Email: or write to privacy@upcraft.art. Tell us the support code shown in Settings so we can find your anonymous account.

9. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, to object to or restrict certain processing, and to withdraw consent.

EEA/UK (GDPR): you can also complain to your local data protection authority.
California (CCPA/CPRA) and other US states: you have the right to know, delete and correct, to opt out of "sale" or "sharing" (we don't sell; turning off tracking in iOS opts you out of Meta ad measurement), to limit use of sensitive information, and not to be discriminated against for using these rights.

To use any of these rights, email privacy@upcraft.art. We'll respond within the time the law requires (usually 30 days for GDPR and 45 days for CCPA). Because accounts are anonymous, we may ask for your in-app support code to confirm the request is yours.

10. Children

The Service is meant for creators aged 13 and older (or the minimum age of digital consent where you live) and isn't directed to children under 13. The App Store age rating describes the app's content; it doesn't mean the Service is designed for children. We don't knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we'll delete it.

11. Security

Data is encrypted in transit (TLS) and at rest on Google Cloud. Access is restricted by security rules so you can only read your own data. Our servers accept requests only from genuine copies of the app (Firebase App Check with Apple App Attest), and API keys for our AI and YouTube providers are kept on our servers, never in the app. No system is perfectly secure, but we work to protect your information and will notify you of a breach where the law requires it.

12. International transfers

We and our providers process data in the United States and other countries. Where required, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

13. Changes to this policy

We may update this policy. If the changes are significant, we'll let you know in the app or on this page before they take effect. The "Last updated" date shows when it last changed.

14. Contact us

Upcraft
Privacy: privacy@upcraft.art
Support: support@upcraft.art