Draft for legal review. Replace [ADDRESS], [EMAIL] and [DATE] before publishing, then remove this note.

Privacy policy

Last updated: [DATE]

Holoura turns your name, and optionally a photo, into a holographic trading card. We built it to keep as little as possible: there are no accounts, no analytics, no ads and no tracking. This policy explains what happens to your information and why.

Who we are

Holoura is made by FAMILIA d.o.o., [ADDRESS], Slovenia ("we", "us"). We are the controller of the information described here. Questions or requests: [EMAIL].

What stays on your iPhone

• Your name, pronouns and look. You type your name and pick your pronouns and how you look (hair, eyes and so on). The card's numbers and its fallback text are made on your iPhone. Your name never leaves your iPhone, except inside the cards you keep in your iCloud (see below).
• Your photo, if you are under 18 or don't consent. On iPhones with Apple Intelligence, the photo is read on the device to suggest your look. It is never sent anywhere.
• Your age range. Holoura asks iOS whether you are 18 or over, using Apple's Declared Age Range feature. We only learn the answer to that question, on the device, and never send or store it.

Your cards and your iCloud

Cards you keep (the name, the generated text and the drawing) are saved on your iPhone and synced to your own private iCloud database through Apple's CloudKit, so they appear on your other devices. We cannot read your private iCloud data. The photo and finished card images are never saved there; the app redraws cards from what it keeps.

To delete your cards, delete them in the app, or remove Holoura's data in Settings, [your name], iCloud, Manage Account Storage.

What our server receives

Cards are drawn through our own server ("the proxy"), which runs on Cloudflare. It holds the keys to the AI service so they are never in the app. When you draw a card, the app sends:

• The card's style and fixed choices made from your name on the iPhone, such as a pirate power type, a football position or a fantasy class. Not your name.
• Your pronouns and the look you picked, so the drawing matches you.
• Your photo, only if you are 18 or over and agreed to send it to an AI service to draw your likeness. You are asked first, and you can withdraw at any time in Settings or next to the photo.
• A card id, a random number the app makes for each card, so its redraws are counted.

The proxy keeps:

• An App Attest key id and public key for your installation, to make sure requests come from the real Holoura app, with how many free cards it used.
• How many drawings each card id has had, for up to 30 days, to allow 2 redraws per card.
• The text generated for each card id (for example a pirate power), so redraws and "Same name, same card" reuse it. This is text written by our AI model from the fixed choices, not from your name.
• Short-lived counters, such as requests per hour, to prevent abuse. They expire within hours.

The proxy does not store your photo, your name, your look or your drawings. It does not log request contents.

The AI service

To draw a card, the proxy sends the AI service a prompt made from the fixed choices, your pronouns and the look you picked, and, only with your consent and only if you are 18 or over, your photo. A text model receives the same fixed choices to write the card's text.

The AI service is OpenAI. Under its API terms, OpenAI does not use this data to train its models, and may keep it for up to 30 days to monitor for abuse before deleting it. See openai.com/policies. If we change the AI service, we will update this policy, and if what happens to your photo changes, the app will ask for your consent again.

Free and paid cards

• Free card. Each iPhone gets one free drawn card. So that deleting and reinstalling the app doesn't reset it, the proxy uses Apple's DeviceCheck: Apple keeps two bits for your device that tell us how many free cards it has used. Apple does not tell us who you are or anything else about the device.
• Purchases. Packs of drawn cards are bought through Apple's App Store. Apple handles the payment; we never see your payment details or your Apple Account. The app sends the proxy Apple's signed record of the purchase so it can add the cards. The proxy keeps the transaction id, so each purchase counts once, and your card balance under a random id. That id is stored in your iCloud key-value storage, so your cards follow you to a new iPhone. It is not linked to your name or your Apple Account on our side.

Why we use it (legal bases)

• To make the cards you ask for, including drawing them and counting free, paid and redrawn cards: performing our agreement with you (GDPR Article 6(1)(b)).
• To send your photo to the AI service: your consent (Article 6(1)(a)), which you can withdraw at any time.
• To prevent abuse and keep the service running, using App Attest, DeviceCheck and rate limits: our legitimate interest in protecting the service and its costs (Article 6(1)(f)).

Who processes it for us

• Cloudflare runs the proxy and stores its counters and the card balance ledger.
• OpenAI draws the cards and writes their text.
• Apple provides iCloud, App Attest, DeviceCheck, Declared Age Range and the App Store.

Some of these providers process data outside the European Economic Area, including in the United States, under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

How long we keep it

• Card drawing counts: 30 days.
• Generated card text, App Attest keys, free card counts, purchase transaction ids and card balances: for as long as the service runs, because they keep the card counts correct.
• Abuse counters: a few hours.
• Photos: not kept. OpenAI may keep them for up to 30 days, as above.

Children

Holoura is meant for ages 13 and up. The photo can only be sent to the AI service by people the iPhone reports as 18 or over; for everyone else it stays on the device. If you believe a child under 13 has used Holoura, contact us.

Your rights

You can ask us for access to, correction or deletion of your information, restrict or object to its use, and ask for a copy of it. Because we don't have accounts and don't store your name, we usually cannot tell which records are yours; if you send us your card balance id or a purchase's transaction id, we can find and delete those. You can withdraw photo consent at any time in the app.

You can also complain to the Slovenian data protection authority, the Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si), or the authority where you live.

Changes

We will post changes here and update the date above. If a change affects how your photo is used, the app will ask for your consent again.