Apex Era

Privacy Policy

Last updated: 7 November 2026 (rev. 5)

This Privacy Policy explains how samko labs, s. r. o., with registered seat at Trnková 451/12, 040 14 Košice – mestská časť Košická Nová Ves, Slovak Republic (IČO: 53928881, DIČ: 2121532600) ("we", "us", "our"), processes personal data when you use the Apex Era app for iPhone or the Apex Era website at apexera.app (the "website"). We are the data controller for both under the EU General Data Protection Regulation (GDPR). Where something applies only to the app or only to the website, we say so; section 6 covers what is specific to the website.

1. What we process

• Face photos — processed transiently to generate a restyled portrait (see below). They are never persisted by us.
• Generated portraits & app data (your saved looks, chosen eras, settings) — stored locally on your device. We do not receive a copy.
• Credit balance — a counter of remaining generations, keyed to the anonymous transaction identifier Apple issues for your subscription or, on the website, to an opaque identifier of your website account (section 6). It contains no photo, no generated image, and no record of which eras you chose. (Our analytics records do hold era-level usage — that is a separate system, described in section 5.)
• Subscription data — when you purchase or change a subscription, Apple sends us signed subscription lifecycle events (e.g. purchase, renewal, cancellation, refund) containing transaction identifiers, product ID, and status. We store these to operate the service, prevent fraud, provide support, and meet legal and accounting obligations.
• Push notification token — if you turn notifications on, Apple issues your copy of the App a device token, which we store so we can send you a notification. We store the token itself, whether it belongs to Apple's production or sandbox notification service, and — optionally — your language setting and the App version, so a message can be sent in the right language to the right App version. Where you are also a subscriber, the token may be linked to the anonymous transaction identifier Apple issues for your subscription, so that an offer meant for subscribers isn't sent to non-subscribers and vice versa. The token is a per-installation identifier, not a name, an email address or a device serial number; it contains no photo, no generated image, and no record of which eras you chose — though the same installation identifier is used for analytics, which does record that (sections 4 and 5). See section 4.
• Usage analytics — a record of how you use the App: sessions and screens you open, onboarding steps, which eras you pick and generate, the quality tier you choose, credits spent, paywall views and plan choices, purchases (product, price, currency, whether a trial applied), your AI-consent decisions, whether a generation succeeded or failed and how long it took, and when you save, share or delete a result. Each event carries the installation identifier described in the next bullet, so sessions join up across launches. It never contains your photo, any image data, anything derived from a photo, file names or paths, your email address, your push token, the era prompts, or any text you typed. Processed by Amplitude in the EU — see section 5.
• Installation identifier — a short identifier for your installation of the App. It is used in two places: it is attached to every analytics event (previous bullet), and, if you turn notifications on, it is stored with your push token. It comes from the anonymous app-transaction identifier Apple issues your Apple Account for this App (Apple issues one even if you never pay for anything); where the App cannot read that, it makes up a random identifier and keeps it on your device instead. We are telling you plainly what this is: unlike the push token, it survives reinstalling the App, and where it comes from Apple it is the same value on your other devices signed in to the same Apple Account. We use it to recognise an installation: so a notification about a new era or an offer reaches you once and not three times, so that people who have never subscribed can be reached at all (the subscription identifier above, by definition, cannot identify them), and so that your analytics events form one continuous history instead of a new stranger every launch. Because it is also the analytics identity, your era-by-era usage history is associated with it — we are not going to pretend otherwise. It is not shared with advertisers or data brokers, is not used to track you across other apps or websites, and is not sold. It is not a name, an email address, an advertising identifier or a device serial number, and it carries no photo, no generated image and nothing derived from a photo. See sections 4 and 5 for deletion.
• Website account (website only) — your email address, the sign-in codes we email you, and your login sessions; if you choose Sign in with Apple, the identifier and (possibly relayed) email address Apple shares with us. Held in the website's own account database, separate from the credit system, which only ever sees an opaque account identifier. See section 6.
• Website payments (website only) — when you buy on the website, Stripe processes the payment. We store Stripe's customer and subscription identifiers, your subscription status and renewal date, and your credit balance. Your card details go to Stripe directly and never reach our servers. See section 6.
• Bot protection and advertising measurement (website only) — Cloudflare Turnstile checks that the free portrait is requested by a person, and, only if you accept in the cookie banner, the Meta Pixel and Meta Conversions API measure whether our ads led to a visit or purchase. See section 6.

2. How photos are processed

Your photo is transformed using OpenAI's image generation API. The image is transmitted to OpenAI solely to produce the styled portrait you requested. It is not used by us to identify you, and OpenAI does not use data submitted through its API to train its models. We do not claim generation happens on-device — it cannot; the photo must leave your phone for the App to work.

This only happens with your permission. The first time — and every time after, unless you choose “Don’t ask me every time” — the App shows a full consent screen naming OpenAI as the recipient, showing the exact photo that would be sent, and asking you to agree. If you turn that screen off, the App still names OpenAI on screen before each generation, so you are always told where the photo is going before it leaves your phone. If you decline, no photo is sent and no image is generated. You can withdraw or grant this consent at any time in Settings → Privacy inside the App; withdrawing also restores the full consent screen.

On the website the same rule applies: before a photo is uploaded, the website names OpenAI as the recipient and asks for your agreement, and nothing is sent if you decline.

3. Face data: collection, use, sharing, and retention

• What face data we collect: the photo you submit, and the AI-generated portrait produced from it. We do not create or store biometric identifiers, faceprints, or facial-geometry templates, and we do not use face data to identify or recognise you.
• How we use it: solely to generate the single styled portrait you asked for and return it to your phone. Face data is never used for advertising, marketing, identification, or AI model training by us.
• Who it is shared with: with your consent, the photo is sent over an encrypted connection to our server (hosted by Cloudflare) — from the website, via the website's own server, also hosted by Cloudflare — which forwards it to OpenAI acting as our processor to generate the image. It is shared with no other third party; in particular it is never sent to Stripe, Meta, Mailgun or any analytics provider.
• Where it is stored: the photo and the generated image are held only in memory on our server for the duration of that single request and are never written to disk, database, cache, or logs. Your photos and generated portraits are stored locally on your device only; we keep no copy. On the website, the generated portrait is returned to your browser and is not kept by us either; download it if you want to keep it.
• How long it is retained: photos sent for generation are retained for zero time beyond the request — they are discarded as soon as the image is returned. OpenAI may retain API request data for a limited period for abuse monitoring under its own policy. On-device photos and generated portraits remain on your phone until you delete them (Settings → Delete All Data) or uninstall the App.

4. Push notifications

Notifications are entirely optional. Nothing is collected under this section unless you allow notifications when iOS asks you to.

• What we store: the Apple push token for your installation of the App, the notification environment it belongs to, optionally your language setting and App version, and an identifier for your installation (next bullet). Where the App has an active subscription at the moment it registers, the token is linked to the anonymous subscription transaction identifier.
• The installation identifier, plainly: a short, anonymous string stored alongside the push token. It is normally the app-transaction identifier Apple issues your Apple Account for this App — issued even for a free download — and where the App cannot read that, a random identifier the App generates and keeps on your device. It is a stronger identifier than the push token and we would rather you heard that from us: a push token changes when you reinstall, whereas this one survives a reinstall, and the Apple-issued form is the same value across your devices signed in to the same Apple Account.
• Why we keep it: so we can recognise an installation. That lets us send a message about a new era or a credit-pack offer once rather than repeatedly to the same person, stop sending to someone who has already taken up the offer, and reach people who have never subscribed — who have no subscription identifier and are otherwise invisible to us. That is the whole of it. We do not share it with advertisers or data brokers, we do not use it to track you across other apps or websites, and we do not sell it. It is not linked to any photo or any generated image. Being straight about one thing: the same installation identifier is also the identity on your analytics events (section 5), so your era-by-era usage history sits under the same identifier as your notification record. The two are held in different systems and we do not join them, but we are not going to claim it is impossible.
• How long: for as long as the App is installed and notifications are on. We delete the token when you remove it (below), and we discard tokens that Apple reports as no longer valid — which is what happens when you uninstall the App.
• How to remove it: turn notifications off for Apex Era — in the App, or in iOS Settings → Notifications → Apex Era — and the App asks us to delete the token. The installation identifier is stored in the same record and is deleted with it; there is no way to delete one and keep the other. Deleting your app data (Settings → Delete All Data) does the same. You can also email samo@vrablik.eu and we will delete it.
• Legal basis: your consent (Art. 6(1)(a) GDPR) — the permission prompt iOS shows you — withdrawable at any time by the steps above.

5. Usage analytics

To decide what to build and what to fix, we measure how the App is actually used. This is done with Amplitude (Amplitude, Inc.), acting as our processor, with the data region set to the European Union — events are sent to and stored on Amplitude's EU infrastructure.

• What is collected: app launches and sessions, screens you view and deep links you open, your progress through onboarding, which eras you browse and generate, the quality tier you choose, credits spent, paywall views and which plan you select, purchases (product identifier, price, currency, and whether a free trial applied), your AI-consent decisions, whether a generation succeeded or failed and how long it took, and when you save, share or delete a result. Events carry the installation identifier from section 1 as the identity, plus the ordinary technical context an analytics SDK collects — app version, device model, operating-system version, language and country.
• What is never collected — plainly: your photo or any image data; anything derived from your photo; file names or paths; your email address; your push notification token; the era prompts; and any free text you type. An era is reported as its short identifier (for example miami-1984), nothing more.
• Why: product decisions. Which eras are worth keeping, where people get stuck in onboarding, whether a generation failure is rare or common, whether a price makes sense. It is not advertising, it is not profiling that produces legal or similarly significant effects, and there is no automated decision-making about you under Art. 22 GDPR.
• What we do not do with it: we do not sell it, we do not share it with advertisers or data brokers, and we do not use it to track you across other companies' apps or websites. Amplitude processes it only on our instructions under a data-processing agreement and may not use it for its own purposes.
• How long: event-level analytics are retained for up to 24 months and then deleted or aggregated into figures that no longer identify an installation.
• Legal basis: our legitimate interest in understanding and improving our own product (Art. 6(1)(f) GDPR). We chose this rather than consent because the processing is first-party, pseudonymous, kept in the EU, never sold and never used for cross-app advertising — and because a consent box here would compete with the one that genuinely matters, the AI-photo consent in section 2. The trade-off is that you get an unconditional right to object.
• How to object or erase: email samo@vrablik.eu and say you object to analytics. We will stop processing your analytics data and delete the events held for your installation — you do not have to give a reason and it does not affect your use of the App. One caveat we would rather state than hide: where the installation identifier is the one Apple issues, reinstalling the App or deleting your app data does not change it, so it is the request to us — not a reinstall — that actually removes your analytics history.

6. The website (apexera.app)

The website lets you make portraits in a browser. It is run by us, samko labs, s. r. o., as the same controller as the app. Everything in sections 2 and 3 about photos applies to it unchanged. In addition:

• Your account: to sign in you give us your email address; we email you a one-time sign-in code, delivered by our email provider Mailgun. You can instead use Sign in with Apple, in which case Apple tells us an identifier for you and an email address (which may be an Apple relay address). We keep your email address, your login sessions and short-lived sign-in codes in the website's account database, hosted by Cloudflare. Our credit and payment system never stores your email: it knows your account only by an opaque identifier.
• Payments: purchases on the website — the weekly plan and credit packs — are processed by Stripe. When you check out, your email address is passed to Stripe to create or find your customer record and send your receipt; your card or wallet details are entered into Stripe's own form and never reach our servers. We keep Stripe's customer and subscription identifiers, your subscription status, plan, renewal date and whether it is set to cancel, plus a record of which Stripe events we have processed (identifiers and event types only). Stripe also processes payment data for its own legal obligations and fraud prevention as an independent controller, under the Stripe Privacy Policy. Credits bought on the website are tied to your website account and do not currently appear in the iPhone app.
• Bot protection: the free website portrait is protected by Cloudflare Turnstile, which checks your browser for signs of automation. Our server sends Cloudflare the resulting token and your IP address to verify it. Your IP address is also used, briefly and in memory, to limit how many requests one address can make. We do not store it.
• Advertising measurement — only with your consent: if, and only if, you accept marketing cookies in the website's cookie banner, the website loads the Meta Pixel and our server relays matching events to Meta's Conversions API, so we can tell whether our ads on Facebook and Instagram led to a visit, a sign-up or a purchase. These events can include the page visited, the event type (for example "purchase"), its value and currency, your IP address and browser details, Meta's cookie identifiers, and — where Meta's matching uses it — your email address in hashed form. They never include your photo, a generated image, or which eras you made. If you decline, or never answer, no pixel is loaded and our server drops the events. You can change your choice at any time from the website's cookie settings. For the collection and transmission of this data, Meta Platforms Ireland Ltd. and we may be joint controllers; Meta's own use is governed by the Meta Privacy Policy.
• Cookies on the website: strictly necessary cookies for your login session, for remembering your cookie choice, and for a signed marker that you have used the free portrait in this browser; and, only with your consent, Meta's advertising cookies.
• Deleting your website account: you can delete it from the website's account page. That cancels any active website subscription at the end of the period you have paid for (so you are not charged again), deletes your credit balance, subscription record and account, and signs you out. Stripe keeps its record of past payments, and we keep invoices, for as long as tax and accounting law requires.

7. Legal bases (GDPR)

• Consent (Art. 6(1)(a), Art. 9(2)(a)) — cloud AI processing of your face photo, asked in-app before every generation and revocable anytime in Settings → Privacy.
• Performance of a contract (Art. 6(1)(b)) — to generate the images, track your credit balance, and provide the subscriptions and features you request; on the website, also to run your account, email you sign-in codes, and process purchases through Stripe.
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, security, and product improvement, including the usage analytics described in section 5, and the website's bot protection (Cloudflare Turnstile) and per-address rate limiting, which keep the free portrait from being abused. You may object to analytics at any time, with no reason and no loss of functionality.
• Consent (Art. 6(1)(a), and Art. 5(3) of the ePrivacy Directive for the cookies involved) — the Meta Pixel and Conversions API on the website, given in the cookie banner and withdrawable at any time from the website's cookie settings.
• Consent (Art. 6(1)(a)) — push notifications, given through the iOS permission prompt and withdrawable in iOS Settings → Notifications.
• Legal obligation (Art. 6(1)(c)) — tax and accounting records for purchases, in the app and on the website.

8. Who we share data with

• Apple — processes all payments, sends us subscription events, and operates the Apple Push Notification service that delivers any notification you have agreed to receive.
• OpenAI — generates the styled portrait from the transient image.
• Cloudflare — hosts our backend and the website (including the website's account database), processes subscription data on our behalf, and provides Turnstile bot protection on the website.
• Stripe (Stripe Payments Europe, Ltd.) — processes payments made on the website and holds the customer, payment and subscription records for them. Acts as our processor for payment processing and as an independent controller for its own legal and fraud-prevention obligations (section 6).
• Mailgun (Mailgun Technologies, Inc., EU region) — delivers the sign-in code emails for the website. Receives your email address and the email content, nothing else.
• Amplitude — our product-analytics processor. Receives the usage events in section 5 (including which eras you generate), keyed to your installation identifier, stored in Amplitude's EU data region. It never receives your photo, any image, anything derived from a photo, your email address or your push token, and it may not use the data for its own purposes.
• Meta / Facebook — the App may use the Facebook SDK for measurement and analytics. On the website, the Meta Pixel and Conversions API run only if you accept them in the cookie banner (section 6).

We do not sell your personal data. Except where stated otherwise above (Apple, Stripe and Meta also act as controllers for their own purposes), each of these parties acts as our processor under a data-processing agreement that binds them to confidentiality, to use the data only on our instructions for the purpose described above, and to security and privacy protections equal to those set out in this policy. Some processors may transfer data outside the EEA under appropriate safeguards such as the EU Standard Contractual Clauses.

9. Retention

Photos and generated images: not retained by us (in-memory only, discarded after each generation request — see section 3). On-device data: kept until you delete it or uninstall the App. Push notification tokens and the installation identifier stored with them: kept while notifications are on, and deleted together when you turn them off, delete your app data, or Apple tells us the token is no longer valid (see section 4). Free-portrait counters: a running count of how many free portraits the App has generated, as random identifiers with timestamps. They are not linked to you, your device or your Apple Account, hold no photo and nothing derived from one, and say nothing about what was generated. Usage analytics: event-level records kept for up to 24 months, then deleted or reduced to figures that no longer identify an installation, and deleted sooner on request (see section 5). Subscription and credit records: kept for the life of the account and for as long as required by tax and accounting law. Website account (email, sessions, sign-in codes): kept until you delete the account; sign-in codes expire within minutes and sessions when you sign out or they time out. Website credit balance and Stripe subscription record: deleted when you delete your website account. Stripe event log: identifiers and event types only, kept as an audit trail of processed payments. Payment records held by Stripe, and our invoices: as long as tax and accounting law requires. Meta Pixel / Conversions API data: only if you consented, retained by Meta under its own policy.

10. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. To exercise these rights, email samo@vrablik.eu. Because our usage analytics rely on legitimate interests, your objection to them (Art. 21(1)) is honoured without question: say the word and we stop processing and delete the analytics events held for your installation. You can delete your website account yourself from its account page (section 6), and withdraw consent to the website's advertising cookies from its cookie settings at any time. You also have the right to lodge a complaint with the Slovak Data Protection Authority (Úrad na ochranu osobných údajov Slovenskej republiky) or your local supervisory authority.

11. Children

Apex Era — the app and the website — is not directed to children under 16. We do not knowingly process their data.

12. Changes

We may update this Policy; material changes will be reflected by the "last updated" date above.

13. Contact

samko labs, s. r. o., Trnková 451/12, 040 14 Košice – mestská časť Košická Nová Ves, Slovak Republic. Email: samo@vrablik.eu.

---