Privacy policy

1. Who we are

The Narrativ service is operated by Meta Media LLC, a company registered in Georgia, Georgia, Tbilisi, Saburtalo district, Ikalto I lane N 1. Below, “we” means that company. We decide why and how the data described here is used.

This policy goes together with the Terms of Use. Where the two use the same words, they mean the same thing.

2. What data we collect and why

We collect only what the service needs in order to work:

• Account: your email address and password, or the one-time codes sent to that address. The password is handled by the sign-in provider Supabase Auth. We also keep in the account the interface language, your post-language settings and your sales settings: the post framework, call-to-action strength, funnel stage, the text about audience, tone and platform, and the “Ask when creating a post” switch. If you sign in with Apple or Google, they pass us your email address (Apple may give a private relay address instead) and a verified sign-in token. We do not store your name.
• Your content: texts, links, the original text of each request, generated results, images, logos, style references, brand colours and fonts, canvas documents with their version history, saved ideas, favourites and your own templates. For clients inside a workspace: name, niche, tone and handle.
• Photos you add from your device. They are shrunk on the device and uploaded to our file storage.
• Voice recordings. The audio is sent for transcription (section 3). We do not write it to our storage; what stays is the text you receive.
• Template choices: which template you picked, where in the app and for which post.
• Notifications: if you allow them, a push token of your device. If you turn them off in Settings, that choice is kept in your sign-in data (Supabase Auth) and is deleted with the account.
• Telegram: if you connect the bot, the number of the chat (chat ID). We do not store the Telegram username or name.
• Technical data: error reports and a sample of 1 in 10 performance traces. An error report contains the error itself, the type of device and the app version, and a log of the recent actions before the error (so-called breadcrumbs). At every launch the app also sends a session and data about that launch. For our server, both error reports and the sampled performance traces also contain the request, which may include the text or link you sent. Our server also writes ordinary logs, and the web server records the IP address, the time and the address requested.
• The sample text in the demo: the demo is available only after you sign in. To limit the number of attempts, we record your account identifier in a counter. The text itself is not saved.
• Content reports: anyone can report content on a view-link page without signing in, and signed-in users can report a result from the editor and from the draft screen. We save the reason from a fixed list, an optional text of the report (up to 1000 characters) and an optional contact of the person reporting, the date, and the link or the identifier of the material that was reported. We do not store the reporter’s IP address: an irreversible hash is saved instead (HMAC with a secret key; for a signed-in user it is computed from the account identifier), which we need for the report limit and to avoid duplicates. The hash stays with the report itself. An administrator reads the text and the contact in the admin panel. Only the report number and the reason are sent to Telegram. If a link was revoked because of a report, its owner cannot issue the link again until an administrator lifts the block (a flag on the report). A copy of reports with the reasons “illegal content” and “child sexual abuse” is kept separately (section 9).
• Accepted terms: when you sign up and when you press “Accept”, we write the number of the Terms version you accepted and the time into your sign-in data (Supabase Auth). It tells us which edition you accepted and when to ask you to confirm a new one. The record is deleted with the account.
• Request log not tied to an account: an anonymised copy of the request text and a few generation settings, without the account or IP address (section 12).
• AI permission: when you allow AI processing or withdraw the permission, we write the version of the permission and the time into your sign-in data (Supabase Auth). The record is deleted with the account.
• Usage events: while you are signed in, we record a few events: the app was opened (launch or return after a long break); a carousel was downloaded (file format and number of slides); what you did with a result (opened it in the editor, edited it, deleted a draft); voice input or link import was used. Each event is stored with your account ID, its name, the time and the platform (iOS, Android or web). Texts of posts and requests, IP addresses, device identifiers and advertising identifiers are not stored in events. Events are not passed to third-party services; they stay in our own database. Events are kept while your account exists and are deleted together with it. One more event is recorded when a text is generated: how long you waited (to a fraction of a second) and whether it succeeded or failed. It is stored like the others. We also record when you hit a limit (on downloads or on public links): your account identifier, the kind and value of the limit, and the time. The record holds none of your content. It exists to protect the service from abuse and automated scraping, is kept while the account exists, and is deleted with it. If the limit is reached by someone viewing a public link, the record is attached only to the workspace the link belongs to and says nothing about the viewer.
• Reason for deleting the account: when you delete your account you can, optionally, choose a reason from a list. It is saved without any link to the account, as the date and the chosen option only, and it stays after the account is deleted (section 9).

We use this data to run the service, tailor results to you, count what the AI models cost us, understand what is used and where the product breaks, improve the app, find and fix errors, keep the service safe, review reports about content and answer your requests. We do not use it for advertising and do not sell it. The app has no advertising services and no third-party analytics.

3. Who we pass data to

We do not sell your data. To run the service we pass data to these contractors, each only for its own job:

• Supabase: database, file storage and sign-in. It holds all the data of your account.
• OpenRouter: the AI service that sends our requests to text and image models from Anthropic, OpenAI, Google and others. It receives what you typed or imported, brand data, and, where you ask us to analyse them, your photos and style references. In some cases text goes to Google AI directly.
• OpenAI: speech recognition and the safety check of texts. When you dictate, the audio goes from your device straight to OpenAI; a recorded file goes there through our server. When OpenAI is not used for a file, the recording goes through OpenRouter to a Google model. Besides that, the text of every request and of every result is sent to OpenAI to check it for content that is not allowed (sexual content involving minors, threats, graphic violence, self-harm); OpenAI returns only the verdict.
• AI image generation: if it is switched on, the topic, the style and the slide text go through OpenRouter to the image model, with a style reference if you attached one.
• Apify: when you paste a link from TikTok, Instagram, X, Threads or LinkedIn, the link goes to Apify to read the post. For video posts our server then downloads the clip for a short time, and the sound and several frames go to the speech and image models above. The clip is deleted afterwards. Other web pages and YouTube transcripts our server reads itself.
• Photo catalogues (such as Openverse and Pexels): a short search phrase about the slide topic. The text of your post is not sent. The photos found are saved to your workspace’s storage.
• Telegram: if you connect the bot and press send, the chat ID and the content you are sending.
• Expo: delivers push notifications; it receives the device token, the short text of the notification and the id of the post that finished.
• Resend: sends the sign-in and confirmation emails; it receives your email address and the email.
• Sentry: receives error reports and performance samples from the app and from our server.
• Apple and Google: only if you choose to sign in with them, to confirm it is you. They pass us your email address and a sign-in token.

We may also give data to authorities when the law requires it.

These contractors handle data under their own terms and privacy policies. We cannot check or change how they work.

AI features work only with your permission. The app asks for it on a separate screen before the first request that sends your content to OpenRouter, OpenAI or Apify. Without permission these features do not work, and the rest of the app stays available. You can withdraw the permission at any time in Settings: on the device where you do it, the AI features stop at once; on your other devices, within about 15 minutes.

4. Where data is stored

Account data, content and files are stored with our cloud infrastructure provider Supabase. Our server processes requests and passes them on to the providers above; the files it needs for a moment (for example a downloaded video) live in a temporary folder and are deleted after the job.

Images are stored in file storage behind public links that cannot be guessed. Anyone who has a link can open the picture without signing in, and copies kept by browsers, messengers or delivery networks can keep opening after the file is deleted. Do not place in images anything that must stay private.

The app and the website also keep small amounts of data on your device (see “Cookies and local storage”).

5. International transfers

We are in Georgia, and the contractors above may process data in other countries, including ones whose data-protection law differs from yours.

By using the service you understand that your data is processed in those places. We do not promise a particular legal mechanism for transfers.

6. How long data is kept

Content and account data are kept while the account exists and are deleted when you delete it (sections 7 to 11). Shorter lives:

• A viewing link works for 3 days or until you revoke it.
• An invitation to a workspace works for 3 days.
• A code for connecting Telegram works for 24 hours; expired codes are removed automatically every 15 minutes.
• An email code for deleting an account works for 1 hour.
• The account identifier in the demo attempts counter, and the entries of the counter that limits the number of reports from one address (they hold the reporter’s irreversible hash), are removed within about 2 hours.
• Version history of a canvas document has no limit and stays until the workspace is deleted. Cost records and the administrators’ log have no time limit (sections 9 and 11).
• Photos picked automatically for a slide and not used in any saved document are removed after 30 days.
• The technical keys that protect against the same request being sent twice (they carry only technical ids of the workspace and the request, never content) are deleted 30 days after they are created, and at once when the account is deleted.
• Content reports themselves have no time limit: a report stays until the generation it was filed against, or the account of that generation’s owner, is deleted (section 8). The separate copy of reports about illegal content and child safety is not deleted with them and has no fixed term (section 9).
• Request log entries are kept for 12 months and then deleted automatically (section 12).

Sentry sets how long error reports are kept. Logs of our web server and of the hosting provider are rotated regularly, and we do not name a period for them.

7. How to delete your account

In the app: Settings → Delete account. Without the app, use the /delete-account page — the email address the account was registered with is enough. Either way we send a one-time code to that address and touch nothing until it comes back. There is no grace period: once the code is accepted the data is removed from the service immediately, and we cannot restore it.

8. What is deleted

Everything the account owns is deleted:

• the workspaces you created and everything in them — clients (with the connected Telegram chat), generations together with their texts and original requests, canvas documents with their version history, carousel templates, brand settings, your style references, saved ideas, any view links and invitations you handed out, the reports filed against your view links and your materials, and the technical keys that protect against repeated requests;
• the files stored under those workspaces: generated images, photos you uploaded, photos picked automatically, logos, exports, previews and the previews of your style references. Afterwards we check separately that not a single object is left under the workspace, and treat the deletion as failed if anything remains;
• your membership in other people’s workspaces, the push tokens from your devices, and your favourites, template choices and own templates wherever they were made;
• the account itself. It is erased rather than flagged as deleted, so the email address is freed and can be used to sign up again.

Other people’s workspaces you were invited into carry on: only your membership leaves them. Material created inside someone else’s workspace belongs to that workspace and stays with its owner.

When you pick a template, we record which one, where in the app you picked it and which post it was applied to. These records build your recent templates and the popular list, and let us count what share of posts start from the Designs tab. They are deleted together with your account.

The copy of a request text in the request log is not deleted together with the account: it is not tied to it and is anonymised (section 12).

Usage events recorded for your account are deleted together with it. Records of limit hits are deleted together with it too.

9. What stays

The generation cost records: which model, how many tokens or items, what it cost and when. The same goes for the usage records of the link-reading service. At the same moment the workspace is deleted, the database itself (and, for the link-reading records, our deletion code) detaches these records from it. The amount and the date remain; whose request it was does not.

These records hold no texts, no images and no email address. We keep them because they are our own accounting for what the services cost: without them there is no reconciling a provider’s invoice and no explaining a spike in spending. The anonymised copy of a request text is kept separately, in the request log (section 12).

Copies of reports with the reasons “illegal content” and “child sexual abuse”. When such a report is filed, a copy of the fact of the report is saved separately: the reason, the text and the contact the reporter wrote, the date, the identifiers of the material and of the workspace, and the reporter’s irreversible hash. The copy does not contain the material itself. It is not deleted with the material or with the account, because we may need it to handle such a report and to answer the authorities, and it has no fixed term. The administrator alone reads it.

The reason for deleting, if you chose one, is kept: it is saved without the account ID, as a date and the chosen option only. We do not promise that it can never be linked to you: with a small number of users, a date can be close to the day your account was deleted.

10. Backups

Copies of the database and the storage, if there are any, are managed by our infrastructure provider, Supabase, under its plan and its own rules. We do not name a retention period for them because we do not control it. This means that after you delete your account, the provider’s copy of your data, if one exists, may live for some time after the data has left the service. If this changes in a way that matters to you, we will update this section.

11. What deletion does not reach

There are places the Delete account button does not reach, and it is fairer to name them:

• the admin action log. It records which administrator changed a service setting or opened a particular generation to look into a problem. It holds the administrator’s address and technical ids (such as the generation and the workspace), not your texts and not your address. But if the administrator was you, your address stays in that log;
• the sign-in log kept by Supabase, our authentication provider. It is held on their side and lives by their rules, not ours;
• messages the bot has already sent to Telegram. They sit in someone else’s chat and we have no way of taking them back;
• cached copies of images. The image links are public: we delete the file itself, but a copy left in a browser, CDN or messenger cache may keep opening for a while;
• the request log (section 12). It holds no account, workspace or generation id, so its entries cannot be found and deleted through your account; they delete themselves after 12 months;
• what has already reached the contractors in section 3 (AI and speech services, error reports, email delivery). Deleting an account does not send them a deletion request, and they keep it under their own rules.

12. Request log not tied to an account

After every successful generation we copy into a separate log the text of your request (up to 500 characters), the language, template, category, format, number of slides, where the generation was started from, the type of source (text, link and so on) and the date — without the time. Some fields may be empty. Before it is written, email addresses, phone numbers, links, @handles, card numbers and long numbers are cut out of the text automatically.

The log holds no account, workspace, generation id, IP address or exact time. While your account exists, administrators can see your generations anyway, and the log does not protect against that: an entry can be matched to a generation by its text. What the log changes is what remains after your account is deleted: the original generations are gone, only a de-identified copy stays, and it can no longer be connected to you. For that reason the log is not deleted together with your account and cannot be found by a request about your data.

We keep it to understand which topics and templates people need. Only the service administrators can see the log, and views and exports of the log are recorded in the administrators' action log. Entries are kept for 12 months and then deleted automatically.

This text cannot be called fully anonymous: it is made anonymous automatically, but it may contain what you wrote yourself. Do not put personal data into your requests.

13. Your rights and how to use them

You can ask us to:

• tell you what data we hold about you and send you a copy;
• correct data that is wrong;
• delete your data (you can also do this yourself, right away, as described in section 7);
• stop a particular use of your data, where we can do so without closing the account.

Write to support@mtmd.dev with “Privacy Request” in the subject, from the email address of your account, so that we can tell the request is yours. We handle these requests by hand.

You can do much yourself in the app: edit and delete content, revoke a viewing link, turn notifications off in your device settings, or delete the account. Depending on your country, you may also have the right to complain to the data-protection authority there.

14. Cookies and local storage

We do not set cookies. The website and the app keep a few things on your device instead (the browser’s local storage on the web): your sign-in session, the interface language and post-language settings, a cached first page of your drafts and of the template lists, the choices of the audience and tone you entered, recent topics, a carousel that has not been saved yet, a queue of template choices made offline, the set of loading animations and a counter that decides when a hint is shown. While an invitation is being accepted, its token waits in the browser tab’s session storage.

On sign-out the app clears the drafts, template lists, offline queue, unsaved carousel and generation options. The sign-in session goes with the sign-out; the language, loading animations, hint counter and some other settings, such as recent topics, stay on the device until you clear them.

None of this is used for advertising or for following you across other sites. You can clear it in your browser settings or by uninstalling the app. The exception is the sign-in session on iOS: it is kept in the system Keychain, which can survive uninstalling the app. Sign out before you uninstall; if an entry is left over, the next installation of the app deletes it at the first launch.

15. Children

The service is for people who are at least 16 years old, as the Terms say. We do not knowingly collect data from younger children.

If you believe a child under 16 uses the service, write to support@mtmd.dev. If we learn that it is so, we may close the account and delete its data.

16. Security

What we do to protect data, as far as we can state it:

• connections to the service are encrypted;
• every request that reads or changes an account’s data is checked against the signed-in account and the workspace, and a workspace’s data is not shown to other workspaces;
• links for viewing and invitations carry a secret token in the part of the address that is not sent to the server and is not written to our logs; pictures in a viewing link are served through signed addresses;
• deleting an account needs a code sent to the account’s email, and the number of attempts is limited.

No method of transmission or storage is completely safe, so we cannot guarantee absolute security. Keep your password and your sign-in emails safe.

17. Changes to this policy

We may change this policy, for example when new features appear or the law changes. The date of the latest update is at the top of the page.

We will publish material changes on this page and, where we can, tell you in the app or by email at least 14 days before they take effect, unless the law requires otherwise or the change is urgently needed to stop abuse or a security threat. If you keep using the service after that date, you accept the new version. If you do not agree, stop using the service and delete your account.

18. Contact us

Meta Media LLC, Georgia, Tbilisi, Saburtalo district, Ikalto I lane N 1. Questions about this policy and requests about your data: support@mtmd.dev.

Put “Privacy Request” in the subject.

If a translation of this policy, including the short version, differs from the English text, the English text prevails, unless the law of your country gives you the right to rely on the version in your language.