Privacy Policy

This Privacy Policy applies to the Moments application (“Application” or “App”), developed by Matheus Domingues, available for mobile devices. The official website of the service is https://themoments.com.br.

It describes how we collect, use, store, share, and protect personal data, in compliance with the Brazilian General Data Protection Law LGPD (Law No. 13,709/2018) and with app store guidelines.

Moments is a private collaborative album for events. It is not a public social network: photos and videos are accessible only to the organizer and participants of the respective event.

This Policy supplements the Terms and Conditions of Use.

1. Who controls the data

The controller of the personal data processed by Moments is the App Developer.

To exercise your rights, ask questions, or contact the person responsible for data processing (when applicable), use: devgrouply@gmail.com

You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

2. What data we collect

We collect only what is necessary to operate the service. The categories below depend on how you use the App.

2.1 Registration and profile data

• Name
• Email
• Password (stored in encrypted form by the authentication provider; we do not have access to the password in plain text)
• Authentication provider (email/password and, when available, Apple)
• Profile time zone
• Preferred language
• Usage intention provided during onboarding (for example, wedding, birthday, trip, or guest)

We do not require a profile photo, phone number, official documents, or banking information.

2.2 Event and participation data

• Events you create or participate in (name, type, dates, time zone, cover, reveal settings, and media limit)
• Event invitation code
• Participation role (organizer or guest) and join date
• Album metrics (for example, number of media items and people)

The invitation code identifies the event. Anyone who has it may request to join. We do not publicly expose the participant list or media to anyone who is not part of the event.

2.3 Photos, videos, and media metadata

When you capture or upload a moment:

• Image or video file
• Type (photo or video), source (camera or album), dimensions, size, and, in the case of video, duration
• Approximate capture date, when available
• Identifier of the person who uploaded it (to display the name in the album and allow deletion by the author)
• Likes (who liked it and the count)
• Event cover, if you upload a custom image

About EXIF and location: photos taken with the App’s camera are uploaded without EXIF. Images selected from the device’s album may contain original metadata (including location, if the original photo contains it). We do not collect real-time GPS location.

Photos and videos may depict you and other people present at the event. This content is personal data of everyone depicted. The person uploading it is responsible for having authorization to share it.

2.4 Technical and diagnostic data

• Device model, operating system, language, and time zone
• Technical session identifiers (authentication tokens)
• Approximate IP address, when necessary for security and infrastructure operation
• App failure, performance, and usage logs (for example, upload errors)

We do not use advertising identifiers (such as IDFA) for ads because we do not display ads in Moments.

2.5 Device permissions

With your authorization in the operating system, the App may access:

• Camera
• Microphone (videos with audio)
• Photo library (to choose images and save copies to the album)

These accesses occur on the device. We only send to the server what you confirm for the event.

2.6 What we do not collect

• Real-time location
• Identity documents (RG, CPF, passport)
• Financial or card data
• Health data
• Content from your gallery beyond what you choose to upload or save

3. What we use the data for and legal bases (LGPD)

We use the data for the purposes below. The legal basis follows Article 7 and, where applicable, Article 11 of the LGPD.

• Provision of the service: account, login, event creation, invitations, media uploading and display, reveal, likes, and covers. Legal basis: performance of a contract.
• Technical operation: storing, transcoding, and delivering photos and videos to authorized participants; generating temporary access URLs. Legal basis: performance of a contract.
• Profile and preferences: name displayed on media, default time zone, and language. Legal basis: performance of a contract and, when applicable, consent.
• Security and abuse prevention: authentication, upload limits, logs, fraud prevention, and misuse prevention. Legal basis: legitimate interest and performance of a contract.
• Support: responding to emails and help requests. Legal basis: performance of a contract and legitimate interest.
• Product improvement: failure diagnostics and aggregated usage metrics. Legal basis: legitimate interest.
• Legal obligations: complying with orders from authorities, legal deadlines, and defense in legal proceedings. Legal basis: compliance with a legal obligation and regular exercise of rights.
• Device permissions: camera, microphone, and album. Legal basis: consent, granted and revocable in the system settings.

We do not sell personal data. We do not use your albums to train third-party artificial intelligence models or for behavioral advertising.

4. Who we share data with (processors)

We share data only with providers essential to the operation, acting as processors, under contracts and security measures compatible with the LGPD:

• Authentication, database, and backend (currently, Supabase infrastructure): account, profile, events, participants, and media metadata
• Media storage and delivery (currently, Bunny Storage for photos and Bunny Stream for videos): files you upload; the database stores stable identifiers, not permanent public URLs
• Media API (worker) under our control: upload reservation, processing, and temporary access URLs
• App stores (Apple / Google), when you install the App or use platform features
• Email / authentication provider, to create and recover the account

We may also share data when required by law or by order of a competent authority.

Participants in the same event can see the authorized content of that album (name of the person who uploaded it, photos, videos, and likes). This is part of the service; it is not a sale of data.

Some processors may process data outside Brazil. In these cases, we adopt appropriate contractual and technical safeguards for international transfers (Articles 33 and following of the LGPD), such as contractual clauses and encryption in transit.

5. Data subject rights (LGPD)

You may, at any time, request:

• Confirmation that we process your data and access to it
• Correction of incomplete, inaccurate, or outdated data (name and time zone can be changed in the profile)
• Anonymization, blocking, or deletion of unnecessary, excessive, or improperly processed data
• Portability, subject to commercial and industrial secrets
• Information about use and sharing
• Withdrawal of consent, without affecting previous processing (for example, disabling camera, microphone, or album access in the device settings)
• Objection to processing based on legitimate interest, where applicable
• Review of automated decisions, if we begin using them in a way that affects your interests

How to exercise your rights: use the options in the App (profile, security, and account or media deletion) or write to devgrouply@gmail.com. We will respond within the legal deadline.

Account deletion, available under Security, permanently removes your account, your profile, and the events you created. Media uploaded to third-party events may be deleted or disassociated from your identity. Copies already saved by other participants on their own devices are beyond our control.

6. Security

We adopt access controls, authentication, database permission policies (including event-based restrictions), encryption in transit and, when applicable, at rest, as well as temporary URLs for media — without persisting permanent public links.

No system is 100% secure. We recommend keeping your device up to date, using a strong password, and sharing the invitation code only with people you trust.

7. Children and adolescents

We do not intentionally collect data from children under 13 years of age. The App is not intended for this age group.

If you are a parent or guardian and believe that a child under 13 has created an account, contact devgrouply@gmail.com so that we can delete the data.

Adolescents between 13 and 18 years of age must use the App with authorization and supervision. Events (birthdays, baby showers, weddings) may contain images of children uploaded by adults: the person uploading them must have authorization from the responsible guardians.

8. Retention and deletion

We retain data for as long as necessary to provide the service, comply with legal obligations, and resolve disputes.

• Active account: profile data, events, and media while the account and events exist
• Media deletion by the author: the photo or video is removed from the event; the corresponding file is deleted from the media infrastructure
• Event deletion by the organizer: the event and its media are removed
• Account deletion: profile and events owned by you are deleted; sessions are terminated
• Technical logs: short retention periods, except where necessary for security or legal obligations

After deletion, we may retain anonymized data for statistics or minimum records required by law.

9. Cookies and similar technologies

In the mobile application, we do not use browser cookies in the same way as a website. We use local storage on the device (for example, session and pending invitation code) and essential authentication, diagnostic, and media SDKs.

We do not use advertising SDKs. If, in the future, there are ads or optional analytics with tracking, we will request consent when required by law (including App Tracking Transparency on iOS) and update this Policy.

10. Subscriptions, payments, and ads

Moments does not offer a paid subscription and does not display third-party ads in this version.

We do not collect card data or banking information. If we begin offering paid plans or ads, we will update this Policy and the Terms before enabling the feature, indicating the legal basis and the processors involved (for example, the app store).

11. Change of purpose

If we change the purpose or legal basis of the processing, we will inform you in the App or by email and, when necessary, obtain new consent.

12. Changes to this Policy

We may update this Policy periodically. Relevant changes will be communicated in the App or by email. Continued use after the communication constitutes acknowledgment of the new version, except when the law requires specific consent.

13. Contact

Questions, requests, or exercise of rights: devgrouply@gmail.com