Yönetmen · effective 6 August 2026
Nothing you shoot stays with us. You sign in with Apple or Google; we hold no password. Our server verifies the sign-in proof without storing it. Your film, your photos and your notes live only on your phone, encrypted.
Signing in is only possible with Sign in with Apple or Sign in with Google. There is no other method, no email/password, no guest mode.
| what | from where | where it stays |
|---|---|---|
| The user ID issued by the provider | Apple / Google | on your device only, encrypted in secure storage |
| Name | if the provider shares it | on your device only |
| if the provider shares it | on your device only | |
| Identity token (JWT) | at sign-in | temporary server signature verification; not stored or logged |
| Device-bound access token | server sign-in verification | 30 days; only in device secure storage, deleted on sign-out |
On Apple's side you can choose "Hide My Email"; the app works in full either way. On Google's side the email is kept only when the provider reports it as verified.
The sign-in proof temporarily reaches our server so its signature, application identity and sign-in nonce can be verified. It is not stored or logged; no server record is created for your name or email. We keep no profile record containing your name, email address or raw provider user ID. Later requests use a separate device-bound access token. When you sign out, the local sign-in record is deleted; your film, your cast and your scenes stay where they are.
Your films and cast photos are not stored on our server. Our server never sees the video and photo bytes: the file goes from your device directly to the production provider; we only broker the signed address. Messages you send to our Instagram account are recorded separately for automated replies, as described below.
To manage production and purchases securely, the server stores a random device identifier, transaction and receipt records, and production job identifiers. The device identifier is also used for daily usage limits and rule enforcement. These records do not contain your name, phone number, or advertising identifier. The transaction ledger that prevents a receipt from being used twice is kept for 10 years for payment disputes and replay protection.
If you accept a gift code, we separately ask whether the video produced with that code may be reshared on Yönetmen’s social accounts. If you agree, the server keeps the gift-code state, the consent-text version, acceptance time and an HMAC-derived account summary that does not reveal your account. Your name, email address and the raw Apple/Google user ID are not written to this record. We keep it to enforce one-time code use and to prove which account gave that consent.
You may ask us to remove the reshare or exercise your rights concerning this consent record at mail@yonetmen.app. Withdrawing consent does not affect processing that was lawful before the withdrawal.
Only when you invite someone to a joint scene or accept an invite, and only for the life of that invite, we temporarily keep on our server: the name added to the invite, the short character note chosen, the temporary addresses of the frames at the provider, and (if you allowed notifications) a notification token. These are kept for at most 24 hours and then deleted — sooner once the invite is completed or cancelled. This data lives on Supabase (EU, Frankfurt), together with our purchase ledger. If you never use joint scenes, none of this is created.
If you permit notifications, we temporarily keep a notification token with the production job record to tell you when a scene is ready. iPhone messages are delivered through Apple APNs and Android messages through Google FCM. Job records are cleaned up after completion or expiry.
An expired job record and its notification token are deleted in the next five-minute cleanup. Delivery diagnostics that contain no content are deleted after 30 days.
When you message the Yönetmen Instagram account, the sender account ID, message text, bot reply and related webhook event are recorded in Supabase to operate automated replies. Message text is sent to Anthropic to prepare a reply. Messages, webhook events and the deduplication records that prevent replying twice to the same event are deleted after 90 days by a daily automatic cleanup. You may request deletion through our support address.
We use a small number of providers to run the app. Our Supabase project is hosted in the EU/Frankfurt region; other providers may process data in different regions. Your use of those services may involve a cross-border transfer:
| provider | for what |
|---|---|
| fal.ai (USA) | scene/video production — frames go directly there |
| Vercel | running API requests; photo and video bytes do not pass through this API |
| Supabase (EU/Frankfurt) | job, purchase, invite and Instagram message records |
| Apple APNs | notification token (only if you allowed notifications) |
| Google FCM | Android notification token (only if you allowed notifications) |
| Anthropic (USA) | members-only custom scene text and Instagram bot messages (no face/photo) |
| Resend | forwarding your email to us when you write to support |
Scenes are produced on fal.ai infrastructure. This necessary processing step happens within these limits:
| what | how long it stays |
|---|---|
| The image/video you upload | at most 8 hours — served with a short-lived header |
| The produced scene | queued for deletion after device download; an eight-hour media lifetime is also requested from the provider |
| Video request and response payload | at most 8 hours for quality review; a verified deletion queue removes it when due |
Productions involving pornography, violence, murder, terrorism, gambling, illegal drugs or child abuse are not permitted. When the provider reports such content you are warned; on the third report your device can no longer produce. The only things kept in that case are a device identifier and a counter — your prompt, your file and your footage are not kept.
None. No third-party analytics, no ad network, no cross-site tracking.
The app is not designed for children under 13. When you add someone else to your film — including your own child — obtaining their consent, or their guardian's, is your responsibility; the app asks you this explicitly.
Deleting the app removes film and cast files on your device. To request deletion of production, purchase, invite or Instagram message records, write to mail@yonetmen.app. Files sent to the provider are processed separately on its infrastructure.
To remove just the sign-in record, Settings → Your account → Sign out inside the app is enough. You can also revoke access at the source: on Apple, Settings → Apple Account → Sign-In & Security → Sign in with Apple; on Google, the Connected apps section of your account security page.
For questions: mail@yonetmen.app