Cookmoji Privacy Policy

Account details: your email address; when you sign in with Apple or Google, only the identifier and email they give us. We do not receive your name or profile picture from them.

Photos. Cookmoji does not browse your entire photo library. Whether you are making stickers, changing your avatar or sending a picture to support, only photos you choose in Apple’s photo picker or take with the camera enter Cookmoji. Photos for sticker creation are converted to JPEG copies on your device without location or other metadata. Selecting a photo does not upload it. Upload begins only after you start a creation; unfinished uploads may continue during recovery or retry. Creation photos and reference images are subject to the 30-day retention and automatic-cleanup rules under Keeping and deleting data. Avatars, support attachments, generated works and historical backups are handled according to their purpose and the rules below.

What you create: the stickers generated for you, the names and captions you write, and what you publish to the plaza.

Device and usage data. Device model and system version, app version, language and region, request times and results, and crash or performance diagnostics we receive. Each request to create an invite link, accept an invite or submit a redemption code asks Apple for a new DeviceCheck token and sends any token obtained to us. For operations that require invite-eligibility checks, we use it to query or update two device-level yes/no flags with Apple to prevent repeated participation on the same device. Apple stores these flags per device on its servers; deleting your Cookmoji account does not reset them. We also keep token hashes, query results and handling records associated with the request and account to prevent token replay, review eligibility and investigate problems. DeviceCheck does not provide us with a stable device identifier. Sharing an existing invite link does not by itself always require a new token.

Invites and Credits. Your invite code and link, who invited you and whom you invited, acceptance and first-completion records, reward eligibility, the applicable amount and monthly limit, the qualifying month, and your Credits balance and history. These records let us check the rules, settle rewards, prevent duplicate grants and handle related questions or disputes.

We do not read your phone’s address book or collect precise location; the analytics services infer an approximate region (country or city) from your network address. Product analytics and acquisition measurement are described below.

Purchase and subscription data. The user ID used to associate purchases with your account, product and transaction identifiers, purchase and renewal times, purchase evidence, subscription status, and cancellation, refund or revocation records. When the RevenueCat purchase SDK initializes for a signed-in account or synchronizes purchase status, it also processes related device and app information, such as system and SDK versions and, when available, Apple’s Identifier for Vendor (IDFV). This synchronization may occur even when you are not making a new purchase. We do not receive your full payment-card details from Apple.

Interactions and support. Records of likes, emoji interactions, follows, blocks, tips and reports when you use those features, and text, photos or other attachments you send to support. We use them to provide the relevant social features, handle reports and safety issues, and respond to your requests.

Product analytics and acquisition measurement. Builds with analytics enabled use Google Analytics for Firebase and AppsFlyer to record how the app is used: pages you view and features you use (including sign-in, purchase steps, opening the app from widgets, links, shortcuts and other system entry points, and opening the Messages extension); creation and sharing actions and their results; Credits earned and spent (amounts of Credits, not money); notification permission and notification opens; rewards and invites; and the IDs of publicly published works (publication IDs beginning with pub_). We also record a few states, such as sign-in method, Plus status, language and appearance settings, whether widgets and Live Activities are on, rough ranges of how many works you have published and how many people you follow, reward and invite status, and the ad source and campaign an installation was attributed to. The SDKs also generate installation, session, device and app technical information automatically. We give both services the same app-specific hashed account identifier and give Firebase the AppsFlyer installation identifier, so we can relate where people came from to how they use the app. These identifiers are pseudonymous, not anonymous, and are linked to your account. The app's own analytics events do not include photos, prompts, search text, nicknames, email addresses, verification, invite or share codes, private file or work IDs, prices, Apple transaction identifiers or RevenueCat user identifiers.

To provide and maintain the service: sign-in, generating and keeping works, publishing and browsing the plaza, providing the interactions and invite features you choose to use, managing Credits, purchases and subscriptions, verifying transactions, handling refunds, and providing support.

For safety and abuse prevention: spotting unusual sign-ins, handling reports, checking invite eligibility and preventing repeated reward claims on the same device, detecting unusual transactions, and taking proportionate action under the terms. These device checks are used for invite and code-redemption operations you initiate, not advertising tracking. Contact us to request a review if you believe an eligibility decision is wrong.

To improve the service and measure how people find it: using product analytics, operational and purchase statistics, and crash or performance diagnostics we receive, to understand use, evaluate the service and identify problems, and to measure which ads and other channels bring people to Cookmoji and whether they go on to sign up, create, buy or share.

To meet legal obligations.

We do not sell your personal information.

Service providers. Providers of cloud hosting, object storage, email codes, AI models, purchase or subscription management, and product analytics and acquisition measurement. We provide information needed for their services; providers processing on our behalf must do so under contract and our lawful instructions. The sections below explain the involvement of AI services, Apple, RevenueCat and analytics providers.

AI services. Your selected photos, reference images and creation instructions are sent to OpenAI to understand the images, plan the pack and generate stickers. When the DeepSeek text model is enabled, it may receive text such as creation instructions or written plans, but not your photos or reference images. To add motion, generated stickers and animation instructions go to the selected animation provider, such as xAI (Grok) or MiniMax, and may also be processed through fal or providers hosting or relaying that request. That animation step does not send the original sticker-creation photos to animation providers. Your avatar and display name, the name and captions of a pack you make public, and any locally edited sticker you make public are first sent to OpenAI's moderation service to check them against our rules. This check only decides whether they can be shown publicly; it is not used to make content. The actual recipients depend on the feature and service configuration; additional processing must comply with the notice and consent rules below.

Legal reasons: when the law requires it, or when it is necessary to protect the rights and safety of people using Cookmoji or the public.

Business changes: in a merger, acquisition or sale of assets information may transfer with the business, and we will tell you beforehand.

Public content. Other signed-in users can view works you choose to publish to the plaza. Public sharing or invite previews may also show works that remain public to people who have the relevant link or code without signing in. Withdrawing a publication does not delete the private original in your account or copies already saved by other people.

Invites. After you accept an invite, the inviter can see your Cookmoji nickname and avatar, that you joined, and whether and when you completed your first pack. A person with your invite link or code can obtain your nickname, avatar and an available public work through the invite page or preview service. When a link specifies a work, the preview prefers that work if it belongs to you and remains public; without a valid specified work, it may show your most recent public work. An older link therefore does not always show your newest work. Creation photos, your email and private works are not made public through invite previews. Apple takes part in the device-eligibility checks described above.

Nickname and avatar. Your nickname and avatar form your public profile and can appear on the plaza, with works and in invite previews; someone with a public avatar-file link may also view that avatar directly. New accounts receive a randomly generated nickname. Google or Apple sign-in gives us only their email and account identifier, not their name or profile picture, and we do not show your email to other users. An avatar you choose to upload is used within the public scope described here. You can change your nickname and avatar in the app.

Purchases and subscriptions. Apple processes App Store payments and its platform transaction records. We use RevenueCat to verify purchase evidence, synchronize subscription and refund status, associate purchases with your Cookmoji account and view purchase-service statistics. RevenueCat receives the account, transaction and relevant device or app information described above to provide these services on our behalf, and forwards purchase, renewal and refund records to AppsFlyer as described under Analytics providers. Integrating RevenueCat does not itself give it access to the photos you use to make stickers. You can contact us below to request access, correction or deletion of personal data involved in this processing.

AI data retention. OpenAI does not use API data for model training by default. Standard abuse-monitoring logs are normally retained for up to 30 days, with longer retention possible for legal requirements or to protect the service and third parties from harm. AI providers and hosting or relay providers may retain necessary data or logs for request processing, abuse prevention, safety review and legal obligations; periods depend on the applicable API-service arrangements and legal requirements. Our 30-day retention and cleanup rule for original creation photos is not a universal deletion deadline for every third-party log, cache or independent record. You can make personal-data requests about this processing to us. Updating this policy does not automatically authorise new training uses.

Analytics providers. Google Analytics for Firebase helps us understand product use and improvements; AppsFlyer helps us measure which ads and channels bring people to Cookmoji and key actions such as sign-up, first creation, purchase and sharing. The app does not collect the advertising identifier (IDFA), does not ask for App Tracking Transparency permission and does not give either service consent for personalised advertising. AppsFlyer collects Apple's Identifier for Vendor (IDFV) only to recognise when Cookmoji is reinstalled on the same device, not to follow you across other companies' apps; Google Analytics does not collect it. Apple Ads attribution is on: the app gets a token from Apple's AdServices framework, and AppsFlyer uses it to learn from Apple whether an installation came from an Apple Ads campaign. For ads on other networks, Apple's SKAdNetwork and AdAttributionKit can tell the ad network whether an installation led to such actions, without a user or device identifier. SDKs still process information needed for network connections, installation identifiers and technical information; not using the advertising identifier does not make all processing anonymous. Signing out clears the account identifier in both services, so new events no longer carry it; signing out does not delete analytics data already received, but deleting your account asks both services to delete that data, as described under Keeping and deleting data.

Purchase revenue in analytics. Revenue does not come from the app's own events. RevenueCat sends AppsFlyer, server to server, the amount, currency and product ID of purchases, renewals and refunds, the Apple transaction identifier and the user identifier the purchase service uses for your account; RevenueCat does not send these records to Google Analytics. When our servers confirm a purchase, renewal or refund, they report its amount, currency and product ID to Google Analytics with the same hashed account identifier and the app's Google Analytics instance identifier, which the app sends to our servers for this purpose, without transaction or RevenueCat identifiers.

Network traffic between the app and the service is encrypted using HTTPS/TLS. Sign-in credentials are stored in the device keychain using device-only storage.

The service is not end-to-end encrypted, so our servers can access what you upload and publish. No system is perfectly secure; please do not upload sensitive information.

Account details and your work are kept while the account exists.

Original creation photos, reference images and related intermediate images are automatically cleaned up under a 30-day retention rule from upload. Cleanup may begin as the deadline approaches; processing tasks or technical failures may delay deletion, and we continue retrying cleanup. Once removed, the originals cannot be used for new creation. Generated stickers and GIFs remain saved separately as your works. Avatars and support attachments are outside this creation-photo rule. Historical backups, object versions, logs and independent third-party records are handled as described below and under When we share it.

You can request permanent deletion under Settings, Delete account. Once accepted, the account is frozen, sign-in credentials are invalidated and public publications in the service are taken down; current service data is then cleaned up in the background. We also ask Google Analytics for Firebase (through its user data deletion) and AppsFlyer (through an OpenDSR erasure request) to delete the analytics and attribution data linked to your account, and retry failed requests; signing out alone does not delete this data. Cached media or short-lived access credentials already issued may remain usable briefly until updated or expired. Account deletion does not remotely erase files other people have saved, automatically cancel an Apple subscription or delete transaction records Apple keeps independently.

Historical backups, object versions and necessary security or operational logs may remain during their respective rotation, expiry or cleanup cycles; deleting active-service data does not mean every historical copy is physically erased at the same time. We use retained material only as necessary for disaster recovery, security, legal obligations or disputes, determine retention by those purposes, system rotation cycles and applicable law, and delete or de-identify it when no longer needed. We keep a limited, separate deletion record needed to enforce deletion and prevent a backup restore from making a deleted account usable again. That record is not used to restore ordinary use of the old account.

Files already exported or downloaded onto your device or someone else's are outside the scope of this deletion.

Purchase and abuse-prevention records. Limited transaction, reward or eligibility records may need to remain after account deletion to reconcile past transactions, handle refunds or disputes, meet financial or legal obligations, or prevent repeated reward claims. Their scope and duration are limited to what those specific matters or applicable obligations require; retention does not authorise reusing a deleted account for marketing or ordinary service. Apple’s independently held platform transaction records follow its rules. Deleting a Cookmoji account does not reset the DeviceCheck flags held by Apple. Contact us to ask about retained records relating to you or to request deletion. After account deletion, we request deletion of the associated RevenueCat customer record in the background and retry failed requests. This does not mean every third-party copy is physically erased the instant you request deletion.

You can see and change your display name and avatar in the app, withdraw published work at any time, and delete your account permanently.

You can turn off product analytics and acquisition measurement on a device at any time under Settings, Help & About, Analytics & improvements. While it is off, the app stops sending analytics data from that device to Google Analytics for Firebase and AppsFlyer, and purchases are no longer reported to them under that device's identifiers; the SKAdNetwork and AdAttributionKit postbacks that Apple's system sends without a user or device identifier are not affected. Turning it off does not delete data already received; deleting your account asks for the data linked to it to be deleted, as described under Keeping and deleting data.

To request a copy of your data, or to object to how we handle it, write to us at the address below.

California (CCPA/CPRA): you have the right to know, delete, correct, limit the use of sensitive personal information, and not be treated differently for exercising these rights. We do not sell personal information and do not share it for cross-context behavioural advertising.

Nevada: we do not sell personal information as that state's law defines it.

EU and EEA. Where the GDPR applies, we process data necessary for the account, creation, purchase, subscription and reward services you request to perform our contract with you. Necessary and proportionate processing for security, fraud or abuse prevention and service reliability is based on our legitimate interests, unless your rights override them. Records we must keep or disclose by law are processed to meet those legal obligations. Other processing that legally requires consent relies on your valid consent; you can withdraw it at any time without affecting the lawfulness of earlier processing. Accepting the terms does not replace any separate consent the law requires for access to terminal equipment or other processing. You may exercise applicable rights of access, rectification, erasure, restriction, portability and objection and complain to a competent data-protection authority. Contact us below to make a request.

International processing. To provide the services described in this policy, we and the service providers above may process data outside your country, including in the United States and other countries where the actual providers process it. Data-protection rules may differ. Before a transfer subject to legal restrictions, we must establish a permitted transfer basis and any required safeguards, such as an applicable adequacy decision or valid contractual safeguards. Contact us using the details below for information about the actual recipients, processing countries and safeguards relevant to your data, and copies where the law provides that right. Any separately required consent must be obtained for the relevant transfer; accepting this policy is not that consent.

Cookmoji is not for people under 13. If we learn that someone under 13 has created an account, we delete the account and its data.

We update the date at the top of the page when this policy changes. Before processing relevant data under material changes to purposes, data categories, recipients or your rights, we must provide the notice required by applicable law and obtain consent where required. A policy update or your continued use does not constitute any additional consent required by law or allow us to retroactively expand the purposes for existing data.

For privacy questions, write to us at the address below.