Last updated: August 13, 2026
This Privacy Policy describes the collection, use, disclosure, storage, and deletion of personal information in connection with the Aevo mobile application, website, and related services (collectively, the “Service”). Use of the Service is also subject to the Aevo Terms of Use.
Aevo is independently operated. References to “Aevo,” “we,” “us,” or “our” refer to the operator of the Service. Privacy inquiries and requests may be submitted to support@goaevo.com.
The categories of information processed through the Service depend on the features used.
Access to a device media library is limited to media selected or captured by the user through the applicable device permissions. Aevo does not access the complete media library.
Personal information is processed for the following purposes:
Selected media, generated content, and information relating to visible faces are not sold and are not used for advertising, data brokerage, facial identification, identity verification, or the training of an Aevo-owned foundation model.
AI generation may require selected User Content to be uploaded to Aevo-controlled storage hosted on Hetzner infrastructure and transmitted to Replicate, LLC. Information transmitted to Replicate may include prompts, generation settings, selected photos or videos, video audio, visible faces, other submitted references, and temporary model output. Replicate processes this information as a third-party AI service for the sole purpose of producing the requested generation.
Generation requests sent to Replicate do not intentionally include the user’s email address, display name, subscription information, or Aevo account identifier. Submitted media may nevertheless identify a person through its content.
Before the first transmission to Replicate, the Service displays a contextual notice identifying the recipient, the categories of information transmitted, and the purpose of the transmission. Processing begins only after explicit permission is provided through the Agree and Continue” action.
Personal information may be disclosed to service providers only to the extent necessary to operate the Service, fulfill a user request, protect the Service or its users, complete a lawful transfer of the Service, or comply with a legal obligation.
| Service Provider | Information Processed | Purpose |
|---|---|---|
| Replicate, LLC | Prompts, generation settings, selected photos, videos, video audio and other references, temporary model outputs, and logs. | AI processing required to produce requested images and videos. |
| Hetzner Online GmbH | Uploaded and generated files, application traffic, and operational logs. | Server, network, and S3-compatible object-storage infrastructure. |
| MongoDB, Inc. (MongoDB Atlas) | Account and authentication records, prompts and generation inputs, generation records and URLs, settings, subscription status, purchase history, and operational metadata. | Managed database hosting. |
| RevenueCat, Inc. | App user identifier, synchronized email address, purchase and subscription events, product identifiers, and device or store metadata. | Subscription entitlement, purchase, and credit administration. |
| Microsoft Corporation (Clarity) | App interactions, screen or session representations, device information, and diagnostics. | Product analytics, usability analysis, and troubleshooting. |
| Apple Inc. and Google LLC | Authentication identifiers and account information supplied during sign-in; Apple also processes App Store purchase and subscription information. | Authentication, app distribution, payment processing, subscription administration, and fraud prevention. |
Aevo uses Microsoft Clarity to understand how the Service is used, identify confusing or non-functioning interfaces, diagnose technical problems, and improve usability. Depending on the device, app version, screen, and configured capture rules, Clarity may collect:
A Clarity session replay is a reconstruction from captured interface and interaction data, not a conventional camera or microphone recording. Clarity is not used to record audio, access the device photo library, or perform AI generation. Microsoft provides masking controls intended to prevent sensitive text or images from appearing in a replay; capture can nevertheless depend on the applicable screen and Aevo’s configuration. Users should not enter or display information in the Service that is unnecessary for the selected feature.
Clarity information is used for product analytics and troubleshooting, not by Aevo for advertising or cross-app tracking. Microsoft states that ordinary playback data is retained for 30 days, while labeled or favorited sessions and aggregated interaction or heatmap data may be retained for up to nine months. Information is stored using Microsoft Azure and may be processed by Microsoft in accordance with the Microsoft Privacy Statement and Clarity Terms.
When a user selects a Replicate-powered feature and grants the contextual permission described in Section 4.1, Aevo sends the prompt, selected media and references, generation settings, and other inputs required by the selected model to Replicate. The submitted media may contain a face or other identifying information. Aevo does not intentionally include the user’s email address, display name, subscription information, or Aevo Account identifier in a Replicate generation request.
Replicate processes the information to run the selected model, return the requested Output, maintain service security, and produce associated technical logs. Replicate states that, by default, API prediction input parameters, output values, input and output files, and logs are automatically removed after one hour. Aevo saves a separate copy of requested Output only when necessary to make it available through the Service. Additional information is available in Replicate’s Privacy Policy and API data-retention documentation.
Aevo uses Hetzner infrastructure for application servers and S3-compatible object storage. Hetzner-hosted systems may process uploaded and generated files, account and API traffic, IP addresses, request dates and times, requested URLs, response status, transferred-data volume, and security or operational logs. This processing is necessary to receive requests, temporarily stage inputs, deliver saved creations, operate the Service, diagnose failures, and protect the infrastructure.
Aevo controls the application records and stored objects on this infrastructure and determines their retention as described in Section 6. Hetzner may process limited infrastructure and account information as necessary to provide and secure its hosting services and comply with law. Additional information is available in Hetzner’s Data Privacy Policy.
Aevo uses MongoDB Atlas to store structured application records. Depending on the feature used, those records may include email address; username; Apple, Google, RevenueCat, and internal Account identifiers; authentication records; registration IP address; credit and subscription balances; purchase history; prompts and generation inputs; model and generation settings; creation URLs; generation status, cost and diagnostic metadata; Account settings; and timestamps.
MongoDB Atlas does not independently select this information or use it to perform AI generation. It hosts and secures the database on Aevo’s behalf. Database records remain subject to Aevo’s deletion and retention practices in Sections 6 and 7, subject to temporary backups and legal or security requirements. Additional information is available in MongoDB’s Privacy Policy.
Aevo uses RevenueCat to validate purchases and maintain subscription, entitlement, and credit status. RevenueCat may process an Aevo or RevenueCat app-user identifier; synchronized email address; device type and operating system; app, store, locale, currency, and country information; product, offering, entitlement, trial, purchase, renewal, cancellation, expiration, and refund events; transaction and receipt information; and the device’s current App Tracking Transparency authorization status. RevenueCat does not receive full payment-card details from Aevo.
Aevo receives purchase events from RevenueCat and stores the information required to grant features or credits, restore purchases, prevent duplicate crediting and fraud, handle cancellations or refunds, and maintain accounting records. RevenueCat states that it uses purchase history for app functionality and analytics and does not inherently use that history to track users across unrelated apps for advertising. Additional information is available in RevenueCat’s Privacy Policy.
When a user chooses Sign in with Apple or Google Sign-In, the selected provider authenticates the user and supplies Aevo with an account identifier and the account information authorized by the user, which may include an email address, name, or profile image. The provider may independently process device, security, and sign-in information under its own policy. Apple also processes App Store purchases, payment credentials, receipts, subscription status, renewals, cancellations, and refunds. Aevo receives transaction and entitlement information but not full payment-card details.
Information processed independently by Apple or Google is governed by the applicable provider’s terms and privacy policy. Users can manage provider permissions and App Store subscriptions through their Apple or Google account settings.
Service providers acting on behalf of Aevo are required to process personal information only for the applicable service and to provide the same or an equivalent level of protection described in this Policy and required by applicable law.
| Data Category | Retention Practice |
|---|---|
| Temporary upload files | Scheduled for deletion after approximately 30 minutes. |
| Replicate API data | Replicate states that API prediction inputs, outputs, files, and logs are removed after one hour by default, subject to its policies and legally required retention. |
| Account information and saved creations | Retained while the Account remains open, unless an individual creation or the Account is deleted. |
| Inactive Accounts | Accounts without an active subscription are automatically closed after six consecutive months of inactivity. Associated uploads and generated content are deleted. Activity before the end of the period resets the inactivity period. |
| Analytics and diagnostics | Retained according to configured retention periods and the applicable provider’s policy, after which the information is deleted or aggregated. |
| Transaction, fraud, security, and legal records | Retained only for the period reasonably necessary for accounting, disputes, security, tax, and legal obligations. |
Expiration or cancellation of a subscription does not result in immediate Account closure. The Account remains subject to the six-month inactivity period unless deletion is requested earlier.
Individual creations may be deleted within the Service. Account deletion may be initiated through Settings → Delete Account without contacting support. Upon processing an Account deletion request, access to the Account is revoked and associated personal information is removed from active systems, subject to technical completion, secure backups, fraud prevention, transaction-record, dispute, tax, and legal-retention requirements. Service providers may retain limited information in accordance with applicable law and their authorized retention schedules.
Requests for access, correction, deletion assistance, or withdrawal of consent may also be submitted to support@goaevo.com. Identity verification may be required before a request is completed.
Where a legal basis is required, processing is conducted as necessary to perform the agreement governing the Service, on the basis of consent, to comply with legal obligations, or for legitimate interests such as security, fraud prevention, reliability, and improvement of the Service where those interests are not overridden by individual rights.
Depending on the applicable jurisdiction, users may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of personal information; withdraw consent; and appeal or submit a complaint to a data-protection authority. Aevo does not sell personal information or share personal information for cross-context behavioral advertising.
Aevo and its service providers may process information in countries other than the user’s country of residence. International processing is conducted subject to contractual or other lawful safeguards where required.
Reasonable technical and organizational measures, including transport encryption, access controls, provider controls, and operational safeguards, are used to protect personal information. No electronic transmission or storage system can be guaranteed to be completely secure.
The Service is not directed to children under 13, and Aevo does not knowingly collect personal information from children under 13. Information identified as having been submitted by a child under 13 will be investigated and deleted where required. Parental consent or a higher minimum age may apply under local law.
This Policy may be updated to reflect changes to the Service, service providers, legal requirements, or privacy practices. The “Last updated” date will be revised, and additional notice will be provided where required. New permission will be requested before implementing a material change to consent-based AI processing, including a change to the information transmitted, recipient, or purpose.
Privacy questions and requests may be submitted by email to support@goaevo.com.