Privacy Policy — Dive Astronaut
- Your videos and photos never leave your device. All color correction runs locally.
- You need an account to use the app (e-mail, name, sign-in with Google or Apple).
- Our server confirms your subscription and counts daily use of the free plan. It does not receive your e-mail address.
- Crash reports and usage statistics are optional, off by default, and you can change them at any time in My account → Privacy.
- No ads, no tracking, no selling of data.
- You can delete your account in the app (My account → Delete my account) and exercise your rights by e-mail.
1. Controller and contact
Controller (Art. 4(7) GDPR / LGPD art. 5 VI): Script Pilot
E-mail: contact@diveastronaut.com
Postal address available on request via the e-mail above.
Privacy contact (encarregado, LGPD art. 41), including for people in the European Union: the same e-mail.
2. Which data, why, legal basis, retention and recipient
GDPR legal bases used below: (b) = performance of the contract (Art. 6(1)(b)); (f) = legitimate interest (Art. 6(1)(f), see section 4); (a) = consent (Art. 6(1)(a)). LGPD equivalents: art. 7 V (contract), IX (legitimate interest) and I (consent).
| Data | Purpose | Legal basis | Retention | Recipient |
|---|---|---|---|---|
| Account: e-mail, name, account ID (uid), sign-in method (e-mail/password, Google, Apple), password (hash only), creation and last sign-in date | Create and run your account, sign in, reset the password, link the subscription to the account | (b) | As long as the account exists; deleted when you delete the account. Provider backups: up to 180 days | Google (Firebase Authentication), as our processor |
| Subscription: purchase token, product (plan), status and expiry, linked to the uid. No e-mail. | Verify the purchase with the store, unlock Pro, use Pro on your other devices (including Windows) | (b) | Up to 90 days after the subscription ends, or until you delete the account | Our server (Hetzner Online GmbH, Germany), Cloudflare (transit), store API (Google Play / Apple App Store) |
| Free-plan quota: uid and number of videos, exports and photos processed that day (older app versions used a cryptographic hash of the device identifier instead of the uid) | Apply the daily limits of the free plan and prevent abuse | (b); (f) abuse prevention | 2 days | Our server, Cloudflare (transit) |
| Technical connection data: IP address, date/time, requested URL, app version | Deliver the response, security and rate limiting | (f) | Our server uses the IP only in memory, for up to 1 hour, and never stores it. Server logs contain no IP, e-mail or token and are removed by automatic log rotation. Cloudflare: under its own policy | Our server, Cloudflare |
| Usage statistics (optional, off by default; Android and iOS only): app opens, processed items (type, resolution range, fps, duration, success/failure, time), features used, plan, app and OS version, language, device model. No file names, no content, no media location | Understand usage, find devices with failures or slowness, decide on improvements | (a); TDDDG §25(1) | The server only adds up daily counters; it keeps no individual events, IP or identifier. The daily totals identify no one and are kept without a time limit | Our server, Cloudflare (transit) |
| Crash and error reports (optional, off by default): Firebase installation ID, device model and technical hardware data (chip, graphics processor, memory, video codecs), OS, app version, location of the error in the code, technical error message, technical data of the video involved (resolution, fps, codec, color; never its name, content or location), date/time. Sent when the app crashes and when a preview or export fails | Find and fix crashes | (a); TDDDG §25(1) | 90 days | Google (Firebase Crashlytics), as our processor |
| Support: what you write to us and your e-mail address | Answer your request, including data-rights requests | (b) or (f); rights requests: Art. 6(1)(c) | Up to 12 months after the case is closed | Our e-mail provider, Purelymail (USA) |
| On the device (not sent): sign-in session, your privacy choices, settings, plan cache | Make the app work | (b); TDDDG §25(2) no. 2 | Until you sign out or uninstall | No one |
Statistics are not anonymous. They do not include your name or e-mail, but because they arrive over the internet (with an IP address) and describe your device, we treat them as pseudonymous, i.e. still personal data.
3. What we do not collect
- Videos, photos, thumbnails and media metadata (such as GPS location) never leave your device.
- No ads, no advertising ID, no cross-app or cross-site tracking, no marketing profiles.
- We do not sell data or share it with third parties for their own purposes.
- We do not collect contacts or your location.
- No automated decisions with legal effect on you (Art. 22 GDPR). The daily quota is just a counter.
4. Legitimate interest (Art. 6(1)(f))
We rely on legitimate interest only for:
- Security: short-lived technical logs on the server and at Cloudflare to block attacks and automated abuse;
- Preventing abuse of the free plan: counting daily use per account so the limits cannot be bypassed;
- Defending legal claims: keeping the minimum needed in case of a dispute.
Balancing: the data is minimal, pseudonymous, kept briefly and not used for anything else. You can object at any time.
5. Consent and how to withdraw it
On first launch the app shows two optional switches, off by default: “Send crash reports” and “Send usage statistics”. Windows has no such switches, because the Windows app sends neither. They are independent of accepting the terms: you can use the app with both off, without any disadvantage.
How to withdraw: My account → Privacy, turn the switch off. It applies from that moment; anything sent before remains lawful (Art. 7(3) GDPR). Crash reports already sent expire after 90 days.
6. Access to your device (TDDDG §25)
The German TDDDG (§25) requires consent for storing or reading information on your device, unless this is strictly necessary for the service you asked for.
- Without consent (strictly necessary, §25(2) no. 2): sign-in session, plan cache, your privacy choices, app settings, temporary processing files.
- Only with consent (§25(1)): installation ID and device data for Crashlytics; device data for usage statistics.
7. Purchases: Apple and Google as separate controllers
The subscription is bought and paid through Google Play (Android) or the App Store (iOS/iPadOS/Mac). The store processes your payment and purchase data as an independent controller under its own privacy policy (Google, Apple). We never receive card data or your billing name: only the purchase token and subscription status, which our server checks with the store's API.
The same applies to “Sign in with Google” and “Sign in with Apple”: Google/Apple authenticate you under their own rules and pass us only what you approve on their screen (e-mail and name).
8. Transfers outside the EU / Brazil
- Purelymail, our e-mail provider, is located in the USA and receives the messages you send us.
- Google LLC (Firebase Authentication and Crashlytics) and Cloudflare, Inc. are in the USA. Both are certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision, Art. 45 GDPR); in addition, the Standard Contractual Clauses (Art. 46(2)(c) GDPR) in their data processing terms apply.
- Our server is located in Germany.
- For users in Brazil: data is processed in Germany and the USA, based on standard contractual clauses and processor safeguards (LGPD art. 33 II; ANPD Resolution CD/ANPD 19/2024).
9. Platform differences
Android
- Purchase via Google Play Billing; optional sign-in with your Google account.
- Permissions: photos and videos (read what you pick and save the corrected files), notifications (progress), internet (sign-in, subscription, quota, optional features).
iOS, iPadOS and Mac (App Store)
- Sign in with Apple: you can hide your e-mail; in that case we receive an Apple relay address. When you delete the account, we revoke the sign-in token with Apple.
- The sign-in session is stored in the device Keychain, protected by the system. Keychain entries may survive uninstalling; signing out or deleting the account removes the session.
- Purchase via Apple StoreKit; photo library access only for the items you pick.
Windows (direct download)
- No store: the Windows app uses the Pro/VIP of your account, bought on Android or the App Store. There is no in-app purchase on Windows.
- Sign-in with e-mail and password or with Google (OAuth in the system browser; the app receives the result locally on your own computer).
- The session is stored in a local file in your user folder (%APPDATA%\DivePilot), encrypted with Windows data protection (DPAPI). Signing out deletes the session.
- The Windows app sends no crash reports and no usage statistics.
10. Your rights (GDPR)
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and to withdraw consent at any time (Art. 7(3)). Write to contact@diveastronaut.com; we reply within one month (Art. 12(3)). We may ask you to confirm that the account is yours.
You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (Art. 6(1)(f)). We will then stop, unless there are compelling legitimate grounds that override your interests or the processing is needed to defend legal claims. We do not do direct marketing.
Complaint: you may lodge a complaint with a data protection authority (Art. 77 GDPR), in particular in the country where you live or work. List of EU authorities: edpb.europa.eu. In Germany, the authority of your federal state (Landesdatenschutzbehörde).
11. Brazil: LGPD and ANPD
Under the LGPD (art. 18) you may request: confirmation of processing, access, correction, anonymisation/blocking/deletion of unnecessary data, portability, deletion of data processed on the basis of consent, information about sharing, information about the option not to consent, and withdrawal of consent. We reply within 15 days. You may also petition the National Data Protection Authority (ANPD): gov.br/anpd.
12. Do you have to provide the data?
Account and subscription data are required for the contract: without an account, your own videos and photos cannot be processed; only the built-in sample videos work without one (Art. 13(2)(e) GDPR). Crash reports and statistics are entirely optional.
13. Minors
The app is intended for people aged 16 or older. We do not knowingly collect data from younger people. If you know of such an account, write to us and it will be removed.
14. Security
- All communication uses HTTPS/TLS.
- Passwords are stored only as hashes in Firebase; the app never stores them.
- The server receives only the uid and the purchase token, not the e-mail; admin access is key-restricted.
- Short retention periods (2 days for the quota, 90 days for crashes).
15. Changes
If this policy changes, we will publish the new version here with a new date. Significant changes will be announced in the app; if new processing requires consent, we will ask again.