Privacy Policy

CutStory: Reels & Story Maker is operated by Highglossy FZE, a company registered in the United Arab Emirates, with its registered office at Al Shmookh Business Center, One UAQ, UAQ Free Trade Zone, Umm Al Quwain, U.A.E. (“we”, “us”). For the purposes of the UK and EU General Data Protection Regulation, we are the data controller for the personal data described here.

Questions, requests and complaints: privacy@highglossy.com.

• Your videos stay on your device. Cutting, templates, subtitles and exports run locally; we have no copy of your footage.
• An account is optional. Most features work without one. If you sign in, we hold the identifier the sign-in provider gives us and, where you share it, your email.
• We do see: subscription status, how the app is used, crash reports, and, only with your permission, an advertising identifier for campaign attribution.
• No selling of personal data, and no advertising inside the app.

• Photos, videos, fonts and music. The app reads the media you pick from your library and writes the result back. It does not upload them.
• Subtitles. Speech recognition runs through the operating system's speech engine. Depending on your device and settings, Apple may process the audio under its own privacy policy; we never receive the audio or the transcript.
• Teleprompter and Live Camera. Scripts and recordings are stored in the app's local storage.
• Publishing. A finished video goes to the social network you choose through its own app or the system share sheet; we never hold your social-network credentials.

Every category we hold, why we hold it, the lawful basis and how long we keep it:

• Account identifier and email (only if you sign in) — To keep your templates and settings across devices and to let you sign in again. Basis: Contract (Art. 6(1)(b) GDPR). Kept: until you delete the account.
• Subscription and purchase records: plan, status, expiry, store product and transaction identifiers, a random Adapty profile ID — To unlock Pro features you paid for and restore them on a new device. Basis: Contract (Art. 6(1)(b) GDPR). Kept: life of the account or installation, then 7 years where tax law requires.
• Usage statistics: which features are used, on which device model and OS version, under a random installation identifier — To understand which features matter and to improve the app. Basis: Legitimate interests (Art. 6(1)(f) GDPR). Kept: 14 months.
• Advertising identifier (only if you allow tracking in the system prompt) — To attribute the installation to the campaign that led to it. Basis: Consent (Art. 6(1)(a) GDPR). Kept: until you revoke permission; attribution data 12 months.
• Push token (only if you allow notifications) — To tell you about new templates and features. Basis: Consent (Art. 6(1)(a) GDPR). Kept: until the token is revoked or goes stale.
• Crash and error reports: stack traces, device model, OS version, app version — To find and fix defects. Basis: Legitimate interests (Art. 6(1)(f) GDPR). Kept: 90 days.
• Support correspondence: your email address and what you write to us — To answer you. Basis: Legitimate interests (Art. 6(1)(f) GDPR). Kept: 24 months.

We do not sell personal data and we do not use it for advertising or profiling.

We use a small number of processors. Each is bound by a data processing agreement and may use the data only to provide the service to us.

• Adapty — subscription management. Receives a random account identifier and purchase events so your plan can be applied and restored.
• Apple — payment processing for in-app purchases. Apple takes the payment; we never see your card number or billing address. Your relationship for the payment itself is with the App Store, under Apple's own privacy policy.
• Google Firebase Analytics — anonymous usage statistics (which features are used, on which kind of device). We have disabled the collection of the advertising identifier in it; it identifies the installation with a random identifier that is reset when you reinstall the app.
• Google Firebase Cloud Messaging — delivery of push notifications. Receives the notification token and the notification text.
• Attribution partner — only if you allow tracking in the App Tracking Transparency prompt, the advertising identifier is used to attribute the installation to the campaign that led to it. Deny the prompt and nothing is sent.
• Crash reporting (Sentry, hosted in the European Union) — receives stack traces, device model, OS and app version. Crash reports carry no IP address and no user identifier.
• Our hosting provider — runs the servers that hold account records and the template catalogue.

We also disclose data where we are legally compelled to: to comply with a legal obligation, to protect our rights or property, to investigate possible wrongdoing in connection with the app, or to protect the safety of users or the public.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

The section above gives the retention period for each category. When you delete your account or ask us to, we delete the records that identify you; backups are purged on a rolling 30-day cycle. We keep purchase records where tax or accounting law obliges us to, and aggregated statistics that no longer identify anyone.

Our servers and those of our processors may be located outside your country, including in the United Arab Emirates and the European Union. Where personal data leaves the UK or the EEA, the transfer relies on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or an adequacy decision, as applicable.

Wherever you live, you can ask us to:

• Give you a copy of the personal data we hold about you, in a portable format.
• Correct anything inaccurate.
• Delete your data. You can do this yourself in the app; we will also do it on request.
• Restrict or object to processing we carry out on the basis of legitimate interests.
• Withdraw consent, for example for notifications by turning them off in your device settings, without affecting what we did before you withdrew it.

Write to privacy@highglossy.com. We respond within 30 days.

If you are in the UK or the EEA, you may also complain to your data protection authority: in the UK the Information Commissioner's Office, in the EEA the supervisory authority where you live.

Under the CCPA as amended by the CPRA, in the last 12 months we collected the categories described above for the business purposes stated there, from you and from your device. We have not sold personal information and we have not shared it for cross-context behavioural advertising. We have no actual knowledge of selling the personal information of consumers under 16.

You have the right to know, delete, correct, and to be free from discrimination for exercising those rights. Exercise them at privacy@highglossy.com.

CutStory: Reels & Story Maker is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with data, write to privacy@highglossy.com and we will delete it.

Data in transit is protected with TLS. Access to our systems is limited to the people who need it to run the service and is logged. No system is perfectly secure, and we will not claim otherwise; if a breach affects your personal data, we will notify you and the competent authority as the law requires.

We will update this policy when what we do changes. The date at the top always reflects the current version. If a change materially reduces your rights or widens what we collect, we will tell you in the app before it takes effect.

Highglossy FZE, Al Shmookh Business Center, One UAQ, UAQ Free Trade Zone, Umm Al Quwain, U.A.E.

Support: support@highglossy.com · Privacy: privacy@highglossy.com