XM
XMagic Privacy Policy
We process information to operate XMagic AI photo and video creation features, maintain accounts and purchases, protect the service, respond to support requests, and improve reliability. We do not sell your uploaded photos, videos, face data, or AI prompts.

1. Scope, App Store, and Google Play Transparency

This Privacy Policy applies to XMagic mobile apps, websites, backend services, public or shared content areas, purchase flows, customer support, and related services. It is intended to support Apple App Store privacy disclosures and Google Play Data safety disclosures, including data collection, access, use, sharing, third-party SDK practices, tracking, retention, deletion, and privacy choices.

Store product pages may summarize some of these practices in Apple's privacy label format or Google Play's Data safety format. If a data practice varies by app version, region, permission setting, or feature, this policy gives additional detail.

XMagic appears by name in store listings and in this policy. The privacy point of contact for XMagic is support@yes366.com.

2. Information We Collect

We collect information you provide directly, information generated when you use the service, and limited technical information from your device or network. The exact information depends on the features you use and the permissions you grant.

Category
Examples
Purpose
Account and identifiers
User ID, Firebase Auth ID, app account status.
Authentication, account support, purchase entitlement, abuse prevention.
User content
Prompts, selected templates, uploaded photos or videos, AI outputs, creation history.
Generate, edit, render, save, display, moderate, and troubleshoot requested creations.
Face and likeness data
Faces or facial features visible in uploaded media that you choose to submit.
Apply the requested image/video workflow, including permitted AI service provider processing. We do not use this data for marketing or advertising.
Purchases
Product IDs, subscription status, entitlement status, transaction or receipt identifiers.
Unlock paid features, restore purchases, prevent duplicate payment, provide support.
Usage and diagnostics
Feature events, app version, device model, operating system, IP address, crash and performance logs.
Analytics, reliability, security, debugging, fraud prevention, product improvement.
Permissions and protected APIs
Photo picker or photo library access, camera access, notifications, advertising identifier where permitted.
Upload selected media, capture content, send service notices, measure attribution with consent where required.
Attribution and messaging
Campaign/referral data, deep link data, push notification token, advertising identifier where permitted.
Measure installs, route deep links, send service notifications, and measure marketing with consent where required.
Support and reports
Feedback, report reason, optional description, relevant task details.
Respond to requests, investigate harmful content, enforce policies, improve support.

3. How Information Is Collected

  • You provide information when you upload media, enter prompts, create tasks, submit feedback, report content, or contact support.
  • The app and backend create operational records when you sign in, request AI generation, view results, save media, or use paid features.
  • Integrated SDKs and service providers may collect technical, purchase, analytics, attribution, crash, and performance information.
  • AI service providers used for a requested workflow, including BytePlus ModelArk for Seedance 2.0 / 2.0 Fast tasks, may receive submitted prompts, selected media, task settings, and any visible face data or likeness contained in that media after the app obtains the required user consent.
  • Apple, Google, RevenueCat, Firebase, SolarEngine, BytePlus, and similar providers may send us limited transaction, attribution, AI task, or service status information.
Prominent disclosure and consent: when Google Play or applicable law requires a prominent in-app disclosure, runtime permission, or affirmative consent for personal or sensitive data, XMagic is designed to request that permission before accessing the data or using it for the disclosed feature.

4. How We Use Information

We use information to:

  • deliver text-to-image, image editing, text-to-video, image-to-video, and related AI features;
  • process selected media, prompts, workflow settings, and templates you submit, including by sending them to service providers needed to complete the requested AI workflow;
  • authenticate users, maintain account state, points, subscriptions, and purchase entitlements;
  • provide restore-purchase, billing support, customer service, account deletion, and data requests;
  • send service messages such as task status, purchase status, security notices, and support responses;
  • measure product performance, diagnose crashes, improve reliability, and maintain remote configuration;
  • detect abuse, fraud, policy violations, spam, harmful content, and unauthorized access;
  • maintain accurate Apple App Store privacy and Google Play Data safety disclosures;
  • comply with applicable law, platform requirements, and valid legal processes.

5. Uploaded Photos, Face Data, and AI Processing

XMagic processes only the photos, videos, prompts, and workflow settings that you choose to submit. Uploaded media may contain faces or other biometric-like information because faces are visible in the image. We use that information only to provide the requested creation or editing workflow.

Face and photo commitment: We do not sell face data, photos, or videos. We do not use face data for advertising, marketing, data mining, identity verification, or building independent facial-recognition profiles. Uploaded photos are intended to be deleted after the analysis or generation process is complete, subject to temporary operational retention described below.

Processing flow

  1. You select media through the app or device picker and submit it for a specific creation workflow.
  2. The app presents an in-app disclosure and consent prompt before sending Seedance 2.0 / 2.0 Fast task data to a third-party AI service provider.
  3. The app sends the selected content, prompt, template, and task settings to XMagic backend services.
  4. For Seedance 2.0 / 2.0 Fast tasks, XMagic may send the submitted prompt, selected photos, videos, audio, task settings, and any visible face data or likeness in that media to BytePlus ModelArk, the third-party AI service provider used to generate the requested video and perform safety checks.
  5. The generated result is returned to you inside the app and may be stored in your creation history until deleted or expired.
  6. Temporary source files and task data are removed after processing or after a limited operational period needed for reliability, security, abuse prevention, or legal compliance.

Do not upload a person's face, likeness, private image, or personal media unless you have the legal right and explicit permission to use it for AI generation or editing.

AI portrait, avatar, face, or likeness features are intended for users who are at least 18 years old or the age of majority required in their region. Do not upload images of children, intimate images, non-consensual images, public figures used deceptively, or media that you are not authorized to process.

6. Disclosure and Service Providers

We do not share face data, uploaded photos, uploaded videos, or prompts with third parties for their own advertising, marketing, sale, or independent profiling. We may disclose information to service providers that process data on our behalf to operate the requested feature. We require these providers to provide the same or equal protection of user data as described in this policy.

  • BytePlus ModelArk: third-party AI processing for Seedance 2.0 / 2.0 Fast video generation and related safety checks. The data sent may include submitted prompts, selected photos, videos, audio, task settings, and any visible face data or likeness contained in uploaded media. For more information about BytePlus data and privacy practices, see BytePlus ModelArk Data Processing, BytePlus Data Processing Addendum, and BytePlus Trust Center Privacy.
  • Google Firebase and Google Cloud: authentication, cloud functions, Firestore, storage, analytics, crash reporting, performance monitoring, messaging, and remote configuration.
  • RevenueCat: subscription and purchase entitlement management, restore-purchase support, and purchase status syncing.
  • SolarEngine: attribution, deep links, campaign measurement, and remote configuration where enabled and permitted.
  • Apple App Store and Google Play: payments, receipts, refunds, subscription management, account deletion links, fraud prevention, store disclosures, and store support.
  • Legal, safety, and business providers: professional advisors, compliance providers, infrastructure operators, or authorities where required by law or necessary to protect users and the service.

XMagic does not control third-party platforms, websites, or online services that you open outside our app. Those services follow their own privacy rules. We encourage you to read their policies separately.

7. Tracking, Advertising Identifiers, and Consent

Where a practice is considered tracking under Apple policies, XMagic requests permission through Apple's AppTrackingTransparency framework before tracking or accessing the advertising identifier. You can decline tracking and still use core app functionality.

On Android, XMagic may use the Android advertising ID or app set ID only for disclosed purposes such as attribution, analytics, fraud prevention, and service improvement, subject to Google Play policies and your device settings.

  • We do not require tracking, push notifications, location, microphone, or unrelated permissions to unlock paid functionality.
  • If permission is denied, attribution, campaign measurement, or personalization may be limited.
  • You can change tracking permission in iOS Settings under Privacy & Security > Tracking.
  • You can reset or manage the Android advertising ID in your Android privacy settings where supported.
  • We do not use Contacts, Photos, or similar protected APIs to build contact databases or sell data.

8. Retention and Deletion

We retain information only for as long as needed to provide the service, maintain purchase and account records, investigate abuse, resolve disputes, comply with legal obligations, or protect our systems and users.

  • Uploaded source media is intended to be temporary and deleted after analysis or generation is complete.
  • Generated outputs, task records, and creation history may remain available in your account until deleted, expired, or removed under our policies.
  • Crash, security, analytics, billing, and transaction records may be retained longer when operationally or legally necessary.
  • If you delete your account, we will delete or de-identify associated personal data unless retention is required for legal, security, dispute, refund, tax, or fraud-prevention reasons.
  • Deleting your XMagic account does not cancel an Apple App Store or Google Play subscription. You must cancel subscriptions through the relevant store account settings.

If your app version allows account creation, you can request account deletion inside the app where available or outside the app through Privacy Choices. The web deletion path is intended to support users who have uninstalled the app or cannot access the in-app flow.

9. Your Privacy Choices

You can manage many choices from your device settings, the app, or by contacting us. For a focused summary, visit Privacy Choices.

  • Photo access: choose selected photos where supported, or change access in device settings.
  • Notifications: enable or disable push notifications in device settings.
  • Tracking and advertising ID: manage AppTrackingTransparency permission in iOS settings and Android advertising ID controls in Android settings.
  • Account deletion: use the in-app account deletion flow where available, or the web request path if you cannot access it.
  • Data requests: contact us to request access, correction, deletion, or withdrawal of consent where applicable.

10. Security

XMagic uses technical and organizational measures intended to protect data against unauthorized access, loss, misuse, alteration, or accidental destruction. These measures include platform security controls, secure transport where available, access controls, monitoring, and limited retention. No transmission method or storage system can be guaranteed to be absolutely secure.

11. Children and Age Restrictions

XMagic is not intended for children under 13 and is not directed to the Kids Category. If we learn that personal information has been collected from a child under 13 without appropriate authorization, we will take reasonable steps to remove it. Users must not upload, create, or share content that exploits, sexualizes, harms, or depicts minors in an unsafe or unlawful manner.

XMagic prohibits child sexual abuse and exploitation, child sexual abuse material, grooming, sextortion, trafficking, and any AI-generated or manipulated media involving minors in sexual or exploitative contexts. Reports can be sent to support@yes366.com; we may remove content, restrict accounts, preserve evidence, or report to appropriate authorities where required or permitted by law.

The same support address serves as XMagic's child safety and privacy contact for user reports and platform review follow-up.

12. International Transfers

XMagic, its infrastructure, and its service providers may process information in countries or regions other than where you live. Where required, we rely on appropriate safeguards and service-provider commitments to protect personal information.

13. Policy Updates

We may update this Privacy Policy from time to time. When we do, we will revise the effective date and post the updated version on this page. If changes materially affect your rights or choices, we may provide additional notice where required.

14. Contact Us

If you have questions, data requests, deletion requests, consent withdrawal requests, or concerns about this Privacy Policy, please contact: support@yes366.com