# Privacy Policy

> Canonical: https://linof.ai/privacy · Last updated: October 18, 2026

Translations of this policy are provided for convenience. The English version is the binding one.

Linof ("linof.ai", "we", "us") turns your photos and home videos into short memory films. This policy explains what information we handle, why we handle it, and what is under your control, in plain words, with the full detail underneath.

It applies to linof.ai, app.linof.ai, and the film pages we host for you.

## 1. Who we are and what this covers

> **In short:** Linof is a small, independent service. This one page covers everything we do with your information.

Linof is a small, independently operated service. "We", "us" and "our" in this policy mean the operator of linof.ai. This policy covers our website, our app, and the films we host and deliver for you.

We deliberately run a quiet product: no data brokers, and analytics cookies and ad measurement only if you accept them. Without a yes we still count visits, but without cookies and without knowing who you are (section 13). The information we handle exists for one purpose (making and delivering your films), and this page walks through all of it.

Questions any time: [info@linof.ai](mailto:info@linof.ai). A real person reads it.

## 2. The short version

- **Your photos, videos and films belong to you.** We use them only to create and deliver your films.
- **We never sell** your content or your personal information, never show your content to other users, and never use it to train AI models.
- We use a small number of carefully chosen service providers, named in section 6, to store your files, run the AI steps, and process payments.
- **We measure our Facebook and Instagram ads with the Meta Pixel, only if you say yes to Advertising** in the cookie notice. Google Analytics, too, runs only if you accept it. PostHog counts visits either way, but knows they are yours only after a yes.
- **We record how the app looks and behaves while you use it**, so we can see a problem happen instead of guessing. What you type is always hidden; the recordings we send to Sentry also hide your email address and name, show your photos only as small copies, and are kept in the EU for at most 90 days (see section 14). Only to fix things, never for advertising.
- **Films you share are visible to anyone who has the link.** Share links only with people you trust.
- You can delete films in the app, and you can delete your whole account from Settings, with 30 days to change your mind.

## 3. The information we collect

> **In short:** Your email and name, the photos and videos you upload, purchase records, and the messages you send us. That's it.

| Category | What it includes | Where it comes from |
| --- | --- | --- |
| Account details | Your email address, your name, and which sign-in method you use (email code, Google, or Facebook) | You, or your sign-in provider |
| Your content | Photos and videos you upload, the films we generate from them, and technical notes about each file (size, type, and what our AI analysis records about each photo; see section 5) | You |
| Purchase records | What you bought, when, the amount, and Dodo Payments' reference numbers, never your card number | Dodo Payments |
| Product records | Your plan, credit balance, language preference, and in-app notifications | Created as you use Linof |
| Support messages | Emails you send us | You |
| The Linof chat | Your messages in a project's chat, Linof's replies, notes from the Linof team, and photos you attach in it. See section 5. | You, and created as you use Linof |
| How you use the app | Which pages you open and what you press, errors the app or our film-making steps hit, and recordings of how the screen looked while you used it. See sections 13 and 14. | Created as you use Linof |

That is the whole list. We don't collect your contacts or your precise location, we don't follow you around other websites, and we don't buy information about you from anyone.

## 4. How we use your information

> **In short:** To make your films, tell you when they're ready, keep the service safe, and meet legal obligations. Ad measurement only with your yes.

- **To provide the service:** storing your uploads, analyzing them, generating your films, showing them to you, and delivering the films you share. This is the contract between us.
- **To tell you what's happening:** emails and in-app notices about your films, your purchases, and your account. We don't send newsletters or marketing emails.
- **To keep Linof safe and working:** preventing abuse, enforcing usage limits, and investigating failures. This is our legitimate interest in running a safe, reliable service.
- **To meet legal obligations:** for example keeping purchase records for tax and accounting rules.
- **To measure our ads, only if you agree:** with your yes to Advertising, the Meta Pixel tells Meta which pages you opened here and when you sign up or buy, so we can see which ads work and Meta can show them to people who may like Linof.

We never sell your information, and we never use your photos, videos or films in advertising. The only advertising use is the Meta Pixel above, and only after your yes.

## 5. AI processing and your photos

> **In short:** AI services process your photos only to make your film. No facial recognition. No AI training on your content.

Making a memory film takes several AI steps. Here is exactly what happens:

- **Analysis:** Google's Gemini models look at each photo or video to judge quality and content: is it sharp, is it well framed, how many people are in it, is it a happy candid or a formal portrait. This is how the best moments are chosen.
- **Enhancement and animation:** specialist models hosted by fal.ai restore old photos, improve resolution, adjust colors and framing, and animate selected stills into short moving clips.
- **Assembly:** Shotstack, a video-editing service, cuts the selected clips together with music into your finished film.

**No facial recognition.** Our analysis detects that faces are present (how many, how large, roughly what expression) so good photos can be chosen. We do not identify who anyone is, we do not match faces across photos, and we do not create biometric templates ("faceprints") of any person. Our instructions to the AI models explicitly forbid guessing anyone's identity.

**No AI training.** We never use your photos, videos, or films to train AI models. The AI providers that see your content process it only to create your film, and the paid-API terms of Google and fal.ai state that content sent to them is not used to train their models. Some enhancement models run through fal.ai's partner network (for example Kling, which animates photos). In that case your photo is processed by that model's provider solely to create your film.

For safety, these providers may keep API content for a short period to detect abuse, up to 55 days (Google) or 30 days (fal.ai), after which it is deleted on their side.

**Automated content safety.** Uploads may be reviewed automatically for sensitive or explicit content. A flagged photo may be labeled in your library or left out of a generated film. We don't delete your photos. If you think something was flagged unfairly, email us and a person will look at it.

**The Linof chat.** Linof is the AI assistant inside your project. When you talk with it, we keep the chat: your messages, Linof's replies, notes from the Linof team, and any photos you attach. To write each reply, your messages are sent to Moonshot AI's Kimi models, together with what Linof reads about the project, such as the short descriptions our analysis wrote of its photos. Only words are sent, never the photos themselves. People from the Linof team can read the chat, so they can help with your project. The chat is kept until you delete the project or your account: deleting the project deletes its chat (photos you attached stay in your library, like your other uploads), and deleting your account deletes it with everything else once the 30 days are up (section 9).

## 6. The service providers we rely on

> **In short:** Nine named providers help us run Linof. They work under our instructions and can't use your content for their own purposes.

| Provider | What they do for us | What they receive |
| --- | --- | --- |
| Base44 | Runs our app platform: hosting, sign-in, database, and email delivery | Account details and product records |
| Cloudflare (R2) | Stores your uploads and finished films | Your content |
| Google (Gemini API) | Photo and video analysis | Your photos and videos, during analysis |
| Moonshot AI (Kimi API) | The replies of Linof, the AI assistant in your project, and, when we choose Kimi for it, the motion prompt that tells an animation how a photo should move | Your Linof chat messages and what Linof reads about the project, to write each reply; for a motion prompt, the finished photo |
| fal.ai | Photo restoration, enhancement, and animation, some models via fal's partner network (see section 5) | Your photos, during processing |
| Shotstack | Assembles and renders the final film | Processed clips and music; their copies are deleted within about 24 hours of rendering |
| Dodo Payments | Payment processing, as our merchant of record | Payment and billing details. Your card number goes only to Dodo, never to us |
| Sentry | Error reports, performance diagnostics and recordings of your visit, so we can find and fix problems. Sentry processes them on our behalf, under a contract with us, and stores them in the EU | Diagnostics that include your film content (the requests we send to our AI and video providers, and their replies) and recordings of your visit, in which your photos appear only as small copies; your user id, never your email address or name |
| PostHog | Counts visits to our site and app, so we can see how Linof is used. PostHog processes them on our behalf and stores them in the EU (see section 13) | The pages you open, your browser and device type and, like any web request, your device's IP address; after a yes to analytics, also an id kept in your browser and, once you sign in, your user id, never your email address or name. It never records your screen |

These providers process data on our behalf to do exactly these jobs. Dodo Payments is a little different: as our merchant of record it is the seller on your receipt, and like every payment company it also uses payment data for its own tax, compliance and fraud-prevention purposes, described in [Dodo's privacy policy](https://dodopayments.com/privacy-policy). Apart from Meta's ad measurement (section 13), which runs only if you say yes to Advertising, we share your information with no one else, and never with data brokers. We would disclose information if the law genuinely required it, and we would tell you unless we were legally prevented from doing so.

One small extra: prices shown in your local currency use exchange rates that your browser fetches from a public exchange-rate service. Like any web request, that service sees your device's IP address, but nothing about your account or your content.

## 7. Where your files live, and who can see them

> **In short:** Uploads are private. Finished films live at a share link. Anyone who has the link can watch.

Your uploads are stored privately (on Cloudflare R2). The app reads them through expiring, signed links. There is no public address for your photo library. While a film is being made, working copies of the photos being processed travel between our processing services over unlisted, hard-to-guess links.

**Finished films are link-public.** Every finished film has a share page and a direct video address. Anyone who has the link can watch or download the film. That is what makes one-tap sharing with family possible. We don't put your films on our public gallery or anywhere else.

Please share film links only with people you trust, and delete a film if you no longer want it reachable.

## 8. How long we keep things

> **In short:** We keep your content while your account is active so you can keep making films. Delete a film, and it's gone right away.

| What | How long we keep it |
| --- | --- |
| Your uploads (photos and videos) | While your account is active, so you can come back and make more films, or until you ask us to delete them |
| Finished films | Until you delete them in the app, or until your account is deleted |
| The Linof chat | Until you delete its project or your account. Photos you attached stay in your library, like your other uploads |
| Account details and product records | While your account exists |
| Purchase records | As long as tax and accounting rules require. These survive account deletion |
| Records that a payment, refund or free credit was already handled | Kept after account deletion, like purchase records, because they are what stops a payment, refund or credit from happening twice. They hold your user id, never your email address or name |
| Records of what you agreed to (our Terms of Use, and your choice about emails) | Kept after your account is deleted, as our legal record that your consent was given, for as long as we need it to show that. What stays is only what proves it: your user id, what you agreed to, which version of our Terms, on which screen, and when. Any email address or IP address an older record still carries is removed when your account is deleted |
| Your Affiliate record, if you joined our Affiliate program | Kept after your account is deleted, under your user id and without your email address: which version of the Affiliate terms you accepted and when, when you were approved, and your Affiliate code, which is never given to anyone else |
| Support emails | As long as needed to help you and keep a record of the conversation |
| Usage records | Which pages you open and what you press are kept with our diagnostics at Sentry, up to 90 days (see below). The older records we kept ourselves were copied once into a private archive when we moved to Sentry; that archive is deleted 90 days after it was made |
| Recordings of your visit made by our hosting platform | 30 days, then deleted automatically |
| Diagnostics sent to Sentry, including its recordings of your visit | Up to 90 days, then deleted automatically. They can't be deleted one person at a time, so they follow this schedule even if you delete your account |

When you delete a film, its video file and share page are removed right away.

**Deleting your account happens in two stages.** When you ask, we schedule it, but nothing is erased yet. Everything stays exactly as it is for 30 days so you can change your mind. When those 30 days are up, we permanently delete your uploads, your films and video clips, your drafts and saved projects, any unused credits, and your account details. See section 9 for how to do it.

Some records stay after your account is deleted, as the table above lists. Tax and accounting rules require us to keep your payment and invoice records. We keep the small record of what you agreed to and when, under your user id only, so we can always show that your consent was given. And if you were a Linof Affiliate, your Affiliate record stays too. What stays is visible only to us.

## 9. Your rights and choices

> **In short:** See, correct, or delete your data any time. Delete your account yourself in Settings, with 30 days to undo it.

Wherever you live, we give you the same set of rights over your information:

- **Access:** ask for a copy of the personal information we hold about you.
- **Correction:** have inaccurate details fixed.
- **Deletion:** have your uploads, films, and account deleted.
- **Objection and restriction:** object to or limit a particular use of your information.
- **Complaint:** raise the issue with your local data-protection authority. We'd appreciate the chance to help first.

**Deleting your account.** You don't need to email anyone. Open **Settings → Delete account**: we show you exactly what will be deleted, ask you to type your email address to confirm, and then schedule the deletion. We email you straight away with the date it becomes permanent.

**You have 30 days to change your mind.** Nothing is erased during that window, and every page in the app carries a Restore account link: one tap and your films, photos and credits are exactly as you left them. After 30 days the deletion runs, we email you to confirm it's done, and it can't be reversed.

You can also delete individual films in the app at any time. For anything else (access, correction, objection, or a deletion request you'd rather make by hand), email [info@linof.ai](mailto:info@linof.ai) from your account's email address. We complete those requests within 30 days and confirm when it's done.

## 10. Children

> **In short:** Accounts are for people 13 and up. Photos of your kids are your family's to share, and a parent can always ask us to remove them.

You must be at least 13 years old (or the higher minimum age your country's law sets) to create a Linof account. We do not knowingly collect information from children below that age.

Memory films are usually full of children: birthdays, first steps, family holidays. When you upload photos of children, you are responsible for having the family's OK to use them (see our [Terms of Use](https://linof.ai/terms)). If you are a parent or guardian and photos of your child were uploaded without your permission, email [info@linof.ai](mailto:info@linof.ai) and we will help remove them.

## 11. International transfers

> **In short:** Our providers run in data centers in several countries. Wherever your data goes, the same protections travel with it.

The service providers listed in section 6 operate data centers in various countries, including the United States. Wherever your information is processed, it remains covered by this policy and by our agreements with those providers, which include the safeguards required by data-protection law (such as the European Union's standard contractual clauses, where they apply). Moonshot AI, which runs Kimi, is a company based in China, so what we send it goes to a company in China to be processed.

## 12. Security

> **In short:** Encrypted connections, private storage, expiring links. And honesty: no service can promise perfect security.

All connections to Linof use encryption in transit (HTTPS). Your uploads live in private storage that is only reachable through short-lived, signed links, and access inside the service is limited to what each step needs.

No internet service can honestly promise perfect security. Keep the email account you sign in with secure, and if you ever notice something wrong, tell us right away at [info@linof.ai](mailto:info@linof.ai).

## 13. Cookies and local storage

> **In short:** Analytics and advertising cookies only if you say yes; without one we still count visits, cookie-free and anonymously. The rest is just the storage that keeps you signed in.

If you say yes to Advertising, we load the Meta Pixel. Meta (the company behind Facebook and Instagram) sets a cookie that lasts up to 90 days and handles this information under [Meta's privacy policy](https://www.facebook.com/privacy/policy). Say no and it never loads.

If you said yes to Advertising and then buy, our server also tells Meta about the purchase: which pack, its price, Meta's own browser id, your browser type, and your email address in scrambled (hashed) form, so Meta can match the purchase to the ad you saw. Meta receives the scrambled form, never the address itself.

We do use Google Analytics to see how the site is used: which pages people open, and where they give up. It sets a cookie in your browser, so it is only loaded after you accept it in the notice at the bottom of the page. Choose “Essential only” instead and it is never loaded at all, and you can change your mind at any time from “Cookie settings” in the footer.

We also count visits with PostHog, which stores the data in the EU: with your yes to analytics it keeps an id in your browser and, once you sign in, knows your visits are yours; choose “Essential only”, or send a Global Privacy Control signal, and it still counts the visit but keeps no id in your browser and does not know who you are. It never records your screen.

Everything else is storage your browser keeps so the app can work:

- your sign-in session, so you stay logged in,
- your language choice,
- your answer to the cookie question, kept once for both linof.ai and app.linof.ai,
- an error-reporting session id (Sentry), cleared when you close the tab, so a recording of your visit stays in one piece,
- a friend's invite code, if you came through their link or typed it in when signing up (kept as “linof.referral.v1”): it lasts up to 30 days, travels with you from linof.ai to app.linof.ai, is sent with your sign-up, and is removed once your sign-up is saved,
- where you first came to Linof from (kept as “linof.arrival.v1”): which of our links brought you (its channel and post name), the address of the site you came from, and whether you came through a shared film, never an ad click id. It lasts up to 30 days, travels with you from linof.ai to app.linof.ai, is sent with your sign-up, and is removed once your sign-up is saved. Your account keeps only the channel, such as “Instagram post”, and the post name too if you said yes to analytics,
- basic app settings, and
- cached currency exchange rates, so prices display in your currency.

Apart from that invite code and where you came from, which are sent with your sign-up, these stay on your device. Clearing your browser's storage removes them. You'll simply need to sign in again, and we'll ask about analytics and advertising once more.

## 14. Recordings of your visit

> **In short:** We record a playback of how the app looked and behaved while you used it, so we can see a problem happen instead of guessing. We care about your data, so we hide what we don't need: every recording hides what you type, and the ones we send to Sentry also hide your email address and name and show your photos only as small copies.

Our hosting platform records a playback of your visit: the pages you open, where you move and click, and how the app responded. It lets us watch a bug happen rather than piece it together from a description afterwards.

**Our hosting platform's recordings hide everything you type.** Every field is masked before anything leaves your browser: your email address, your password, your name, anything you type anywhere. The characters never reach us.

**About your photos.** A hosting-platform recording captures how the page looked, so a photo you were viewing can appear in the playback. The recording does not copy the picture itself: it stores the address the picture was loaded from, and those addresses are short-lived signed links to our private storage (see section 7).

A recording stops on its own after a short session, and sooner if you stop interacting. We use these only to find and fix problems, never to build a profile of you, and never for advertising. Only our own team can open one, and each of these recordings is deleted automatically 30 days after it is made.

**Recordings sent to Sentry.** We also record visits with Sentry, our error-reporting service (section 6). Sentry processes them on our behalf, under a contract with us, and stores them in the EU. Once you start creating a film or open checkout, the rest of that visit is recorded. Everywhere else, only the last minute or so before something goes wrong is sent, and nothing at all if nothing does.

**We hide what we don't need.** A Sentry recording shows the page as you saw it: its text, your film's words and settings, and where you clicked. It hides everything you type, and every place the app shows your email address or name, or someone else's. The recording also notes the requests the app made to our servers: their web addresses are kept without the part after the question mark, email addresses in them are replaced, and the requests that carry upload links, payment links, contact details or account data are left out entirely.

**Your photos appear as small copies.** So we can see what you saw, a photo from your private storage appears in the recording as a small, lower-quality copy that your browser makes while you use the app. The private link the photo was loaded from is never recorded. A video appears as its cover picture, if it has one; anything we can't copy appears as an empty box.

**We keep them safe.** Sentry recordings carry your user id as the only identifier attached to them: never your email address or name. They are stored in the EU, only our own team can open them, and they are deleted automatically after at most 90 days.

If you would rather not be recorded, tell us at [info@linof.ai](mailto:info@linof.ai). It is one of the choices described in section 9.

## 15. A note for California and other US states

> **In short:** We don't sell personal information. Ad measurement only if you opt in, and you can switch it off any time. Everyone gets the same rights.

We do not "sell" personal information as that term is defined in US state privacy laws. If you say yes to Advertising, the Meta Pixel may count as "sharing" personal information for targeted advertising under California law. It happens only after you opt in, you can switch it off any time from "Cookie settings" in the footer, and if your browser sends a Global Privacy Control signal we treat it as a no. Residents of California and other states with privacy laws can exercise the rights described in section 9. We extend the same rights to everyone, everywhere, without discrimination for using them.

## 16. Changes to this policy

> **In short:** If something meaningful changes, we'll tell you before it takes effect.

When we make a meaningful change to this policy, we will update the date at the top and let you know (in the app or by email) before the change takes effect. Earlier versions are available on request.

## 17. Contact us

For anything about privacy (questions, requests, worries), email [info@linof.ai](mailto:info@linof.ai). A real person reads it and answers.

Questions? [info@linof.ai](mailto:info@linof.ai) · Also read: [Terms of Use](https://linof.ai/terms)