Privacy Policy.

This Privacy Policy describes how Swell Games, TOO ("we", "us", or "our") collects, uses, and protects your information when you use the Flash7X mobile application and visit www.flash7x.app. We are committed to protecting your privacy and handling your data transparently.

1. Data We Collect In the App

Flash7X processes all image and photo data exclusively on your device using native Metal shaders. We do not upload, transmit, or store your photographs on any external servers.

We collect the following limited technical data:

• — Camera access: Used solely to display the live viewfinder and capture photos. Images are processed on-device and saved to your Photo Library only with your permission.
• — Photo Library access: Only accessed if you choose to save a captured image or import a photo for processing. We do not read your existing library.
• — Anonymous crash diagnostics: Collected via Firebase Crashlytics to improve application stability. These reports contain no personally identifiable information and no image data.
• — Anonymized usage analytics: Collected via Firebase Analytics (linked to Google Analytics 4). This includes session duration, feature interactions, and device type. No photos or personal identifiers are included.
• — Purchase history: Subscription status is managed securely by Apple StoreKit. We receive only anonymized confirmation of active subscription status — never your payment card details.
• — App Tracking Transparency (ATT): Flash7X does not use the Apple Advertising Identifier (IDFA) and does not display an ATT prompt. We do not track you across third-party apps or websites for advertising purposes.

2. Data Collected via the Website & Payments

When you visit www.flash7x.app:

• — Analytics cookies: We use Google Analytics 4 (GA4) via Firebase to understand how visitors interact with the site. This data is anonymized and aggregated. Visitors from the EEA, the UK, and Switzerland are prompted for cookie consent via our cookie banner before any non-essential cookies are set.
• — Advertising click identifiers: If you arrive at our site by clicking an ad, the ad platform may append a click identifier to the URL — a Google click ID (gclid, gbraid, or wbraid), a Meta click ID (fbclid), or a TikTok click ID (ttclid). We store these identifiers in your browser's local storage and, if you make a purchase, attach them to your order as metadata so the purchase can be attributed to the ad campaign. See Section 3 for details.
• — Advertising cookies: Where you have consented (or, outside consent regions, until you decline), the TikTok Pixel sets first-party cookies on our domain — _ttp, ttclid, and ttcsid — and the Meta Pixel sets _fbp and _fbc, used to recognize your visit for the conversion measurement described in Section 3. In the EEA, the UK, and Switzerland neither pixel is loaded at all until you accept via our cookie banner.
• — Email address: If you contact our support team, your email is used solely to respond to your inquiry.
• — Marketing emails: If you enter your email on our site to receive your look guide, or start a checkout without completing it, we may send you the content you requested plus occasional emails about Flash7X — tips, product updates, and reminders about an unfinished checkout. If you ask us to email you your processed photo, the photo is processed in memory and attached to that one email — it is not kept on our servers. Every such email contains a one-click unsubscribe link, honored immediately. We may store the quiz answers and funnel context (e.g. ad click identifier) associated with your email to personalize these messages. We never sell your email or share it with third parties for their own marketing.

Web purchases, if offered, are processed by our payment provider Polar Software, Inc. ("Polar", polar.sh), our Merchant of Record. Polar collects your name, email address, billing address, payment details (processed through its payment processor, Stripe), and related device data directly. We receive only limited purchase metadata (order ID, country, amount) — never your card details. For details on how Polar handles your payment data, please review Polar's Privacy Policy.

3. Advertising Measurement

We advertise Flash7X on Google Ads, TikTok, and Meta (Facebook and Instagram). To measure whether those campaigns work — and only for that purpose — we share limited conversion data with those platforms:

• — Conversion data sent to Google: When you complete a web purchase, we send Google the order ID, purchase value, currency, timestamp, and any Google click ID (gclid, gbraid, or wbraid) associated with your visit. This happens both via the Google tag in your browser and via a server-side upload to Google's conversion measurement API.
• — Hashed email (Enhanced Conversions): Alongside the conversion, we share your email address as a SHA-256 hash — a one-way cryptographic fingerprint that cannot be reversed to reveal your address. Google uses it solely to match the purchase to an ad interaction for more accurate campaign reporting. We never send your plain-text email to Google for advertising purposes.
• — Conversion data sent to TikTok: If you have consented to advertising cookies, the TikTok Pixel records page views and funnel milestones on our site (for example viewing the try-it demo, starting it, submitting your email, and starting a checkout). When you complete a web purchase we also send TikTok the order ID, purchase value, currency, timestamp, your TikTok click ID and pixel cookie identifier, and the IP address and browser user-agent recorded when you started the checkout. This happens both via the TikTok Pixel in your browser and via a server-side upload to TikTok's Events API.
• — Hashed email sent to TikTok: As with Google, your email address is shared only as a SHA-256 hash, used solely to match the purchase to an ad interaction. We never send your plain-text email to TikTok.
• — Conversion data sent to Meta: If you have consented to advertising cookies, the Meta Pixel records page views and funnel milestones on our site (for example viewing the try-it demo, starting it, submitting your email, and starting a checkout). When you complete a web purchase we also send Meta the order ID, purchase value, currency, timestamp, your Meta click ID (fbclid) and pixel browser identifier, and the IP address and browser user-agent recorded when you started the checkout. This happens both via the Meta Pixel in your browser and via a server-side upload to Meta's Conversions API.
• — Hashed email sent to Meta: As with Google and TikTok, your email address is shared only as a SHA-256 hash, used solely to match the purchase to an ad interaction. We never send your plain-text email to Meta.

Each platform's use of this data is governed by its own policies — see Google's Privacy Policy and TikTok's Privacy Policy, and Meta's Privacy Policy. In the EEA and UK (and anywhere else consent is required), advertising cookies and identifiers are used only if you consent via our cookie banner: Google ad storage is denied by default (Google Consent Mode v2) and neither the TikTok Pixel nor the Meta Pixel is loaded at all until you accept. You can change your choice at any time via the "Cookie settings" control on our site; declining also stops any further conversion data being sent to these platforms.

4. Try-It Demo Photo Processing

Our website offers a free try-it demo that applies the Flash7X look to a photo you choose. For most visitors, this processing happens entirely on your device, in your browser — the photo is never uploaded anywhere.

For some visitors, we generate the preview on our servers instead: the photo you select is transmitted over an encrypted connection to our processing server, where our own image-processing software applies the Flash7X look and returns the graded preview to your browser. The photo is processed in memory only — it is not stored on our servers, not retained after the preview is returned, not shared with any third party (including any third-party AI service), and never used for advertising, to train any model, or to identify you.

When server-side processing is used, we keep a technical log of the request: a random device identifier generated by your browser, a salted hash of your IP address (the raw address is never stored), your browser's user-agent string and language preference, the advertising click identifier from the link you arrived through (as described in Section 3), image dimensions, processing timings, and automated quality scores. This log contains no photo content and is used solely for fraud prevention, spend control, and quality monitoring of the demo.

5. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your data on the following lawful bases:

• — Contract performance: To provide the Flash7X application and subscription service you have purchased.
• — Legitimate interest: To analyze usage patterns and improve application stability via anonymized analytics and crash reports.
• — Consent: For optional analytics cookies and for advertising measurement on the website (Section 3). You may withdraw consent at any time via the "Cookie settings" control.

6. Third-Party Services

We use the following third-party services. Each operates under its own privacy policy:

• — Firebase / Google Analytics: Analytics, crash reporting, and performance monitoring. Firebase Privacy
• — Google Ads: Advertising conversion measurement, including Enhanced Conversions with hashed email addresses and click IDs, as described in Section 3. Google Privacy
• — TikTok: Advertising conversion measurement via the TikTok Pixel and Events API, including hashed email addresses, click IDs, and purchase values, as described in Section 3. TikTok Privacy
• — Meta (Facebook/Instagram): Advertising conversion measurement via the Meta Pixel and Conversions API, including hashed email addresses, click IDs, and purchase values, as described in Section 3. Meta Privacy
• — Apple StoreKit: In-app subscription management and purchase validation.
• — Polar Software, Inc. (polar.sh): Payment processing and Merchant of Record for web purchases. Polar Privacy

We do not sell your personal information to any third parties. We do not build behavioral advertising profiles of you ourselves, and we do not share your data with advertising platforms for their independent profiling — the only advertising-related sharing we do is the limited, hashed conversion data described in Section 3, used solely to measure the performance of our own ad campaigns.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• — Access: Request a copy of the personal data we hold about you.
• — Correction: Request correction of inaccurate data.
• — Deletion: Request deletion of your personal data ("right to be forgotten").
• — Restriction: Request that we limit processing of your data.
• — Portability: Request your data in a structured, machine-readable format.
• — Objection: Object to processing based on legitimate interest.
• — Opt out of advertising measurement: Decline or withdraw consent for advertising cookies and conversion measurement at any time via the "Cookie settings" control on our site. You may also ask us to exclude your data from ad measurement by contacting us.
• — California residents (CCPA/CPRA): You have the right to know, delete, and opt out of the sale or sharing of personal information. We do not sell personal information; to opt out of the sharing of conversion data for ad measurement, use the "Cookie settings" control or contact us.

To exercise any of these rights, contact us at support@flash7x.app.

8. Data Retention

Anonymized analytics and crash data is retained for up to 14 months in accordance with Google Analytics default settings. Support correspondence is retained for up to 3 years. Purchase records are retained as required by applicable tax law. Photos are processed on your device or, for the server-generated try-it preview (Section 4), in memory only — we retain no image data whatsoever.

9. Children

Flash7X is not directed at children under the age of 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately at support@flash7x.app.

10. Security

We implement appropriate technical and organizational measures to protect your data. All data transmitted between the app and third-party services uses TLS encryption. In the app, image processing is entirely on-device — your photos never leave your device through our systems. On the web try-it demo, any server-processed photo (Section 4) is transmitted over TLS and handled in memory only.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. Continued use of Flash7X after any changes constitutes acceptance of the updated policy.