Living Pages — privacy notice

Version 2026-10-17-v9 · 17 October 2026. Adult accounts are available through email, Google or Apple. Generation requires an eligible account and sufficient credits. A signed-in account keeps its Gallery privately backed up and restored automatically; platform store purchases remain enabled separately by platform and territory. This notice covers the current Android and native iOS apps. Older builds through Android 0.10.0 used Sites, which retains earlier cloud copies; installing an update does not delete them.

Who is responsible

Georgi Kostov, trading as Studio Kostov, Breitwiesenstraße 22, Tür 7, 4481 Asten, Austria, is responsible for the Living Pages service. Contact privacy@studiokostov.com. Further operator details are in the legal notice.

What stays on the phone

Camera frames used for scanning, cropping and local image tracking stay on your device. No account or age question precedes these local actions, and confirming a crop does not approve an upload. We do not stream your camera to our servers. The working Gallery is stored on the device and there is no public feed. Signed-out local drawings are not uploaded and may be lost if app data is deleted, the app is uninstalled or the device is lost or broken. Automatic Android app-data backup and device transfer remain excluded by app configuration.

After an adult signs in and accepts this version, Living Pages automatically reconciles that account's Gallery: it uploads eligible saved drawing references, videos, titles and their associations, and downloads missing completed pairs for the same account. New generated pairs are retained as part of generation completion. Transfers retry after interruption without a manual backup or restore button. The service stores checksums, byte sizes, media dimensions/duration and opaque object keys to verify and manage those files. Sync does not upload the live camera stream, unrelated photos or the rest of the device library, and it does not make Gallery items public. Local entries already bound to a different account are not reassigned to the current account.

You can export, share and import portable Gallery ZIP files containing the pictures, videos, titles and associations included in the archive. They contain no credit balance or account credentials. Anyone with a ZIP can read its contents, so keep it private and share only where you have the necessary rights. Import rebuilds local tracking information and cannot restore files that were not included in the archive. Signed-out imports stay on the device. After sign-in and acceptance of the current terms, imported items follow that account's Gallery backup rules, including supported completed files and available storage. Items already associated with another account are not uploaded into a different account. A drawing/video pair previously deleted from your account backup is not backed up again if you re-import it; that imported copy stays on the device. Gallery files are not included in automatic Android app-data backup or device-to-device transfer.

The age and terms agreement made before account creation or purchase is remembered locally; it does not create a child profile or collect an age or date of birth. That limited agreement does not create server acceptance of artwork-upload or AI-processing declarations. Before any artwork upload, the full agreement records those declarations and the displayed terms version. Gallery sync waits for that full acceptance. Gallery titles are stored locally, in portable archives you export and any copies you share, and, for items backed up to your account, in its private Gallery. They are not sent to the AI model as generation prompts.

Accounts, sign-in and purchases

You can sign in with email and a password, Google, or Apple. Supabase handles authentication and stores your account identifier, email address, verified login methods, session records and provider profile information supplied during sign-in. Passwords are handled by the authentication service, not stored in readable form by Living Pages. Google and Apple handle their own sign-in under their privacy notices; we do not receive their account passwords. Apple may supply a private relay address if you choose Hide My Email. Resend delivers account confirmation, password recovery and account-security messages.

The app stores session credentials using Android Keystore protection or the iOS Keychain. Our service associates your verified login with an account ID, credit balance, acceptance history and service records. Signing into the same account automatically makes its completed Gallery copies available to the device. You can explicitly link an additional login method from Account and credits. We do not use sign-in to create child profiles or import your contacts.

Legacy private wallets use a random identifier and hashed access/recovery secrets. A wallet can be linked to your account only with its access secret. Its server balance and service history then belong to the linked account; the old wallet credentials are revoked. New legacy wallet registration is disabled.

Where store purchasing is enabled, RevenueCat receives your service account ID, receipt/purchase records and technical connection/app/device information needed to verify purchases. RevenueCat also processes purchase history for customer-history records and purchase analytics in its dashboard, such as sales charts. This processing is linked to the service account; it is not cross-app advertising tracking. Apple or Google handles store checkout and payment details. We do not send drawings, backed-up media, passwords or account session credentials to RevenueCat. Optional SDK diagnostics and automatic device-identifier collection are disabled, and the app does not set advertising-attribution, email or telephone attributes. The store shows the pack and price before purchase confirmation.

Settings → Account and credits → Delete account closes service access, revokes service sessions and queues a deletion request, including deletion of the account Gallery copy. You can also request deletion without the app at Delete your account. The operator completes account and supplier erasure and confirms the outcome, normally within one month. Closing access is not a claim of immediate supplier erasure or automatic Apple authorization revocation. We explain any legally required retention. Local drawings, portable backups and independently held Apple/Google records are not erased by closing the account.

Parents and children's drawings

Living Pages accounts, uploads, generation and purchases are operated by adults, including parents or guardians animating their children's original drawings. Scanning and cropping happen locally before the age and agreement action. An adult reviews the selected crop and approves cloud processing before any upload. Children can create on paper and watch a result the adult has reviewed. We do not offer child accounts, profiles, chat or a public feed, and do not ask for a child's name, age, school or photograph.

Before scanning, cover names, signatures, school labels and personal details; keep people and personal photographs out of the crop. Choose imaginary subjects without sensitive or identifying details. The app does not automatically redact them. A drawing can still identify or reveal information about someone, including through its contents or its connection with other records. A child's artwork is not automatically anonymous just because it is a drawing.

The adult's contract and rights declaration do not automatically establish a legal basis for every child's or third party's personal data. We restrict inputs to minimise this information; sensitive or identifying child content and classroom collections are outside the intended service. If you think personal information or a child's independent use has reached the service, contact privacy@studiokostov.com without attaching the drawing by default. We investigate, restrict inappropriate access and handle deletion and any lawful retention as required. This notice does not claim that an adult declaration removes children's privacy obligations.

What is sent when you request an animation

After you review a crop and explicitly choose generation, the selected still picture travels over an encrypted connection to our Vercel API and the AI providers shown in the upload notice. We send the picture with a short motion instruction to generate an animation. We do not send the surrounding camera stream or unrelated Gallery items. For a signed-in account that accepted this version, the selected reference and validated result are retained in the private account Gallery before the generation is reported ready. A signed-out local-only drawing is not backed up.

The current apps and API use only direct fal H3 video generation. There is no separate image-analysis request. Earlier comparison builds offered OpenAI or fal MoonDream analysis; removing those routes does not erase data already processed under the earlier notices. A future change of provider requires an updated notice and permission where applicable.

Service records and purposes

We do not sell personal information or operate advertising, tracking analytics or session replay in the production design. We do not train our own models on scans. Any claim about provider training is limited to the applicable contractual coverage for the exact endpoints.

A picture can contain someone else's personal data. Your contract does not automatically provide a legal basis for processing another person's data, and you cannot give consent on behalf of every person pictured. The permitted-input rules therefore restrict what may be uploaded. Sensitive documents and sensitive personal content are not supported. A photograph is not automatically biometric identification data; Living Pages does not identify people or infer sensitive traits for tracking.

Providers and international transfers

Vercel hosts the API with a Frankfurt function region. Supabase hosts account authentication and service metadata in Frankfurt. Cloudflare R2 stores encrypted-in-transit private Gallery objects and issues short-lived signed transfer URLs; the bucket is not public. Resend delivers transactional account email. Google and Apple supply the sign-in methods you choose. Neon retains the website waitlist and historical personal-preview records; it no longer handles new app sign-ins. fal supplies H3 video inference. The current service does not send new crops to OpenAI or MoonDream; earlier comparison requests may have used them as described above. RevenueCat provides purchase verification and purchase-history analytics when enabled; Google and Apple process their respective store payments. Studio Kostov's email provider processes email you send to support.

Android AR uses Google Play Services for AR (ARCore), which processes information under Google's privacy policy. The service uses local image tracking, not Cloud Anchors or Geospatial features. Local tracking does not mean Google receives no service/device information. The app's Privacy screen discloses ARCore and links to Google's policy.

An EU hosting region does not mean every provider's support, security or inference processing stays within the EU. International processing must be covered by applicable adequacy decisions or contractual safeguards, including the relevant Standard Contractual Clauses where required. Copies of the relevant safeguards can be requested from privacy@studiokostov.com, with confidential information protected.

Retention

The service applies the following retention controls. Retention inside each provider follows that provider's terms; we cannot independently verify every provider-internal copy.

AI providers may retain some security, billing or legally required information separately. Those exceptions follow the applicable provider agreements. We cannot promise that third parties keep no information at all.

Your choices and rights

You may use available signed-out local features without account Gallery upload. Once you sign in and accept this version, eligible Gallery items for that account sync automatically; signing out stops transfers from that device but does not erase the server recovery copy. The confirmation in your app explains whether you are removing a local copy or deleting an item from your account backup. In versions that support account Gallery deletion, the request is sent when the device is online and the app retries interrupted requests during later syncs. Other devices signed in to the same account with a supporting app version apply the deletion when they next sync; older versions may retain local copies. A local-only removal made in an older version is not converted into an account deletion. Deletion does not affect exported ZIPs, copies you have shared, or copies saved outside Living Pages; delete the copies you control separately. A drawing/video pair previously deleted from your account backup is not backed up again if you re-import it; that imported copy stays on the device. You can request deletion of specific copies we hold, or close your account, through the privacy-request process.

Before the first upload under a terms version, one explicit agreement action confirms adulthood, terms and privacy, artwork permission and AI processing. Opening the camera, cropping, closing the agreement or signing in from the age-and-terms-only sheet does not give upload permission. Accepted terms and approved AI routes are remembered on this device until reset, a relevant version/account/service change, or removal of app data. A previously unapproved AI route asks for permission once. Every image still requires your explicit Animate action, with the route and rights reminder shown in the cost review. Use Privacy → Reset upload permissions to require fresh approval; it does not undo already submitted processing. Delete local saved media through the Gallery. Contact privacy@studiokostov.com for access, correction, portability, restriction, objection or an erasure request. Privacy → Privacy requests accepts access, correction, erasure, restriction and objection requests and provides a receipt and status. Erasure, restriction and objection requests stop new generation while handled; submitted work may finish. Requests are reviewed by Studio Kostov, not silently treated as completed deletion. Account closure starts the deletion procedure described above; it does not immediately erase every provider record. We verify identity proportionately and normally respond within one month; lawful extensions will be explained.

You may complain to the Austrian Data Protection Authority at dsb.gv.at or another competent EU supervisory authority. We do not make decisions about you with legal or similarly significant effects using the animation model. We use appropriate access controls and encrypted transmission, and handle personal-data breaches under applicable notification rules.