Convert Privacy Policy.

This privacy policy covers the Creovia Convert app ("the app", "Convert") for Android — and for iOS and macOS, when released — made and operated by CREOVIA PRO LLP, a limited liability partnership incorporated under the (Indian) Limited Liability Partnership Act, 2008 (LLPIN: ADA-3738)("we", "us", "our"), registered office: No. 33, 4th Floor, 1st Main, HMT Layout, CBI Road, Ganganagar, R T Nagar, Bengaluru – 560032, Karnataka, India. Privacy contact: [email protected]. We are the data controller — and, for India, the data fiduciary under the Digital Personal Data Protection Act, 2023 — for the personal data described here. The Creovia Pro website has its own policy at creoviapro.com/privacy, and our other app, Creovia Creator, has its own at creoviapro.com/products/creator/privacy.

The short version: your files are converted by your own device, not by our servers. Convert has no accounts — there is nothing to sign in to. We run no content servers and never receive your media. The free tier is ad-supported, and Pro removes the ads. What the app collects is pseudonymous operational data — app-usage events, crash reports, the state of a Pro purchase, and the advertising identifier used to serve and measure ads — and every category is listed below with its purpose, processor and retention.

1. Your videos, audio and photos stay on your device

• Every conversion runs on your device, using the media codecs built into it. Your media is never uploaded to us or to anyone else for processing. The app converts with no network connection at all.
• The app reads only the files you explicitly choose in the system picker, or that you share into it from another app. It does not scan your gallery or your storage.
• Converted output is written where you tell it to go: your gallery, or a folder you pick. While a job runs, the app may hold a private working copy inside its own storage; that copy is deleted once the output has been published, and anything left behind by a failed job is cleaned up automatically.
• Recent is a local list of your finished conversions, stored in the app's own database on the device. It is kept for 30 days and then cleared automatically; you can clear it yourself at any time in Settings. Files you saved to your gallery are ordinary files and stay until you delete them.
• We cannot access, view, scan or moderate your files, your file names or your conversion output. There is no account to attach them to and no server to hold them.
• The app's data is excluded from Android backup and device-transfer, so your conversion history is not copied to Google or to a new device.
• We do not use your content to train AI models — ours or anyone else's.

2. There are no accounts

Convert has no sign-up, no sign-in, and no user profile. We never receive your name, your email address, or any account identifier. The subject of the analytics described below is a random identifier generated on your device at install time — it is not linked to you, and reinstalling the app replaces it. Your Pro purchase is held by Google against your Google Play account, not by us against an account with us.

3. Data we collect, and why

At a glance — each category maps to the disclosures in Google Play's Data safety section, and is explained in full below the table.

• App interactions (usage analytics). Which tools and screens you use, and whether a conversion started, succeeded, failed, timed out or was cancelled — recorded against the random install identifier, never against you. Processed by Google Firebase Analytics and Mixpanel. Analytics can never block, delay or alter a conversion.
• Crash logs and diagnostics. Stack traces, device model and OS version when something breaks, plus a breadcrumb trail of the events that led there, processed by Firebase Crashlytics. Error events carry an exception class name only — never the message, because a message can contain a file name.
• Install identifier. A random UUID created on first launch, plus the Firebase installation ID. Used to tell one device from another in aggregate counts. Not linked to any identity, and replaced if you reinstall.
• Purchase state. Whether the one-time Pro purchase is owned, through Google Play Billing. Payment is handled entirely by Google Play; we never receive your card, bank or billing details. To confirm a purchase, the app may send the product ID, the package name and the Play purchase token to our server, which checks it with Google. Our server keeps no purchase data, except a one-way hash of the token for purchases that were refunded or revoked.
• Remote configuration. The app fetches feature flags and safety switches (for example, disabling a codec that turns out to be broken on a device family, or requiring an update) from Firebase Remote Config. This sends the installation ID and basic app and device attributes to Google.
• Support correspondence. If you email us, we receive your email address and whatever you include, used solely to respond. The in-app "Send feedback" action opens your email app with a message you can read and edit before sending; nothing is transmitted until you send it.

4. What is never collected

• No file names, paths, URIs or folder names.
• No content of any kind. Your media never leaves the device, and text you type into the app is not reported — a custom watermark, for example, is recorded only as a character count.
• No advertising ID inside our analytics. The advertising identifier is used by our ad partners for advertising only (section 5). It is not attached to the product-analytics events described above, so app usage is never joined to an ad profile by us.
• No account identity — because there are no accounts.
• No precise sizes or durations. File sizes and clip lengths are bucketed into ranges (for example "under 5 MB", "1–5 minutes") before being recorded.
• We also do not collect your location, contacts, messages, browsing history, photos beyond the ones you hand to a conversion, or health or financial information. We do not sell personal data, and we do not use your data for third-party marketing.

5. Advertising and consent

• The free tier shows ads served through Google AdMob, and only AdMob — every ad you see is filled by Google. Google may receive your device's advertising identifier and coarse, non-identifying device information in order to serve, frequency-cap and measure ads. If we ever add another ad network, this policy will name it here before that version ships.
• Google may also share that same limited ad-request data — the advertising identifier and coarse device information above — with its certified ad partners, for bidding and measurement. This does not add another ad network: Google remains the only one. The full, current list of those partners is shown inside the consent dialog itself, under Manage options, so it stays accurate as the list changes.
• Where you will see them: a banner on the home, conversion-setup, merge, ringtone and settings screens, a single in-feed ad in your Recent list, and a full-screen interstitial after a conversion finishes — never during one, and never before you have your file. An ad cannot take a converted file away from you, and the in-feed ad is labelled so it can't be mistaken for one of your own conversions. Pro removes all of them.
• Where required — the EEA, UK and Switzerland among others — you will see a consent dialog (Google's UMP framework) before any personalised advertising, and you can choose non-personalised ads or decline. You can change that choice at any time in the app's settings.
• On Android you can reset or delete your Advertising ID in system settings (Settings → Google → Ads). On iOS, ads would only ever track across apps if you allow the App Tracking Transparency prompt; declining it is fully supported and costs you nothing in the app.
• Our ad partner processes data under its own policy: Google advertising.

6. Permissions, and what each is for

• Notifications — to show conversion progress with a Cancel action while a job runs in the background. Declining is fine: conversions still run, you just can't see or cancel them from outside the app. There is no push messaging in Convert, and no push token is created.
• Background processing — so a conversion you started keeps running when you leave the app, rather than dying the moment you switch away.
• Modify system settings — requested only when you use the ringtone tool and choose to set a converted clip as your ringtone, notification sound or alarm. It is used for nothing else.
• Storage (on Android 9 and older only) — to save output into your gallery on platform versions that require it. Newer versions use scoped, permission-free access.
• Wake lock — to keep the processor awake during a long encode with the screen off, so your conversion finishes.

7. Who processes data on our behalf

• Google LLC / Google Ireland Ltd. — Firebase Analytics, Crashlytics and Remote Config; AdMob; Google Play Billing (including confirming purchases from our server). Privacy policy.
• Mixpanel, Inc. — product analytics. Privacy policy.
• Cloudflare, Inc. — hosting for the server that confirms purchases with Google Play. Privacy policy.
• Apple Inc. (on iOS and macOS, when released) — App Store distribution and In-App Purchase.

These providers act as our processors, or as independent controllers for their own platform services, under contracts and terms requiring protection at least equivalent to this policy. Beyond them, we share data only where the law requires it (a valid legal request), to protect rights and safety, or — should CREOVIA PRO LLP ever be part of a merger or acquisition — with the successor entity under this same policy.

8. Legal bases (EEA/UK users)

• Consent — personalised advertising, and analytics where consent is required. You can withdraw either at any time without losing the ability to convert: declining personalised ads means you see non-personalised ads instead, and nothing in Convert depends on analytics.
• Contract — processing purchase state to deliver the Pro features you bought.
• Legitimate interests — crash diagnostics, security, fraud and refund-abuse prevention, and non-identifying usage measurement, balanced against your rights.

9. Retention and deletion

• Analytics and diagnostics are retained for defined windows and then deleted or irreversibly aggregated: Firebase Analytics user-level data for 14 months; Crashlytics crash records for 90 days; Mixpanel events for our configured project window of 12 months.
• Everything the app holds about your work lives on your device. Settings → Clear recent history empties the Recent list immediately; it also clears itself after 30 days. Clearing the app's storage or uninstalling it removes the database, settings and any working files. We hold no copy of any of it.
• Because there is no account, there is no account to delete. To have the analytics and diagnostics records tied to your device's identifiers deleted with our providers, use the data-deletion request page or email [email protected] — we confirm within 30 days.
• Support emails are kept only as long as needed to resolve your request.

10. Security

All data in transit between the app and our service providers is encrypted (TLS). Because conversion happens on-device and we operate no content servers, the most sensitive data — your files — never crosses the network at all. Access to provider dashboards is restricted and protected with strong authentication.

11. International transfers

Our providers may process the limited data above on servers outside your country, including the United States. Where data leaves the EEA/UK, transfers rely on adequacy decisions or Standard Contractual Clauses; equivalent safeguards apply for other regions with transfer rules.

12. Your rights

• EEA/UK (GDPR): access, rectification, erasure, restriction, portability, objection, and withdrawal of consent — plus the right to complain to your supervisory authority.
• California (CCPA/CPRA): the rights to know, delete and correct. We do not "sell" personal information. If serving personalised ads constitutes "sharing" under the CPRA, you can opt out through the in-app ad-consent controls or your device's ad settings, and we honour opt-out preference signals where they technically apply. We don't discriminate for exercising rights.
• India (DPDP Act 2023): as data principals you have the rights to access, correction and erasure, grievance redressal, and to nominate. Our grievance contact is below. If you are not satisfied with our resolution, you have the right to complain to the Data Protection Board of India.
• Exercise any of these by emailing [email protected]. Please note the practical limit honestly: because Convert holds no identity data, we have nothing to match a request against except the device-scoped identifiers described above, so we may ask you for details (such as your device model and roughly when you installed the app) to locate the records — or, in some cases, be unable to identify them at all.

13. Children

Convert is not directed at children under 13 (or the higher minimum age your jurisdiction sets for consent), and we do not knowingly collect personal data from them. The app is not enrolled in child-directed programs, and ads are not targeted at children. If you believe a child has used the app in a way that gave us personal data, contact us and we will delete it.

14. Changes to this policy

We'll update this policy as the app evolves. New versions are published at this URL with an updated effective date; material changes are additionally noted in the app's release notes and, where consent is the legal basis, re-consented in the app.

15. Contact & grievance

Data controller / data fiduciary: CREOVIA PRO LLP, registered office: No. 33, 4th Floor, 1st Main, HMT Layout, CBI Road, Ganganagar, R T Nagar, Bengaluru – 560032, Karnataka, India. Grievance redressal (India — DPDP Act, 2023): Namrata Boro, Grievance Officer, CREOVIA PRO LLP, [email protected]. We acknowledge grievances within 48 hours and resolve them within the timelines applicable law prescribes. General support: [email protected].