Back to iMavi

Last updated: November 3, 2026

Privacy Policy for iMavi

iMavi ("the App," "we," "us") is a mobile application that lets you create AI-generated images and videos. You sign in, add credit to an in-app wallet through Google Play, and pay for each generation from that wallet. This Privacy Policy explains what data we collect, why, who we share it with, how long we keep it, and your rights.

The short version: we collect what we need to run your account, your wallet, and your generations, and nothing for advertising. We do not sell your data and we do not use it to train AI models.

1. Information We Collect

  • Account details: your email address, and if you sign in with Google, a keyed hash of your Google account identifier. We do not store your Google password.
  • Your creations: the prompts you write, any reference images you attach, the model and settings you choose, and the images and videos that are generated.
  • Wallet and purchases: your wallet balance, a ledger of top-ups, charges, and refunds, and Google Play purchase records (product, order ID, and purchase token). We never receive your card number or billing address; Google handles payment.
  • Security and abuse prevention: a keyed hash of a device identifier (used so the free starter images are given once per device), Google Play Integrity results that confirm requests come from a genuine copy of the App, request timestamps and hashed network addresses used for rate limiting, and records of content moderation decisions and reports.
  • Notifications: if you allow them, a push token so we can tell you when a generation is ready.

iMavi does not use advertising, advertising identifiers, or third-party analytics tools.

2. How We Use It

  • To sign you in and keep your account secure
  • To run your generations and deliver the results to your device
  • To keep your wallet accurate: credit top-ups, charge the price shown before each generation, and refund failed generations
  • To prevent fraud and abuse, including payment fraud, repeated free-credit claims, and content that breaks our Terms
  • To answer you when you contact support
  • To meet legal, tax, and accounting obligations

3. Who We Share It With

We share data only with the service providers that run the App, and only what each one needs:

  • Supabase hosts our database, file storage, sign-in, and server functions. Our project is hosted in Mumbai, India.
  • OpenRouter and the AI model providers behind it (for example Google, OpenAI, ByteDance, Black Forest Labs) receive your prompt, reference images, and settings in order to generate your result. They receive no account details from us. Each provider processes this under its own terms and privacy policy.
  • Google provides Google Sign-In, Google Play billing, and Play Integrity.
  • Authorities, where we are legally required to disclose information, or where needed to protect people from serious harm, including reporting child sexual abuse material.

Some of these providers process data outside India. Where they do, they handle it under their own data-protection commitments.

4. Content Moderation

Prompts and reference images are checked automatically before a generation runs, and requests that break our Terms of Service are blocked. You can report a result from inside the App. Reports and moderation decisions may be reviewed by us, and repeated or serious violations can lead to your account being suspended.

5. How Long We Keep It

  • Reference images you attach are passed to the AI provider and are not stored on our servers.
  • Generated images and videos are deleted from our servers as soon as the App has saved them to your device, and at the latest 7 days after they are created. Media you report is kept separately until the report has been reviewed.
  • Prompts are removed from our records after 30 days.
  • Security logs are kept for up to 90 days, and payment webhook records for up to 30 days.
  • Account details are kept until you delete your account.
  • Wallet ledger and purchase records are kept after account deletion, unlinked from your account, because tax law and payment-fraud prevention require it.

6. Data Security

Data is encrypted in transit. Each user can only read their own records and files. Device and Google identifiers are stored as keyed hashes rather than in plain form. No system is perfectly secure, so please also protect your device with a lock screen.

7. Children

iMavi is intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, contact us and we will delete it.

8. Your Rights

Depending on where you live, including under India's Digital Personal Data Protection Act, the GDPR, or the CCPA, you may have the right to access, correct, or delete your personal data, and to withdraw consent. You can:

  • Delete your account and its data at any time in the App under Settings → Delete account, or by following our Data Deletion page
  • Email hello@imavi.in from the address you sign in with to request a copy of your data or a correction

We will respond within 30 days. If you are unhappy with our response, you may complain to your local data-protection authority.

9. Changes to This Policy

We may update this Privacy Policy as iMavi changes. We will update the "Last updated" date above and, for material changes, notify you within the App before the change takes effect.

10. Contact Us

Questions about this Privacy Policy, or requests about your data, can be sent to hello@imavi.in.