Boom Privacy Policy

This policy applies to the Boom app only. Boom turns a photo that you choose into a toon, a comic or an action figure image. To do this, Boom sends your photo and your text to our server and to AI service providers. This page tells you what data Boom uses, why it uses the data, who processes it, how long we keep it and how you can delete it.

Summary

• Boom has no sign-up. We do not ask for your name, email address or phone number in the app.
• Boom uploads the photo that you choose, and the text that you type, to make your image.
• Third-party AI service providers process the photo and the text on our behalf to create the image.
• We do not sell your data. We do not use your photos or your text to train AI models.
• Boom uses the advertising identifier (IDFA) only if you allow tracking in the Apple tracking prompt.
• Boom deletes your photo, your pictures and your text from our server 30 days after you make a picture. You can delete a picture earlier in History.
• Our server keeps an action log for support, refunds and fraud prevention for 24 months. It has no photos, no text that you typed and no image content.
• To delete all your data, email support@tensortechapps.com.

1. The data that Boom uses

Photos and text that you give

• The photo that you choose. Boom reads only the photo that you pick from your library. Boom does not read your other photos. Boom does not use the camera.
• The text that you type. For example, the story for a comic, the box title, subtitle, outfit and items for an action figure, the speech bubble text, or a custom style description.
• The images that Boom makes. These are the results that you see in History.
• Your choices in the app. For example, the style that you pick and the images that you like.

We do not use your photos for facial recognition, identity checks or biometric analysis.

An app user id and device checks

• When you open Boom for the first time, our server makes a random user id and a recovery secret. Boom keeps them in the iOS Keychain on your device. They are not synced to iCloud. The id lets Boom show your History and your coins again after you reinstall the app on the same device.
• Boom uses Apple App Attest (or Apple DeviceCheck as a fallback) to confirm that requests come from the real Boom app on a real Apple device. Our server keeps the App Attest key data and the device check result with your user id.
• Our server keeps the app version and the time of your last request.

Purchases and coins

You buy coin packs and subscriptions through Apple. We do not receive your payment card details. RevenueCat processes your purchases, your subscription status and your coin balance. Our server keeps a record of the coins that each image costs and of refunds for failed images. RevenueCat can send our server purchase events (for example, a purchase, a renewal or a transfer of a purchase to another Boom user id). Our server records the event type, the product, the price, the currency, the store and the store transaction id in the action log, for support and refund requests.

When you ask Apple for a refund of an in-app purchase, Apple can ask us for information about how the purchase was used. RevenueCat sends this consumption information to Apple for us (for example, that the coins were delivered and the in-app usage status). Apple uses this information to decide on the refund request.

The action log

Our server keeps a log of the actions of your Boom user id. We use it to answer support requests, to handle refund disputes and to prevent fraud. A log entry has:

• the action, for example: the app started a session, a push token was registered, a picture was created, completed, failed, refunded, liked, deleted or automatically deleted, coins were spent, refunded or corrected, or a purchase event arrived from RevenueCat;
• the picture id and the style, the number of coins and a reference to the coin record;
• the app version and the time;
• for a completed picture, a SHA-256 fingerprint of the delivered picture. The fingerprint shows that we delivered a picture. Nobody can make the picture again from the fingerprint.

The action log also records the refunds and the coin transactions that RevenueCat reports to our server. For these entries it records the event type, the product, the price, the currency, the store transaction id and the reason (for example, a refund by Apple or a cancelled subscription). We use these entries for support and refund disputes. We keep them for 24 months, the same as all action log entries.

The action log has no photos, no text that you typed and no image content.

Push notifications

If you allow notifications, Boom sends a Firebase Cloud Messaging (FCM) token to our server. We use it to tell you when your image is ready and when new styles are available. You can turn off notifications in the iOS Settings app.

Analytics and crash reports

• Firebase Analytics records how you use the app (for example, which screens you open and which features you use). We set your Boom user id as the Analytics user id.
• Firebase Crashlytics sends crash reports and error reports with device and app data.
• Firebase Remote Config loads app settings from Google servers.

Marketing attribution and the advertising identifier

• Boom uses the SolarEngine SDK for install attribution. It tells us which advertising campaign, if any, brought you to the app. SolarEngine receives device data, such as the device model, the OS version and the IP address.
• Boom shows the Apple App Tracking Transparency prompt. SolarEngine and RevenueCat get the advertising identifier (IDFA) only if you tap Allow. If you do not allow tracking, Boom does not use the IDFA.
• Boom uses Google on-device conversion measurement through SolarEngine to measure our Google Ads campaigns. We send revenue events (for example, a purchase) to measure our advertising, for example in Google Ads.
• Through SolarEngine, advertising partners such as Google Ads and TikTok receive attribution data (for example, an install or a purchase event and the campaign that it came from). With your permission, this data can include the IDFA.
• Boom does not show ads.

2. Why we use the data

• To make the images that you ask for and to show them in History.
• To process purchases and to keep your coin balance correct.
• To stop abuse and fraud (device checks, request limits and the action log).
• To answer support requests and to handle refund disputes (the action log).
• To send the notifications that you allowed.
• To fix crashes and to make the app better.
• To measure our advertising campaigns.
• To answer your support emails.

3. Who processes your data

We share data only with the service providers below. They process the data on our behalf, for the purposes in this policy.

• Third-party AI service providers. They receive the photo that you choose, the text that you type and the style instructions. They process this data on our behalf to create the image and send the result back to our server.
• Cloudflare. Cloudflare hosts our server, our database, our file storage and our request queue.
• Google Firebase. Analytics, Crashlytics, Remote Config and Cloud Messaging.
• RevenueCat. Purchases, subscriptions and coin balance.
• SolarEngine. Install attribution. SolarEngine sends attribution data to advertising partners such as Google Ads and TikTok.
• Apple. App Store purchases, App Attest, DeviceCheck and push delivery.

We do not sell your personal data. We do not share your photos with advertisers. We can disclose data if the law requires it.

4. How long we keep your data

• Your original photo, the full-size result without the Boom watermark and the result images in History: our server deletes them automatically 30 days after you make the picture. The picture then no longer shows in History. If you delete a picture in the app, our server deletes them at once. We also delete the original photo at once if the request stops before we charge coins (for example, when you do not have enough coins).
• Copies in caches: each result image has a long random web address. A person who has that address can open the image. After a delete, an internet cache can still show a copy at that address for up to 1 day. Pictures that you saved to Photos or shared are not on our server, and we cannot delete them.
• The text that you typed: our server deletes it from the request record when you delete the picture, or automatically 30 days after you make the picture.
• The request record without your text (the id, the style, the status, the times and the coin charge): we keep it in our database for our accounting. It no longer shows in History.
• The coin record (the coins that each image costs and the refunds): we keep it for our accounting.
• The action log: we keep each entry for 24 months. Then our server deletes it automatically. Deleting a picture and the 30-day deletion do not delete the action log.
• Your user id, device check data and push token: we keep them while you use Boom. They have no automatic delete date. Email us to delete them.
• Data at Firebase, RevenueCat and SolarEngine: these providers keep the data for the periods in their own settings and policies.

5. Delete your data

• To delete one picture, open it in History and tap Delete picture. Our server deletes the picture, the original photo and the text that you typed. The request record without your text, the coin record and the action log stay (see section 4).
• To delete all your data, email support@tensortechapps.com.
• Use Menu > Support in the app to write the email. The app adds your support code to the email. The support code lets us find your data. It is not your user id.
• We delete your photos, your results, your request records, your action log, your user id and your device data from our server. We keep only the data that we must keep by law or for an open refund dispute.
• Deleting the app from your device does not delete the data on our server.
• Coins and subscriptions are linked to your Apple purchases. To cancel a subscription, use your Apple ID settings. Deleting your data does not cancel a subscription.

6. Your rights

Depending on where you live (for example, in the European Union or the United Kingdom), you can ask for access to your data, a copy of your data, a correction, a deletion or a restriction of the processing. You can object to the processing. You can also complain to your data protection authority. To use these rights, email support@tensortechapps.com. We answer within one month.

The legal bases for the processing are the performance of our contract with you (to make the images and to process purchases), our legitimate interests (security, crash fixes and app improvement) and your consent (tracking with the IDFA and notifications). You can withdraw your consent at any time in the iOS Settings app.

7. Security

Boom sends all data over HTTPS. Your original photo is in private storage. A link to the original photo is signed and expires after one hour. Request limits and device checks protect the server from abuse.

8. International transfers

Our service providers can process data outside your country, for example in the United States. Where the law requires it, we use the safeguards that the law permits, such as the standard contractual clauses.

9. Children

Boom is not directed to children under 13. We do not knowingly collect data from children under 13. If you think that a child under 13 used Boom, email us and we will delete the data.

10. Changes to this policy

We can change this policy. We will show the new effective date on this page.

11. Contact

TensorTech Apps B.V.
Email: support@tensortechapps.com

See also the Boom support page and the Terms of Service.