Privacy Policy

App: Reel Wrap (shown as “Wrap” on your home screen)
Developer: Nahit Rüştü Heper (sole proprietor)
Last updated: September 4, 2026

1. Who we are

Reel Wrap (“App”, “we”, “our”, “us”) is developed and operated by Nahit Rüştü Heper, an individual developer (sole proprietor). For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), we are the data controller for the personal data described in this policy. Contact: [email protected].

This policy applies to the Reel Wrap iOS app and to this website. It does not apply to third‑party apps or services you share content to (for example Instagram or TikTok); their own privacy policies apply there.

2. What the App does with your photos and videos

To fill a template you grant the App access to your photo library (iOS asks for this permission). The App only reads the items you select. All trimming, effects, adjustments and rendering happen locally on your device. Your photos, videos and exported reels are not uploaded to our servers or to any third party by the App. Sharing to Instagram or TikTok happens through those apps, after you tap Share, and is governed by their terms.

Saved projects are stored only on your device. Deleting the App deletes them.

3. Information we collect

3.1 Information you give us

• Support email. If you contact us, we receive your email address and the content of your message.
• Notification choices. Whether you enabled reminders and which topics you opted into (stored on your device and, for remote notifications, as a topic subscription with Firebase).

3.2 Information collected automatically

When you use the App, we and the service providers listed in section 5 collect:

• Identifiers: a per‑app device identifier (Apple’s identifier for vendors), a randomly generated app‑instance ID, an anonymous Firebase user ID, an anonymous RevenueCat customer ID, a push‑notification token, and — only if you allow tracking — Apple’s advertising identifier (IDFA).
• Device and app information: device model, iOS version, language, region, time zone, app version, and a coarse, IP‑derived location (country or city level). We do not collect precise GPS location.
• Usage events: screens viewed, templates opened, liked and used, editing actions (for example trims, effects, adjustments), exports started and completed, shares tapped, paywall views, notification prompts shown and answered, and errors encountered. Events are tied to the identifiers above, not to your name.
• Purchase information: the product purchased, price, currency, transaction and renewal status, delivered to us and to RevenueCat by Apple. We never see your payment card or Apple ID password.
• Crash and diagnostic data: crash logs, stack traces, device state at the time of a crash, and certificate‑validation failures.
• Server logs: when the App downloads the template catalogue and template assets from our servers and content delivery network, standard web‑server logs record your IP address, request time, app version and user agent. Nothing else is sent to our servers.

3.3 What we do not collect

• No name, account, password or contact list.
• No face, biometric or health data.
• No precise location.
• No copies of your photos, videos or exported reels.

4. Why we use this information and our legal bases

5. Service providers and how they receive data

We do not sell your personal data for money. We share it with the following providers, who process it on our behalf or, in the case of advertising partners, for measurement in accordance with their own policies.

We may also disclose information if required by law, to enforce our Terms, to protect the rights and safety of users, or to a successor if the App is sold or transferred (you will be notified).

6. Advertising, tracking and your choices

We run ads for Reel Wrap on Meta and TikTok. To know whether those ads work, the App can share your device’s advertising identifier (IDFA) and events such as installs and purchases with Meta and TikTok, who may combine them with data they hold about you. This is “tracking” as defined by Apple and is treated as “sharing” for cross‑context behavioural advertising under California law.

• It only happens with your permission. iOS shows an “Allow tracking?” prompt. If you choose “Ask App Not to Track”, the IDFA is not shared.
• Change your mind any time: iOS Settings → Privacy & Security → Tracking → Reel Wrap. You can also turn off “Allow Apps to Request to Track” globally, and enable “Limit Ad Tracking”.
• Without tracking permission we still receive privacy‑preserving, aggregated attribution from Apple’s SKAdNetwork and event counts that are not linked to your advertising identifier.
• The App does not display third‑party ads.

7. Notifications

The App can send two kinds of notifications, both optional:

• Local reminders scheduled on your device (for example a reminder about a template you previewed, or after you have not used the App for a while). These need no server and do not send data anywhere.
• Remote notifications about new templates or offers, delivered through Firebase Cloud Messaging and Apple Push Notification service using a push token and topic subscriptions.

We only ask for notification permission after you tap “Yes” on an in‑app pre‑prompt. You can turn notifications off in the App (More → Notifications) or in iOS Settings → Notifications → Reel Wrap. When you turn them off in the App we cancel scheduled reminders and unsubscribe your device from our topics.

8. Retention

We keep data only as long as needed for the purposes above, using our providers’ default retention settings:

• Analytics: Google Firebase’s default retention, currently 2 months for user‑level and event‑level data; aggregated reports are retained longer.
• Crash reports: 90 days (Crashlytics default).
• Push tokens and topic subscriptions: until you turn notifications off, delete the App, or the token expires after roughly 9 months of inactivity.
• Purchase records: for as long as your subscription is active and afterwards as long as required for accounting, tax and dispute purposes.
• Advertising measurement data: held by Meta and TikTok according to their policies; we keep only aggregated campaign reports.
• Server logs: a short rolling period for security and debugging.
• Support emails: as long as needed to resolve your request and handle any follow‑up.
• Your photos, videos and projects: only on your device; removed when you delete them or the App.

9. International transfers

Our providers process data in the United States and other countries. Where data leaves the European Economic Area, the United Kingdom or Switzerland, transfers rely on the EU–US Data Privacy Framework where the provider is certified and otherwise on the European Commission’s Standard Contractual Clauses (and the UK Addendum), together with additional safeguards.

10. Security

Data in transit is encrypted with HTTPS. Connections to our servers additionally use certificate pinning, and requests are protected by Apple App Attest / Firebase App Check to keep automated abuse out. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data;
• restrict or object to processing, including processing based on legitimate interests;
• withdraw consent (for tracking and notifications, see sections 6 and 7);
• data portability;
• not be discriminated against for exercising these rights;
• lodge a complaint with your data‑protection authority (in the EU, your national supervisory authority; in the UK, the Information Commissioner’s Office).

California (CCPA/CPRA). The categories of personal information we collect are identifiers, commercial information, internet or network activity, and coarse geolocation. We do not sell personal information for money. Sharing with Meta and TikTok for advertising measurement is “sharing” under the CPRA; you can opt out by declining or revoking tracking permission as described in section 6. We do not knowingly sell or share the personal information of consumers under 16.

Brazil (LGPD). You have the rights listed in Article 18 of the LGPD, including confirmation of processing, access, correction, anonymisation, deletion and information about sharing. Contact us at the email below.

How to exercise your rights. Email [email protected]. Because the App has no accounts, we cannot always link data held by our providers to you. To help us find your data, include your device model, approximate install date and, if you made a purchase, the order ID from your Apple receipt. We respond within 30 days (45 days for California requests) and may ask for information needed to verify the request. Deleting the App removes all local data immediately; to also remove data held by our providers, send us a deletion request and we will action it with them.

12. Children

Reel Wrap is rated 12+ on the App Store and is not directed at children. We do not knowingly collect personal data from children under 13 (or under 16 in the European Economic Area and the UK, or the age of digital consent where you live). If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy when the App or the law changes. The “Last updated” date at the top shows the current version. For significant changes we will notify you in the App.

14. Contact

Nahit Rüştü Heper
[email protected]