Privacy Policy

This Privacy Policy explains how Reelio (“we”, “us”) collects, uses and protects your personal data when you use the Reelio iOS app and this website. We keep it in plain language, because you should actually be able to read it.

Controller: Omar Ashour, Rügländer Straße 6, 91522 Ansbach, Germany — email: support@reel-io.com

1. The short version

• Your videos are uploaded only so our AI can analyze them, then deleted automatically — we keep the results, not your footage.
• We never post to your social accounts — we never even connect to them.
• We don’t sell your data and we don’t use your videos for advertising.
• If you join the website waitlist, we use your email only for early access, launch updates and the promised waitlist benefit.
• You can delete your account and all associated data at any time, directly in the app — section 6 lists the few minimal records we have to keep afterwards.

2. Data we collect

Account data

When you create an account: your email address, display name, chosen avatar, and the content preferences you pick during onboarding (niches, target audiences, goals, audience size). If you continue as a guest, we store a device identifier instead of an account.

Videos and analysis results

The video you upload for analysis is used only to generate your results and is then deleted automatically (see section 6). We retain the AI-generated results (scores, verdicts, fixes, captions, hook rewrites, cover images, playbooks) and technical metadata about each analysis (e.g. video duration, processing tokens, timestamps) — but not the original video.

Choosing a cover image on your device

To suggest a cover, the app looks at a handful of frames from your video on your device and scores them for visual quality, using Apple’s built-in Vision framework. Part of that score is whether a frame contains a well-captured face, so that a blurry or half-turned shot isn’t chosen. It measures picture quality only: it does not recognise or identify anyone, it does not create a face template, faceprint or any other biometric identifier, and nothing from this step — no frame, no score — ever leaves your phone.

Purchase data

Your subscription status and check balance, plus the opaque identifier Apple assigns to your subscription, which we store alongside your account so that renewals are applied to the right account. Payments are processed entirely by Apple — we never see your payment details.

Usage and diagnostics

Product analytics (screens visited, features used) and crash reports, so we can understand what to improve, plus a push notification token if you enable notifications. As a guest, analytics are tied only to a random identifier. Once you sign in, they are linked to your account ID — never to your email address, your videos, your results or your payment details. Crash reports are configured not to include your IP address.

Website waitlist data

If you join the waitlist, we collect your email address, signup time and an approximate country derived by our hosting provider. We then send a confirmation email to that address, and the signup only becomes effective when its link is clicked (double opt-in); an address that is not confirmed within 7 days is deleted automatically, along with everything entered with it. If the link you arrived by carried a campaign tag (for example which social profile it was posted on), we store that tag and the domain of the page that referred you, so we can tell which channels people actually come from; neither identifies you. We also use a short-lived, IP-based counter to prevent automated signup abuse; the counter expires after one hour.

As evidence of your consent, the signup record also keeps the version of the consent sentence shown under the form at the time, the IP address the signup was made from, and the time and IP address of the confirmation click (Art. 7(1) GDPR requires us to be able to demonstrate consent). These are retained for as long as the signup itself.

To keep automated signups out, the form is protected by Cloudflare Turnstile. Cloudflare checks the request (your IP address and technical characteristics of your browser) to distinguish people from scripts, on our behalf and only for that purpose (Art. 6(1)(f) GDPR, legitimate interest in keeping the list and our email sending free of abuse). We do not use Turnstile’s “pre-clearance” mode, the one variant that would set a cookie.

3. What we use it for

• Providing the service — analyzing your videos and showing your history and progress (Art. 6(1)(b) GDPR, contract performance).
• Personalization — tailoring feedback, trends and playbooks to your niche and goals (Art. 6(1)(b) GDPR).
• Fair-use enforcement — counting checks and preventing abuse of free quotas (Art. 6(1)(f) GDPR, legitimate interest).
• Notifications — analysis-ready and progress notifications, only if you opt in (Art. 6(1)(a) GDPR, consent).
• Improving the product — aggregated analytics and crash reports (Art. 6(1)(f) GDPR).
• Waitlist, launch and product updates — confirming your signup, providing early access, applying your waitlist benefit, telling you when Reelio launches and sending occasional updates about the product, based on the request you make when submitting the form (Art. 6(1)(a) GDPR, consent). You can withdraw at any time, and every such email carries an unsubscribe link.
• Account emails — if you create an account, we send a short welcome series when you sign up, a reminder when your monthly free check becomes available, a confirmation if you subscribe to Pro, and notices about your subscription (that it is about to end, or that it has ended) (Art. 6(1)(b) GDPR, contract performance, and Art. 6(1)(f) GDPR, legitimate interest in helping you use what you signed up for). The tips and monthly reminders carry an unsubscribe link; emails needed to run your account, such as sign-in codes and subscription notices, do not.

4. AI processing of your videos

To generate your analysis, your video is processed by a third-party AI model provider (Google Gemini). The video is transmitted securely for the sole purpose of generating your results and is subject to the provider’s API data protection terms; we use the paid API tier, under which API content is not used by Google to train its models. Google may retain API inputs for a short period for abuse monitoring under those terms. Once the analysis completes, the video is deleted from our storage. Your analysis results belong to your account, and your videos are never published or shared with other users.

5. Service providers we rely on

• Supabase — database, authentication and secure video storage, hosted in Zurich, Switzerland (a country with an EU adequacy decision).
• Apple and Google (sign-in) — if you choose “Sign in with Apple” or “Sign in with Google”, that provider confirms your identity to us and receives the fact that you signed in to Reelio; we receive your name and email address (or Apple’s private relay address) from them.
• Google Gemini API — AI analysis of uploaded videos and generation of feedback and covers.
• Apple — App Store distribution, in-app purchases and push notification delivery (APNs).
• Superwall — displaying and testing our paywall and subscription offers.
• PostHog (EU cloud) — product analytics, hosted in the European Union.
• Sentry — crash and error diagnostics; configured not to collect your IP address.
• Cloudflare — website hosting, security and storage of the waitlist in Cloudflare KV.
• Resend — sending our emails: sign-in codes, account and welcome emails, waitlist confirmation, launch announcements and product updates.

Where providers process data outside the EU/EEA, transfers are safeguarded by an EU adequacy decision, the EU–US Data Privacy Framework or Standard Contractual Clauses.

6. How long we keep your data

Uploaded videos are not stored long-term. Your video is deleted from our storage as soon as its analysis finishes — and, if an analysis is interrupted before it completes, by an hourly clean-up that removes anything older than 24 hours. We keep only the results of each analysis (scores, feedback and the generated cover image), never the original footage.

Your analysis results and account data are kept for as long as your account exists, so you can track your progress over time. When you delete your account, your personal data and analysis history are deleted. We may retain minimal records where the law requires it (e.g. purchase records for tax purposes) and minimal abuse-prevention flags (e.g. that a device already used its free checks).

If you have ever subscribed to Pro, deleting your account leaves one further minimal record behind: the opaque identifier Apple assigns to that subscription, together with a one-way hash (SHA-256) of the email address the deleted account used. The address itself is erased at the moment of deletion, and the hash cannot be turned back into it. We keep this record because one Apple subscription belongs to exactly one Reelio account: it stops the same subscription being activated on a second account, and it lets our support team give you your Pro access back if you return — by hashing the address you contact us from and checking it against the stored hash (Art. 6(1)(f) GDPR, legitimate interest in preventing subscription sharing and in resolving billing problems). It holds no name, no readable email address and no payment data. We keep it for as long as that purpose lasts, because an Apple subscription identifier can reach us again at any time; you can ask us to erase it sooner by emailing support@reel-io.com, but once it is gone we can no longer restore a subscription that was bought under the deleted account.

Waitlist records are kept while you remain subscribed to our launch and product updates, so we can apply the promised early-access benefit and keep you informed. Unconfirmed signups expire after 7 days on their own. You can unsubscribe or withdraw your consent at any time — via the unsubscribe link in any update email, or by emailingsupport@reel-io.com. When you do, we stop emailing you immediately and delete the record; we keep only your address on a suppression list, so that it is never emailed again, and the record of your original consent (its wording version, time and IP address) for three years — the general limitation period for claims (§ 195 BGB) — so that we can demonstrate the consent if asked. Addresses that have not created a Reelio account within twelve months of launch are deleted. The IP-based abuse counter expires automatically after one hour.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• correct inaccurate data (Art. 16),
• have your data deleted (Art. 17),
• restrict processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw any consent at any time (Art. 7(3)),
• lodge a complaint with a supervisory authority (Art. 77).

The fastest way to delete app data is in the app: Profile → Delete Account. To remove a waitlist email, withdraw consent or make any other request, email support@reel-io.com.

The supervisory authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You may also complain to the authority in the country where you live.

No automated decisions about you. Reelio’s scores and feedback are AI-generated content about a video, not decisions with legal or similarly significant effects on you (Art. 22 GDPR). Your check balance is counted automatically, but whether you keep using the Service is never decided by an algorithm.

8. Children

Reelio is not directed at children under 16. We do not knowingly collect data from children; if you believe a child has provided us data, contact us and we will delete it.

9. This website

This website does not set cookies or run third-party advertising trackers. The one thing it stores in your browser is your light/dark theme choice, and only after you use the toggle in the header — that is a setting you asked for, stored so it survives a reload (§ 25(2) TDDDG, strictly necessary for a function you requested), and it is never sent anywhere. Apart from the optional waitlist form described above (including its bot check), the site does not collect information directly from you. Server access logs (IP address, requested page, timestamp) may be processed briefly by Cloudflare for security and delivery (Art. 6(1)(f) GDPR, legitimate interest).

We do measure how the site is used, with PostHog (EU cloud, the same provider as the app — see section 5). It is configured to store nothing on your device: no cookies, no local storage, and no identifier that survives the tab. That means it counts visits and steps — a page opened, the waitlist form started, an address submitted — without being able to recognise you on a later visit or across devices. We do not record your screen, and the analytics never receive the address you type — not before you submit the form and not after; they record only that a signup happened and, if the link carried one, its campaign tag. Your browser's “Do Not Track” setting is honoured: if it is on, nothing is measured at all (Art. 6(1)(f) GDPR, legitimate interest in understanding whether the site works).

10. Changes to this policy

We will update this policy as the product evolves and note the date of the latest revision at the top. For significant changes we will inform you in the app.