Cookies, data and retention
Last updated 12 October 2026
What this website keeps in your browser, what the app's server keeps and for exactly how long, and how to have any of it deleted. Every number here is read out of the code that enforces it, and a check in the repository fails if the two drift apart.
The short version
- This website sets no cookies of its own. It keeps your age confirmation, notice dismissal and country choice only in your browser. If you like or comment on a reel, it also keeps a random browser token to remember your likes and let you remove your comments.
- The home page counts visits without cookies, through the hosting provider's page-view script. It does not identify you.
- The app's server keeps counters, not your library. What you write, record and perform stays on your device and in your iCloud. The server only handles what you send it for a feature (writing help, a double, a reel, a report link or a Private Mic link), and each thing it keeps is listed below with its life.
- Anything it holds about you can be deleted on request. Write to the address at the bottom.
This website
Cookies
None are set by these pages. If your browser shows a cookie for this domain, it did not come from us.
Local storage
Four keys, written only after you act and gone when you clear the site's data:
| Key | What it holds | Set when |
|---|---|---|
cwi.adult | That you said you are 18 or over. Nothing else: no date of birth, no age. | You press I am 18 or over on the gate. |
cwi.consent | The day you dismissed the notice that links here, so it is shown once. | You press OK on the notice. |
cwi.territory | The country you chose on the pricing page, as Apple's three-letter code, so prices are shown in your currency next time. | You press Set my country. |
cwi.reels | A random token sent to our server for your likes and comments. It is not linked to an account; the server stores only its hash. | You first like a reel or send a comment. |
The country is guessed once from your browser's language setting and then asked, not assumed. Your location is never read.
Reel likes and comments
Likes are counted per browser. Comments wait for our approval before they appear publicly; your chosen display name and comment are then visible to everyone. We keep likes, comments and their browser-token hashes in Cloudflare for up to one year, or until removed. We use your network address briefly to limit requests, without storing it in these records. No Instagram information is shared with us by the Follow link.
Open Comments on the same reel in the same browser to remove your own comment, including one awaiting approval. Clearing this site's storage removes your ability to manage earlier likes and comments; you can still email us for removal. Like counts update from the saved server total. Comment counts and removals may take about a minute to update. Please do not post private information.
Page views
The home page loads /_vercel/insights/script.js, the page-view counter of Vercel, which hosts this site. It reports that a page was viewed; it sets no cookie and stores nothing in your browser, which you can confirm in your browser's own storage inspector. No other analytics, advertising or tracking script is loaded on any page.
The early-access form
If you fill in the form on the home page, what you type is stored on our server, in Cloudflare, for 180 days, and emailed to our inbox through our email provider, Bird; the email is kept until you ask us to delete it. Only if our server cannot be reached does the form send what you typed to a form-forwarding service, FormSubmit, instead. We use your network address briefly to limit requests, without storing it with your answers. The form sends what you have typed when you move past its first step and again past its third, so a form you abandon halfway still reaches us; that is deliberate, so that a lost connection does not lose your request. It is used to open the trial to you and for nothing else.
Studio service enquiries
The Studio form sends your name, email, profession, selected plan, language and optional goals only when you submit. We store the enquiry on Cloudflare for 180 days and forward it to our inbox through Bird to discuss the service. There is no partial submission or FormSubmit fallback for Studio. Forwarded emails remain until you request deletion. The form saves no contact details in browser storage. Production material handling is agreed separately before onboarding; see Studio privacy information.
Hasyam API private preview
This optional business API runs separately from the app’s server. It processes the script, language and pronunciation choices sent in each request on Cloudflare. Its code does not persist request bodies or replies, call external model providers, or use the material for training. Responses have a no-store instruction, and application request logging is disabled. Cloudflare can still process operational and security metadata.
API-key digests and opaque key identifiers stay in the access registry until access is revoked. Throttling uses a brief per-minute counter by key identifier. There is no saved personal vocabulary: overrides apply only to the current request. Pilot enquiries remain in our email inbox until removed on request. For revocation or removal, contact sachin@getconvi.com. See the API documentation and privacy details.
The app on your device
Everything you write, record and perform is stored in the app's own database on your device, and in the private part of your own iCloud if iCloud is on. The privacy page has the whole account; the retention that matters is:
- Show recordings: 90 days by default, adjustable in Settings → Privacy, deletable one by one or all at once.
- Notes, sets and shows: until you delete them.
- Film takes and video notes: What you film of yourself with the prompter, every take, stays on this device unless you share it. The video note you keep from a take goes to your own iCloud as well, over Wi‑Fi only and never over cellular data, so your other devices have it; only you can read it there, and it never reaches us. The takes of a filming session are deleted when the session ends; the clip you keep stays until you delete it, on any of your devices — deleting it takes the iCloud copy with it.
- Deleting the app deletes its database and files from the device.
- Settings › Delete everything deletes it all while the app is still installed — every record and recording on the device, the copy in your iCloud, and everything in the table below that is tied to your subscription or to this install — after asking you to take a copy first. It runs store by store, says what it could not reach, and picks up where it stopped if the app is closed part way.
The app's server
The server is a single Cloudflare Worker. It stores neither the text you send the generator nor what comes back. The only audio or video that passes through it is what you send for your double or a reel, which it forwards to the render service without keeping, and a Private Mic reel, which it hosts for the link's life. What it does keep is keyed by a salted hash of an Apple transaction identifier or of an App Attest key, never by a name, email or device identifier, and each item expires on its own. The lives below are the constants in the Worker's source, named so that they can be checked against it.
| What | Kept for | Why, and where it is set |
|---|---|---|
| The challenge issued to prove an install is a real copy of the app | 5 minutes | Long enough to answer, then gone.worker/src/tokens.ts · CHALLENGE_TTL_SECONDS |
| The install token record (a hash of the token, which install it belongs to, how it proved itself) | 90 days | How long an attested install stays signed in before it proves itself again.worker/src/tokens.ts · TOKEN_TTL_SECONDS |
| The same record, for a build that proved itself with a subscription receipt instead | 7 days | A receipt says the subscription was live when read; a week is as long as that is trusted.worker/src/subscriptionproof.ts · SUBSCRIPTION_TOKEN_TTL_SECONDS |
| The month's spend counter, the number that says how far your plan's balance has gone | 70 days | A month, plus the slack for a clock that is behind. Then the key expires.worker/src/caps.ts · MONTH_TTL_SECONDS |
| Your ledger: one row per thing that cost credits, and the running totals | No expiry; the last 200 rows | A history that expires quietly stops being one. Older rows fall off the front; the totals keep counting them.worker/src/ledger.ts · MAX_ROWS |
| Your reload balance, and the marker that says a reload was already credited | No expiry, for either | A reload does not expire: it stays on your balance until you spend it, and the oldest one is spent first. The marker stays so a purchase can never be credited twice.worker/src/topup.ts · grantLot |
| The subscriber record: plan, store, first and last seen, how many proofs | 400 days from the last visit | A year, plus the slack for a subscription that renews late. No name, no email, no device.worker/src/subject.ts · SUBJECT_TTL_SECONDS |
| A hosted Show Report: the PDF and its record | 30 days | Then the link stops. Deleting it earlier removes the PDF at once and leaves a marker for the rest of the same window so the address cannot be reused.worker/src/reports.ts · REPORT_TTL_SECONDS |
| A Private Mic link: the reel file, its record and the viewers' reactions | 7 days | Then the link, the file and the reactions are gone. Taking the link down earlier removes the file at once; the reactions stay until the same day so you can still read them.worker/src/tape.ts · TAPE_TTL_SECONDS |
| A report about a Private Mic video: the reason, any words added, and a one-way hash of the reporter's address and the link | 90 days | Long enough to act on it, and it outlives the link, because a complaint about a link that has expired is still a complaint. The address itself is never stored.worker/src/tape.ts · TAPE_REPORT_TTL_SECONDS |
| A file you added to Media that was removed after a rights complaint: the reason, the file's type, size, date and fingerprint (a SHA-256 hash of its bytes), what you confirmed when you added it and your device's check of it, the reels that used it, and a one-way hash of your account; never the file or its name | 1,095 days (3 years) | The record of a complaint and of what was done about it. The file itself is deleted at once. It stays if you delete everything, because it holds nothing of yours but that hash; the count of files removed from your account and any switch on adding to Media go with everything else.worker/src/media-block.ts · MEDIA_TAKEDOWN_TTL_SECONDS |
| Activity counts, if you turned them on: ten numbers, never a word | 400 days from the last report | The same life as the subscriber record. Off until you switch it on in Settings.worker/src/usage.ts · USAGE_TTL_SECONDS |
| A render job: what was quoted, what was charged, whether it finished | 90 days | Long enough to settle the charge, short enough to forget. The lines sent for the render are held only while it is rendering and cleared the moment it settles.worker/src/reeljob.ts · JOB_TTL_SECONDS |
| Your double: our id for the reference video, the provider's ids for it (BytePlus group and asset, or Higgsfield's), its length, your consent and the face or liveness check's result | Until you delete it | Deleting it removes our record at once. The render provider, Higgsfield, offers no way to delete the video it holds, so the app tells you its copy remains rather than showing a success. A record of the request stays, with no expiry, so the deletion can be completed if the provider ever offers one.worker/src/double.ts · DELETE /v1/double |
| Media: each picture, video and sound you add, its thumbnail, and what you confirmed about your right to use it (when, and under which version of the Media terms) | Until you delete it; 365 days after your plan with reels ends | Deleting a file removes the file and its thumbnail 48 hours later and its record, the rights statement included, 30 days later, so a rights holder's claim can still be answered. Delete everything removes every file and record at once. When Apple tells us your plan with reels has ended, a clock starts; a renewal stops it, and at its end the nightly pass deletes your uploads and pack pictures the same way. Looks are not on this clock: they follow your double. The Media page shows a notice from 30 days before.worker/src/reel-reference-media.ts · TOMBSTONE_BYTES_MS, TOMBSTONE_RECORD_MS · worker/src/media-lapse.ts · MEDIA_LAPSE_DELETE_MS |
| The month's total render spend, for the whole app, with nothing per person in it | 365 days | One number per month, checked against the provider's invoice.worker/src/reconcile.ts · RECONCILE_TTL_SECONDS |
| A LinkedIn or Instagram sign-in you connected for posting: the account's name, handle, picture and expiry, and its token, encrypted (AES-256-GCM) under a key that never leaves the server | Until you disconnect it or delete everything; otherwise 30 days after the token expires | Posting while your phone is off needs something else to hold the right to post for you, and that is the server and only the server: the token never reaches your device. Disconnecting deletes the ciphertext at once and revokes it at LinkedIn; a token past its life is dropped by the nightly pass. Off until posting is switched on.worker/src/posting-refresh.ts · TOKEN_GRACE_SECONDS |
| A reel you posted to LinkedIn or Instagram from the app: the marked copy the server holds so it can post with your phone off | 7 days after it posted or was cancelled | The file goes to the platform from the server, once, through a link that works a single time; then it waits only for a Try again before the nightly pass removes it. Cancelling a post, deleting your double or deleting everything removes it at once. Off until posting is switched on.worker/src/posting-retention.ts · MEDIA_RETENTION_SECONDS |
| The caption of a post that went out, kept so the post's card can show it | 90 days after posting | Then the words are removed and only the time, the platform and the link stay. A caption never appears on a notification or in a log line.worker/src/posting-retention.ts · CAPTION_RETENTION_SECONDS |
| A count of wrong passwords on the operator's own panel, by a hash of the address | 1 hour | Not about you unless you are guessing our password.worker/src/admin.ts · ADMIN_LOCK_SECONDS |
Request logs at the edge — status codes, timings, the route — are Cloudflare's operational logs for the Worker, and hold neither your material nor an identifier we could look you up by.
Having it deleted
- A hosted Show Report link: delete it from the report in the app, and it stops working at once.
- Your double: delete it from the app, which does everything the row above describes.
- A file in Media: delete it from the Media page in the app, which does what the Media row above describes. Delete everything removes all of them, and their records, at once. It does not remove the record of a file removed after a rights complaint, which is kept for 3 years as its row above says.
- A Private Mic link: take it down from its page in the app, and it stops working within a minute. Delete everything takes down every Private Mic link you made.
- Everything else the server holds under your subscription — the counters, the ledger, the subscriber record, the reels, the activity counts — and this install's own records: Settings › Delete everything in the app, which takes them at once and tells you what the render service would not confirm. Unspent reload credit goes with it, and the screen says the amount first.
- An email you sent through the form, or anything of yours if you no longer have the app: write to us and we will delete it.
- Apart from Media and the other files listed above, your material is on your device and not on our servers, so you already hold it; the app exports all of it.
Changes
If this page changes in a way that matters, the date at the top changes and the app's What's New will say so.
Contact
Getconvi Technologies Private Limited, India · Sachin Uppal, Founder and Director · sachin@getconvi.com