Privacy Policy

STORM Studio | Last updated: March 4, 2026 | Effective date: March 4, 2026

  At a glance: We collect information needed to run the App — your sign-in identity, photos you upload, generation history, and purchase data. Your photos are processed through Google's Gemini AI and stored on Google Cloud. We do not sell your personal data. You can request deletion of your account and all associated data at any time from within the App.

1. Who We Are

STORM Studio ("we", "us", "our") is the operator of the STORM Studio iOS application. We are responsible for the personal data you provide when using the App.

Website: https://stormstudio.club
Contact: support@stormstudio.club
Jurisdiction: California, USA

This Privacy Policy describes how we collect, use, store, and share your information when you use STORM Studio, and explains your rights under applicable law, including GDPR (for users in the European Economic Area and UK) and CCPA (for California residents).

2. Information We Collect

2.1 Account Information

Apple ID Token: A unique identifier provided by Apple when you sign in. This is how we recognize your account.
Email Address: Provided at sign-in via Apple. If you use Apple's "Hide My Email" feature, we receive a private relay email address instead of your real one. We use this solely for essential account communications.

2.2 Photos & Generated Content

Original photos you upload or capture in the App.
AI-generated images produced from your photos (stored in 4 sizes: thumbnail, medium, large, original).
Your original photos are not deleted after processing — they remain stored in your account and are accessible to you.

2.3 Activity & Usage Data

Generation history: which preset was used, when, and the status of each generation.
Favorites: presets you have saved.
Following: creators you follow.
Likes: photos you have liked in the Discovery Feed.
Search queries (what you search for in the App) and trending search data (aggregated).
Basic usage analytics: which presets are popular, feature usage frequency (aggregated and anonymized where possible).

2.4 Purchase & Subscription Data

History of token purchases and subscription activations.
Current token balance and expiry information.
Subscription status (managed via RevenueCat and Apple StoreKit 2).
Note: We do not collect or store your payment card details — all payments are processed by Apple.

2.5 Personalization Settings

Generation preferences such as gender and style preferences that you configure in the App. These are considered personal data and are used solely to personalize your experience.

2.6 Creator Program Data

If you apply for or participate in the Creator Program, we collect your display name and avatar URL as provided in your application.

2.7 Device & Technical Data

Push notification device token — to send you notifications (only if you opt in).
IP address — captured in server logs for security and abuse prevention. Server logs are retained for up to 30 days, then deleted.
Local image cache — the App uses Kingfisher to cache images locally on your device for faster loading. This cache is managed by iOS and cleared automatically by the system.

2.8 Information We Do NOT Collect

We do not collect your real name beyond what you provide.
We do not collect location data.
We do not collect contacts or calendar data.
We do not collect biometric data.
We do not collect data from children under 13.

3. Device Permissions

Permission	Why We Need It	Required?
Camera	To let you take photos directly in the App for AI generation.	Optional (you can import from Photo Library instead)
Photo Library	To import photos from your Camera Roll for AI generation.	Optional (you can use Camera instead)
Push Notifications	To notify you about new presets from creators you follow and App updates.	Optional (opt-in)

You can change any of these permissions at any time in your iPhone's Settings app. Revoking Camera or Photo Library access means you will need to use the other method to upload photos.

4. How We Use Your Information

Purpose	Data Used	Legal Basis (GDPR)
Authenticate and manage your account	Apple ID token, email	Contract performance
Process AI photo generation	Your photos, generation settings	Contract performance
Store and display your photos and history	Photos, generation history	Contract performance
Manage tokens, subscriptions, and purchases	Purchase history, subscription status	Contract performance
Operate Discovery Feed and social features	Published photos, likes, following	Contract performance / Legitimate interest
Send push notifications	Device token, preferences	Consent
Improve the App and AI models	Aggregated analytics, usage data	Legitimate interest
Security, fraud prevention, and compliance	IP address, server logs	Legitimate interest / Legal obligation
Respond to support requests	Email, account data	Legitimate interest
Marketing & promotional content	Published Discovery photos	Consent (given when you publish to Discovery)

For California residents, our use of your personal information falls under the following categories of business purposes under CCPA: providing services, security, debugging, analytics, and marketing with your consent.

5. AI Processing — How Your Photos Are Used

Your photos are sent to Google's Gemini AI API for processing. This is how the AI transformation feature works. Here is what you need to know:

Your photo is transmitted securely (TLS/HTTPS) from our server to the Google Gemini API (Gemini 2.0 Flash model).
Google processes the photo to generate the AI-styled output and returns the result to our server.
Google does not store your photos as part of Gemini API processing — processing is transient. See Google's API Service Terms for details.
The original and generated photos are then stored in your account on Google Cloud Storage — accessible only to you through the App.
We use asynchronous job queuing (Google Cloud Tasks) to manage processing load. Your photo may be held briefly in a queue before processing begins.
All third-party services we use (including Google) are required to provide the same or equal level of data protection as described in this Privacy Policy, in accordance with their published terms of service and privacy policies.

6. Third-Party Services

We use the following third-party services to operate STORM Studio. Each service processes data in accordance with its own privacy policy:

Service	Provider	Data Processed	Privacy Policy
Firebase Authentication	Google LLC	Apple ID token, email	firebase.google.com/support/privacy
Google Cloud Storage	Google LLC	Photos (originals & generated)	cloud.google.com/privacy
Google Firestore	Google LLC	Profiles, history, transactions	cloud.google.com/privacy
Google Gemini API	Google LLC	Photos (transient, not stored by Google)	ai.google.dev/terms
Google Cloud Run	Google LLC	Server-side request processing	cloud.google.com/privacy
Google Cloud Tasks	Google LLC	Generation queue data	cloud.google.com/privacy
Firebase Cloud Messaging	Google LLC	Device push token	firebase.google.com/support/privacy
RevenueCat	RevenueCat, Inc.	Purchase history, subscription data	revenuecat.com/privacy
Apple StoreKit 2	Apple Inc.	Payment processing	apple.com/legal/privacy
Kingfisher	Open-source library	Local on-device image cache only	No external data transmission

We do not sell your personal data to any third party. We share data with third parties only as described above (to operate the Service) or when required by law.

7. Data Retention

Data Type	Retention Period
Account information (profile, email)	Until you delete your account
Original photos	Until you delete them or delete your account
Generated photos	Until you delete them or delete your account
Generation history	Until you delete your account
Purchase & subscription history	Until you delete your account (may be retained longer for legal/tax obligations)
Analytics data	Up to 14 months (then aggregated or deleted)
Server logs (IP address)	Up to 30 days
Purchased tokens	90 days from purchase date, then expired
Local image cache (on device)	Managed by iOS; cleared automatically by the system

8. Data Security

We take reasonable technical and organizational measures to protect your data, including:

Encryption in transit: All data transmitted between the App, our servers, and third-party services is encrypted using TLS/HTTPS.
Encryption at rest: Photos and user data stored on Google Cloud Storage and Firestore are encrypted at rest using Google's default encryption.
Access controls: Access to production data is restricted to authorized personnel only.
Authentication: Sign in with Apple provides secure, token-based authentication.

No system is 100% secure. While we work to protect your information, we cannot guarantee absolute security. If you become aware of a security vulnerability, please contact us at support@stormstudio.club.

9. Social Media — Discovery Feed & Promotional Posting

Important disclosure: Photos you publish to the Discovery Feed may be shared on STORM Studio's official social media accounts on Instagram and Twitter/X for promotional purposes.

When you publish a photo to Discovery, you consent to this use. We will credit your STORM Studio username where reasonably possible. You can remove your photo from Discovery at any time; however, content already posted to our social media may remain there unless you contact us to request removal.

The Discovery Feed is publicly visible within the App. Do not publish photos you wish to keep private.

10. Push Notifications

Push notifications are strictly opt-in. We may send:

Notifications about new presets from creators you follow.
App updates and announcements.
Marketing and promotional messages (only if you have opted in).

You can withdraw consent at any time by going to your iPhone's Settings → Notifications → STORM Studio and disabling notifications. Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal.

11. Children's Privacy

STORM Studio is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at support@stormstudio.club and we will promptly delete the information.

Users between 13 and 17 may use the App only with parental consent, as described in our Terms of Use.

12. International Transfers

Our infrastructure is primarily operated through Google Cloud, which may process and store your data in data centers in the United States and other countries. If you are located in the European Economic Area (EEA), UK, or Switzerland, your data may be transferred to countries that may have different data protection standards than your country of residence.

Google Cloud has implemented appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission. By using the App, you consent to this transfer.

13. Your Privacy Rights

13.1 Rights Available to All Users

Access: Request a copy of the personal data we hold about you.
Correction: Ask us to correct inaccurate data.
Deletion: Delete your account and all associated data from within the App (Settings → Delete Account), or contact us to request deletion.
Opt out of marketing: Opt out of push notifications via your device settings.
Data portability: Request a copy of your data in a portable format (to the extent technically feasible).

13.2 GDPR Rights (EEA, UK & Switzerland)

In addition to the above, if you are in the EEA, UK, or Switzerland, you also have the right to:

Restrict processing of your data in certain circumstances.
Object to processing based on legitimate interests.
Withdraw consent at any time for processing based on consent (without affecting prior processing).
Lodge a complaint with your local data protection authority (supervisory authority).

13.3 CCPA Rights (California Residents)

California residents have the right to:

Know what personal information we collect, use, disclose, and sell.
Delete personal information we have collected (subject to certain exceptions).
Opt out of the sale of personal information. We do not sell your personal information.
Non-discrimination for exercising your CCPA rights.
Correct inaccurate personal information.
Limit use and disclosure of sensitive personal information.

To exercise CCPA rights, contact us at support@stormstudio.club with the subject line "CCPA Request". We will verify your identity before processing requests.

13.4 How to Submit a Request

For any privacy request:

Delete your account: Use Settings → Delete Account within the App (fastest method).
Other requests: Email support@stormstudio.club with the subject "Privacy Request".

We will respond to verified requests within 30 days (or as required by applicable law). We may need to verify your identity to process your request.

14. Account Deletion — What Gets Deleted

When you delete your account, the following is permanently and irreversibly removed:

Your profile and account data.
All original photos and AI-generated photos.
Your generation history.
Your token balance.
Your favorites, following, and likes.
Your Creator Program data and published presets (if applicable).
Your push notification device token.

The following may be retained temporarily after deletion:

Server logs — up to 30 days for security purposes, then deleted.
Purchase history — may be retained for legal and accounting obligations as required by law.
Aggregated, anonymized analytics — retained as they cannot be linked back to you.

Important: Deleting your account does not automatically cancel an active subscription. You must cancel your subscription separately through the App Store to prevent future charges.

15. Sign in with Apple & Hide My Email

We use Sign in with Apple for authentication. If you choose Apple's "Hide My Email" option, Apple provides us with a private relay email address (e.g., something@privaterelay.appleid.com) instead of your real email. We receive and store only this relay address. We will use it solely for essential account communications (e.g., account support). We do not attempt to identify your real email from the relay address.

You can disable the relay at any time through your Apple ID settings, which may affect our ability to contact you.

16. Local Caching

The App uses Kingfisher, an open-source iOS image caching library, to store images locally on your device for faster loading. This cache:

Is stored only on your device — not transmitted anywhere.
Is managed automatically by iOS (cleared when your device needs space or the App is uninstalled).
Can also be cleared manually by uninstalling and reinstalling the App.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the App or sending an email to the address associated with your account. The "Last updated" date at the top of this page indicates when the Policy was last revised. Your continued use of the App after changes become effective constitutes acceptance of the updated Policy.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us:

Email: support@stormstudio.club
Website: https://stormstudio.club

We will do our best to respond to all inquiries within 30 days.