Privacy policy

1. Who we are

The Narrativ service is operated by Meta Media LLC, a company registered in Georgia, Georgia, Tbilisi, Saburtalo district, Ikalto I lane N 1. Below, “we” means that company. We decide why and how the data described here is used.

This policy goes together with the Terms of Use. Where the two use the same words, they mean the same thing.

2. What data we collect and why

We collect only what the service needs in order to work:

• Account: your email address and password, or the one-time codes sent to that address. The password is handled by the sign-in component Supabase Auth, which runs on our server. We also keep in the account the interface language, your post-language settings and your sales settings: the post framework, call-to-action strength, funnel stage, the text about audience, tone and platform, and the “Ask when creating a post” switch. If you sign in with Apple or Google, they pass us your email address (Apple may give a private relay address instead) and a verified sign-in token. If Apple or Google pass us your first and last name, we save them in the account profile (Supabase Auth) and show them in Settings; they are used for nothing else, are not shown to other people and are deleted together with the account. If you sign in with Apple, we also keep an Apple token that lets us revoke the app’s access to your Apple account when you delete the account; it is stored encrypted, used for nothing else and erased with the account.
• Your content: texts, links, the original text of each request, generated results, images, logos, style references, brand colours and fonts, canvas documents with their version history, saved ideas, favourites and your own templates. For clients inside a workspace: name, niche, tone and handle.
• Photos you add from your device. They are shrunk on the device and uploaded to our file storage.
• Voice recordings. The audio is sent for transcription (section 3). We do not write it to our storage; what stays is the text you receive.
• Template choices: which template you picked, where in the app and for which post.
• Notifications: if you allow them, a push token of your device. If you turn them off in Settings, that choice is kept in your sign-in data (Supabase Auth) and is deleted with the account.
• Telegram: if you connect the bot, the number of the chat (chat ID). We do not store the Telegram username or name.
• Technical data: error reports and a sample of 1 in 10 performance traces. An error report contains the error itself, the type of device and the app version, and a log of the recent actions before the error (so-called breadcrumbs). At every launch the app also sends a session and data about that launch. For our server, both error reports and the sampled performance traces also contain the request, which may include the text or link you sent. Our server also writes ordinary logs, and the web server records the IP address, the time and the address requested.
• The sample text in the demo: the demo is available only after you sign in. To limit the number of attempts, we record your account identifier in a counter. The text itself is not saved.
• Content reports: anyone can report content on a view-link page without signing in, and signed-in users can report a result from the editor and from the draft screen. We save the reason from a fixed list, an optional text of the report (up to 1000 characters) and an optional contact of the person reporting, the date, and the link or the identifier of the material that was reported. We do not store the reporter’s IP address: an irreversible hash is saved instead (HMAC with a secret key; for a signed-in user it is computed from the account identifier), which we need for the report limit and to avoid duplicates. The hash stays with the report itself. An administrator reads the text and the contact in the admin panel. Only the report number and the reason are sent to Telegram. If a link was revoked because of a report, its owner cannot issue the link again until an administrator lifts the block (a flag on the report). A copy of reports with the reasons “illegal content” and “child sexual abuse” is kept separately (section 9).
• Accepted terms: when you sign up and when you press “Accept”, we write the number of the Terms version you accepted and the time into your sign-in data (Supabase Auth). It tells us which edition you accepted and when to ask you to confirm a new one. The record is deleted with the account.
• Request log not tied to an account: an anonymised copy of the request text and a few generation settings, without the account or IP address (section 12).
• AI permission: when you allow AI processing or withdraw the permission, we write the version of the permission and the time into your sign-in data (Supabase Auth). The record is deleted with the account.
• Usage events: while you are signed in, we record a few events: the app was opened (launch or return after a long break); a carousel was downloaded (file format and number of slides); what you did with a result (opened it in the editor, edited it, deleted a draft); voice input or link import was used. Each event is stored with your account ID, its name, the time and the platform (iOS, Android or web). Texts of posts and requests, IP addresses, device identifiers and advertising identifiers are not stored in events. Events are not passed to third-party services; they stay in our own database. Events are kept while your account exists and are deleted together with it. One more event is recorded when a text is generated: how long you waited (to a fraction of a second) and whether it succeeded or failed. It is stored like the others. We also record when you hit a limit (on downloads or on public links): your account identifier, the kind and value of the limit, and the time. The record holds none of your content. It exists to protect the service from abuse and automated scraping, is kept while the account exists, and is deleted with it. If the limit is reached by someone viewing a public link, the record is attached only to the workspace the link belongs to and says nothing about the viewer.
• Reason for deleting the account: when you delete your account you can, optionally, choose a reason from a list. It is saved without any link to the account, as the date and the chosen option only, and it stays after the account is deleted (section 9).
• Offers by email: we ask once whether you would like to receive emails from Narrativ with ideas for carousels, new templates and offers; you can change the answer at any time in Settings. If you say yes, we write the fact of your consent, the time and where you gave it (the question or Settings) into your sign-in data (Supabase Auth); whichever answer you give, we also note in the account that the question was asked, so as not to ask again. We send nothing without your consent, and your consent does not affect the service or the emails with sign-in and confirmation codes. Resend sends these emails (section 3). You can opt out at any time: with the “Offers by email” switch in Settings or with the “Unsubscribe” link in every such email; after you opt out, the emails stop. Your consent is kept while the account exists or until you withdraw it, and the records are deleted with the account.
• Subscription: the identifier of your workspace is also your customer identifier at RevenueCat (section 3). If you buy Premium, we keep a record of the subscription: where it was bought (Apple or the website), the store’s identifier of the subscription, the product, the status, the dates of the period, whether it renews automatically and whether it is a test purchase, and the identifier of your customer record at RevenueCat. For a purchase on the website we also keep the identifier of the payment contract. We do not receive or store your card number or your Apple ID. We also keep a log of the notifications we receive from the purchase services: each entry holds the body of the notification, which includes the identifiers of the workspaces it names, the product, the store’s transaction identifiers, the price and currency, the country of the purchase and the type of the event (section 6). Premium that an administrator gives a workspace by hand is recorded in the same way, together with the administrator’s address.

We use this data to run the service, tailor results to you, manage your subscription, count what the AI models cost us, understand what is used and where the product breaks, improve the app, find and fix errors, keep the service safe, review reports about content and answer your requests. We do not sell it and do not pass it to advertisers. If you allow it, we also use your email address to send you ideas for carousels, new templates and offers. The app has no advertising services and no third-party analytics; RevenueCat (section 3) only processes purchases.

3. Who we pass data to

We do not sell your data. To run the service we pass data to these contractors, each only for its own job:

• Supabase: the software that runs the database, file storage and sign-in. We run it ourselves on our own server (see the next item), so the company Supabase does not receive this data. The exception is the transition period: while we move the data, the former project in the Supabase Cloud still holds it, and after the move we close that project. We keep the last dump of the former project for no longer than 30 days (section 10).
• OpenRouter: the AI service that sends our requests to text and image models from Anthropic, OpenAI, Google and others. It receives what you typed or imported, brand data, and, where you ask us to analyse them, your photos and style references. In some cases text goes to Google AI directly.
• OpenAI: speech recognition and the safety check of texts. When you dictate, the audio goes from your device straight to OpenAI; a recorded file goes there through our server. When OpenAI is not used for a file, the recording goes through OpenRouter to a Google model. Besides that, the text of every request and of every result is sent to OpenAI to check it for content that is not allowed (sexual content involving minors, threats, graphic violence, self-harm); OpenAI returns only the verdict.
• AI image generation: if it is switched on, the topic, the style and the slide text go through OpenRouter to the image model, with a style reference if you attached one.
• Apify: when you paste a link from TikTok, Instagram, X, Threads or LinkedIn, the link goes to Apify to read the post. For video posts our server then downloads the clip for a short time, and the sound and several frames go to the speech and image models above. The clip is deleted afterwards. Other web pages and YouTube transcripts our server reads itself.
• Photo catalogues (such as Openverse and Pexels): a short search phrase about the slide topic. The text of your post is not sent. The photos found are saved to your workspace’s storage.
• Telegram: if you connect the bot and press send, the chat ID and the content you are sending.
• Expo: delivers push notifications; it receives the device token, the short text of the notification and the id of the post that finished.
• Resend: sends the sign-in and confirmation emails, and the emails with ideas for carousels, new templates and offers to those who agreed to them; it receives your email address and the email.
• Sentry: receives error reports and performance samples from the app and from our server.
• Apple and Google: only if you choose to sign in with them, to confirm it is you. They pass us your email address and a sign-in token.
• DePowered Limited (brand Rifty, Hong Kong): hosting provider. Our database, storage and application server run on its virtual server in Germany, so all the data of your account physically sits on its hardware. We do not ask it to process the data: it provides the server.
• Cloudflare: the R2 storage that holds files (images and other objects) and backups of the database and the files, and a delivery network with a cache for images (the address img.mtmd.dev). Images opened through public links pass through it, along with the technical data of those requests: the reader’s IP address, the time and the file address.
• RevenueCat: the service that processes in-app purchases and subscriptions. From the moment you sign in to the app, even if you never buy anything, it receives the identifier of your workspace (as your customer identifier) and the technical data that its library in the app sends, such as platform, app version and IP address. When you buy, it also receives the data of the purchase from the store (product, status, dates, the store’s transaction identifiers, a test-purchase flag). It does not receive your texts or images.
• Apple: when you buy Premium in the iOS app, Apple takes the payment and manages the subscription under its own terms. We do not receive your card details or your Apple ID. The same goes for any other store or payment service that we offer on your platform: we will name it in this list before it is used.
• Lava and Meta Media LLC, Georgia: if you buy Premium on the website, the payment is made through Lava to Meta Media LLC, Georgia as the seller. Lava receives the email address of your account and the payment details that you enter on its page, and Meta Media LLC, Georgia receives the data about the sale. To us they pass the payment contract, its status and its dates. They process this data under their own terms and policies.

We may also give data to authorities when the law requires it.

These contractors handle data under their own terms and privacy policies. We cannot check or change how they work.

AI features work only with your permission. The app asks for it on a separate screen before the first request that sends your content to OpenRouter, OpenAI or Apify. The sample text in the demo is the exception: pressing its button is the permission, and the screen says so. Without permission these features do not work, and the rest of the app stays available. You can withdraw the permission at any time in Settings: on the device where you do it, the AI features stop at once; on your other devices, within about 15 minutes.

4. Where data is stored

Account data and content are stored in a database on our own server with the hosting provider DePowered Limited (brand Rifty, Hong Kong); the servers are in Germany. Files are stored in Cloudflare R2. Our server processes requests and passes them on to the providers above; the files it needs for a moment (for example a downloaded video) live in a temporary folder and are deleted after the job.

Images are stored in file storage behind public links that cannot be guessed. Anyone who has a link can open the picture without signing in, and copies kept by browsers, messengers or delivery networks, including the Cloudflare cache, can keep opening after the file is deleted. Do not place in images anything that must stay private.

The app and the website also keep small amounts of data on your device (see “Cookies and local storage”).

5. International transfers

We are in Georgia, our hosting provider is registered in Hong Kong, and the servers are in Germany. Cloudflare and the other contractors listed above may process data in other countries, including ones whose data-protection law differs from yours.

By using the service you understand that your data is processed in those places. We do not promise a particular legal mechanism for transfers.

6. How long data is kept

Content and account data are kept while the account exists and are deleted when you delete it (sections 7 to 11). Shorter lives:

• A viewing link works for 3 days or until you revoke it.
• An invitation to a workspace works for 3 days.
• A code for connecting Telegram works for 24 hours; expired codes are removed automatically every 15 minutes.
• An email code for deleting an account works for 1 hour.
• The account identifier in the demo attempts counter, and the entries of the counter that limits the number of reports from one address (they hold the reporter’s irreversible hash), are removed within about 2 hours.
• Version history of a canvas document has no limit and stays until the workspace is deleted. Cost records and the administrators’ log have no time limit (sections 9 and 11).
• Photos picked automatically for a slide and not used in any saved document are removed after 30 days.
• The technical keys that protect against the same request being sent twice (they carry only technical ids of the workspace and the request, never content) are deleted 30 days after they are created, and at once when the account is deleted.
• Content reports themselves have no time limit: a report stays until the generation it was filed against, or the account of that generation’s owner, is deleted (section 8). The separate copy of reports about illegal content and child safety is not deleted with them and has no fixed term (section 9).
• Request log entries are kept for 12 months and then deleted automatically (section 12).
• The log of notifications from the purchase services (RevenueCat, Lava) is deleted automatically 90 days after it was received, or at once when the account is deleted.

Sentry sets how long error reports are kept. Logs of our web server and of the hosting provider are rotated regularly, and we do not name a period for them.

7. How to delete your account

In the app: Settings → Delete account. Without the app, use the /delete-account page — the email address the account was registered with is enough. Either way we send a one-time code to that address and touch nothing until it comes back. There is no grace period: once the code is accepted the data is removed from the service immediately, and we cannot restore it.

8. What is deleted

Everything the account owns is deleted; only the erasure of your record at RevenueCat (the last item) is not instant:

• the workspaces you created and everything in them — clients (with the connected Telegram chat), generations together with their texts and original requests, canvas documents with their version history, carousel templates, brand settings, your style references, saved ideas, any view links and invitations you handed out, the reports filed against your view links and your materials, and the technical keys that protect against repeated requests;
• the files stored under those workspaces: generated images, photos you uploaded, photos picked automatically, logos, exports, previews and the previews of your style references. Afterwards we check separately that not a single object is left under the workspace, and treat the deletion as failed if anything remains;
• your membership in other people’s workspaces, the push tokens from your devices, and your favourites, template choices and own templates wherever they were made;
• the account itself. It is erased rather than flagged as deleted, so the email address is freed and can be used to sign up again. If you signed in with Apple, we first revoke the app’s access to your Apple account; if Apple does not confirm this, you can remove the access yourself in your Apple ID settings.
• your customer record at RevenueCat: when the account is deleted we ask RevenueCat to erase it. The request goes out from a queue, so it may reach RevenueCat some time after the account is gone. Until RevenueCat confirms the erasure, the queue keeps the identifier of the deleted workspace (your customer identifier there), the number of attempts and the code of the last error; the entry is deleted when RevenueCat confirms, and while it does not confirm, the entry stays with no fixed term.

Other people’s workspaces you were invited into carry on: only your membership leaves them. Material created inside someone else’s workspace belongs to that workspace and stays with its owner.

When you pick a template, we record which one, where in the app you picked it and which post it was applied to. These records build your recent templates and the popular list, and let us count what share of posts start from the Designs tab. They are deleted together with your account.

The copy of a request text in the request log is not deleted together with the account: it is not tied to it and is anonymised (section 12).

Usage events recorded for your account are deleted together with it. Records of limit hits are deleted together with it too.

Deleting the account does not cancel a subscription bought from Apple or from a payment service, and we cannot cancel it for you. Cancel it first, in your Apple ID settings or in the way shown on the payment page; otherwise it keeps renewing and being charged.

9. What stays

The generation cost records: which model, how many tokens or items, what it cost and when. The same goes for the usage records of the link-reading service. At the same moment the workspace is deleted, the database itself (and, for the link-reading records, our deletion code) detaches these records from it. The amount and the date remain; whose request it was does not.

These records hold no texts, no images and no email address. We keep them because they are our own accounting for what the services cost: without them there is no reconciling a provider’s invoice and no explaining a spike in spending. The anonymised copy of a request text is kept separately, in the request log (section 12).

Copies of reports with the reasons “illegal content” and “child sexual abuse”. When such a report is filed, a copy of the fact of the report is saved separately: the reason, the text and the contact the reporter wrote, the date, the identifiers of the material and of the workspace, and the reporter’s irreversible hash. The copy does not contain the material itself. It is not deleted with the material or with the account, because we may need it to handle such a report and to answer the authorities, and it has no fixed term. The administrator alone reads it.

The reason for deleting, if you chose one, is kept: it is saved without the account ID, as a date and the chosen option only. We do not promise that it can never be linked to you: with a small number of users, a date can be close to the day your account was deleted.

Subscription records. The record of a purchase made through a store or a payment service stays after the account is deleted: the store’s identifier of the subscription (for Apple, the original transaction identifier; for the website, the payment contract), the product, the status, the dates of the period, the flags of automatic renewal and of a test purchase. The link to your workspace and the RevenueCat customer identifier are removed, so we can no longer tell whose it was (with few users, the dates alone may point to you); the store or the payment service can still match its own identifier to you. We keep it as our accounting of payments, like the generation cost records, and it has no fixed term. Premium that an administrator gave by hand is not kept: it is deleted with the account.

10. Backups

We make backups of the database and the files ourselves and keep them in Cloudflare R2. A database backup includes the change log from which it can be restored to a chosen moment. Backups are kept for 30 days and then deleted; we treat the last dump of the former Supabase Cloud project the same way. This means that after you delete your account the data leaves the service at once, while it may stay in backups for up to 30 days.

11. What deletion does not reach

There are places the Delete account button does not reach, and it is fairer to name them:

• the admin action log. It records which administrator changed a service setting or opened a particular generation to look into a problem. It holds the administrator’s address and technical ids (such as the generation and the workspace), not your texts and not your address. But if the administrator was you, your address stays in that log;
• the service log of sign-ins kept by the Supabase Auth component. It is written automatically and is not cleared when you delete your account; in the former project in the Supabase Cloud, while it is open, Supabase keeps this log under its own rules;
• messages the bot has already sent to Telegram. They sit in someone else’s chat and we have no way of taking them back;
• cached copies of images. The image links are public: we delete the file itself, but a copy left in a browser, CDN or messenger cache may keep opening for a while;
• the request log (section 12). It holds no account, workspace or generation id, so its entries cannot be found and deleted through your account; they delete themselves after 12 months;
• what has already reached the contractors in section 3 (AI and speech services, error reports, email delivery, Apple, the website payment service and the seller). Deleting an account does not send them a deletion request, and they keep it under their own rules. The exception is RevenueCat: we ask it to erase your customer record (section 8).

12. Request log not tied to an account

After every successful generation we copy into a separate log the text of your request (up to 500 characters), the language, template, category, format, number of slides, where the generation was started from, the type of source (text, link and so on) and the date — without the time. Some fields may be empty. Before it is written, email addresses, phone numbers, links, @handles, card numbers and long numbers are cut out of the text automatically.

The log holds no account, workspace, generation id, IP address or exact time. While your account exists, administrators can see your generations anyway, and the log does not protect against that: an entry can be matched to a generation by its text. What the log changes is what remains after your account is deleted: the original generations are gone, only a de-identified copy stays, and it can no longer be connected to you. For that reason the log is not deleted together with your account and cannot be found by a request about your data.

We keep it to understand which topics and templates people need. Only the service administrators can see the log, and views and exports of the log are recorded in the administrators' action log. Entries are kept for 12 months and then deleted automatically.

This text cannot be called fully anonymous: it is made anonymous automatically, but it may contain what you wrote yourself. Do not put personal data into your requests.

13. Your rights and how to use them

You can ask us to:

• tell you what data we hold about you and send you a copy;
• correct data that is wrong;
• delete your data (you can also do this yourself, right away, as described in section 7);
• stop a particular use of your data, where we can do so without closing the account.

Write to support@mtmd.dev with “Privacy Request” in the subject, from the email address of your account, so that we can tell the request is yours. We handle these requests by hand.

You can do much yourself in the app: edit and delete content, revoke a viewing link, turn notifications off in your device settings, switch off emails with ideas, templates and offers in Settings or with the “Unsubscribe” link in an email, or delete the account. Depending on your country, you may also have the right to complain to the data-protection authority there.

14. Cookies and local storage

We do not set cookies. The website and the app keep a few things on your device instead (the browser’s local storage on the web): your sign-in session, the interface language and post-language settings, a cached first page of your drafts and of the template lists, the choices of the audience and tone you entered, recent topics, a carousel that has not been saved yet, a queue of template choices made offline, the set of loading animations and a counter that decides when a hint is shown. The purchase library RevenueCat keeps its own copy of your customer identifier and subscription status on the device. While an invitation is being accepted, its token waits in the browser tab’s session storage.

On sign-out the app clears the drafts, template lists, offline queue, unsaved carousel and generation options. The sign-in session goes with the sign-out; the language, loading animations, hint counter and some other settings, such as recent topics, stay on the device until you clear them.

None of this is used for advertising or for following you across other sites. You can clear it in your browser settings or by uninstalling the app. The exception is the sign-in session on iOS: it is kept in the system Keychain, which can survive uninstalling the app. Sign out before you uninstall; if an entry is left over, the next installation of the app deletes it at the first launch.

15. Children

The service is for people who are at least 16 years old, as the Terms say. We do not knowingly collect data from younger children.

If you believe a child under 16 uses the service, write to support@mtmd.dev. If we learn that it is so, we may close the account and delete its data.

16. Security

What we do to protect data, as far as we can state it:

• connections to the service are encrypted;
• every request that reads or changes an account’s data is checked against the signed-in account and the workspace, and a workspace’s data is not shown to other workspaces;
• links for viewing and invitations carry a secret token in the part of the address that is not sent to the server and is not written to our logs; pictures in a viewing link are served through signed addresses;
• deleting an account needs a code sent to the account’s email, and the number of attempts is limited.

No method of transmission or storage is completely safe, so we cannot guarantee absolute security. Keep your password and your sign-in emails safe.

17. Changes to this policy

We may change this policy, for example when new features appear or the law changes. The date of the latest update is at the top of the page.

We will publish material changes on this page and show them in the app when they take effect. Where the law requires earlier notice, we will give it. If you keep using the service after a change takes effect, you accept the new version. If you do not agree, stop using the service and delete your account.

18. Contact us

Meta Media LLC, Georgia, Tbilisi, Saburtalo district, Ikalto I lane N 1. Questions about this policy and requests about your data: support@mtmd.dev.

Put “Privacy Request” in the subject.

If a translation of this policy, including the short version, differs from the English text, the English text prevails, unless the law of your country gives you the right to rely on the version in your language.