From a single sentence, cinema.

This policy describes what Luxim collects, where it goes, how long it is kept and how to get it back or get rid of it. Luxim turns a written sentence into a short film, and it does that by sending your words and your reference images to third-party generation services. That transmission is the central privacy fact of the product and it is described plainly in section 5.

Luxim is published by TODO(owner): legal entity name, registered address, country of establishment.

Contact: TODO(owner): support and privacy email address.

1. Summary

Data	Why it exists	How long it is kept	Who processes it
Apple account identifier (the stable user identifier Sign in with Apple returns) and, if you choose to share it, your name	Creates and identifies your account; every stored object is namespaced under it	Until you ask for the account to be deleted	Apple, Google (Firebase Authentication)
Images and video you upload as references	Supplied to the generation provider as reference material for the frames and clips it produces	Kept until you delete them; any image file is deleted automatically 180 days after it is created	Google (Cloud Storage), plus the generation provider fulfilling that request
Prompts, story text, character profiles, place descriptions, style and skill text	The instructions the models are asked to follow	Kept until you delete them	Google (Firestore), plus the generation provider or model fulfilling that request
Intermediate frames and per-shot video clips	Working artefacts of a render	Deleted automatically 30 days after they are written	Google (Cloud Storage)
Finished films and exported PDFs	The output you asked for	Kept until you delete them; PDF and video files have no automatic deletion, image files are deleted 180 days after creation	Google (Cloud Storage)
Job records, per-shot state, provider request and response logs	Shows a render's progress, supports retries, and records what was sent	Kept until you delete the film; see section 6.4	Google (Firestore)
Spend ledger and credit ledger (monthly totals in US dollars and provider credits)	Enforces the monthly spending cap and shows you what a render cost	Retained; deleting a film does not rewrite it	Google (Firestore)
Provider API keys you add	Authenticates calls to the generation provider you connected	Until you replace or remove the key	Google (Secret Manager)
Device push token	Delivers the notification that a render finished or needs a decision	Until the token is replaced or the account is deleted	Google (Firebase Cloud Messaging), Apple (APNs)
Ratings, favourites, film names, skill marks	Your own annotations; the app reads them, the backend does not	Kept until you delete them; ratings deliberately survive deletion of the film they describe	Google (Firestore)

2. Account and identity

Luxim signs you in with Sign in with Apple. The app requests only the name scope from Apple. It does not request your email address, and no email address is asked for anywhere else in the app. If you use Apple's Hide My Email feature, that has no effect here, because the app never asks Apple for an address in the first place.

What the backend holds is the account identifier Firebase Authentication derives from your Apple credential. Every document and every stored file belongs to that identifier and is addressed by it.

An anonymous sign-in path exists in the code, but it is restricted to local development against the Firebase emulator suite and cannot create an account on the production project.

3. What you give us

Uploads. You upload images, and for video-to-video work short video clips, from your device. They are stored under your own uploads folder. A single image upload is limited to 15 MB and a single video upload to 50 MB, and an account is limited to 2 GiB of uploads in total.

Text. Prompts, the sentence a film starts from, shot descriptions, character profiles, place descriptions, named render styles and prompt-craft overrides. These are stored as documents belonging to your account.

Provider API keys. Luxim does not resell generation. You bring your own key for each generation service you want to use. Section 7 describes how those keys are held.

Device push token. If you allow notifications, the device registers a token so the backend can tell you a render finished or is waiting on a decision.

4. What the service produces about you

Rendering a film writes records to your account: a job document holding per-shot state, the prompts that were used and what each shot was billed; a per-shot log of the request sent to the provider and the response that came back, with key material excluded; monthly spend and credit totals; cost estimates; and reconciliation alerts when billed cost drifts from the estimate.

You can read all of this. You cannot write it, and neither can a compromised copy of the app: those collections are written only by the backend.

5. Third parties, and what leaves the service

Prompts and reference images are transmitted to the generation provider that fulfils a request. This is not incidental. It is how the product works. When you generate, the text of the prompt and any reference images bound to that shot are sent to a third-party provider's API, either as base64 bytes in the request body or as a time-limited signed download link valid for one hour.

The text that reaches a provider is not always byte-identical to the text you wrote. Before a request goes out, the backend rewrites certain words: brand names are replaced by descriptions of the thing, a small registry of words that providers have previously refused is replaced by equivalent descriptions, and numeric ages are replaced by adult age bands. The document you saved keeps your words; only the outbound request is rewritten.

The processors, named individually:

• Google LLC / Google Cloud (Firebase). Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Tasks, Cloud Messaging, App Check and Secret Manager. This is the platform the whole backend runs on.
• Apple Inc. Sign in with Apple, and the Apple Push Notification service that carries notifications to your device.
• fal.ai. Video generation and video composition. Requests go to queue.fal.run. fal is also called back by a webhook when a render finishes.
• Higgsfield. Video and image generation over the Higgsfield gateways (mcp.higgsfield.ai, fnf-api-gw.higgsfield.ai, platform.higgsfield.ai), with authentication through clerk.higgsfield.ai. On this route, reference images are uploaded into your own Higgsfield account.
• Google (Gemini API). The vision model that reads an uploaded reference and extracts a workflow, and the image model that produces frames. Requests go to generativelanguage.googleapis.com. This is a separate API from the Firebase platform above and is called with the key you supplied.
• Anthropic. A vision and authoring model used for story understanding and direction suggestions. Requests go to api.anthropic.com.

Each provider handles the data it receives under its own privacy policy and terms, using the account your key belongs to. Luxim does not control that handling, and a provider may retain the prompt or the reference image it received according to its own policy. If you have not connected a key for a given step, that step runs against a local stub and nothing leaves the backend.

International transfer. The Cloud Functions backend deploys to the me-central1 region by default. TODO(owner): confirm and state the actual Firestore location and Cloud Storage bucket location for the project. They are set at project creation and are not recorded in this repository.

Independently of where the backend runs, the providers above are operated from their own regions, so generating a film transfers your prompt and reference images across borders. TODO(owner): if any user is in the EEA, the UK or Switzerland, name the transfer mechanism relied on (for example standard contractual clauses) and confirm it with each provider.

6. Retention

Retention is enforced by two automatic bucket rules and by your own deletions. Both automatic rules are stated exactly as configured.

6.1 Intermediates: 30 days

Every frame and every per-shot video clip the render worker writes is tagged with a custom time when it is stored, and the first lifecycle rule deletes any tagged object 30 days after that time. These are the files under frames/ and clips/.

6.2 Images: 180 days

A second lifecycle rule deletes any object under users/ whose name ends in .png, .jpg, .jpeg, .webp or .heic, 180 days after it was created, whether or not it carries a custom time. Your uploads are always images, so an upload is deleted at 180 days even though nothing else deletes it. Any image stored among your finished outputs is deleted on the same schedule.

6.3 Everything else in storage

Video files and PDF exports under your finished outputs and exports folders carry no custom time and are not images, so neither lifecycle rule reaches them. They are kept until you delete them.

6.4 Documents

Stories, characters, places, styles, skills, jobs, ratings and annotations are kept until you delete them. Deleting a film deletes its stored files, its job record and the story it was made from. Three things deliberately survive that deletion: your ratings, because they are feedback about craft rather than about the file; places that film discovered and that were promoted into your own library; and the character plates, which belong to the character rather than to the film.

6.5 The spend ledger is not rewritten

Deleting a film does not reduce the monthly spend or credit totals. Spend that happened happened, and the ledger is the record of it.

6.6 Provider request and response logs

These are stored under the job they belong to and are removed when that job is removed. TODO(owner): decide whether these logs should also expire on a fixed schedule. Today there is no separate time-to-live on them.

7. Provider API keys

The keys you add are write-only from the app. When you save a key, the backend runs a cheap validation call that spends nothing, stores the key value in Google Secret Manager under a secret named for your account and the provider, writes a pointer document holding only the Secret Manager resource name and a connection status, and returns that status and nothing else.

There is no endpoint anywhere in the backend that returns a stored key to a client, and the response types are structurally incapable of carrying one. As a second layer, the database rules reject any write to a provider pointer document that contains a field named key, apiKey, api_key, secret, secretValue, token, keyValue, credential or credentials, even when the write comes from the account that owns the document. Key values are excluded from logs, URLs and error messages.

Because the key is yours, the generation provider bills you directly for what you generate. Luxim does not see that bill.

8. Security

• Per-account isolation. Database and storage rules permit a request only where the authenticated account identifier matches the path being read or written. Everything not explicitly matched is denied.
• Backend-only writes for anything that costs money. Jobs, spend, credits, estimates and provider logs are written only by Cloud Functions. A client can read its own records and cannot fabricate a job, a cost or a state change.
• App Check. Every callable endpoint enforces Firebase App Check in addition to authentication, using DeviceCheck on release builds. Possession of the app's Firebase configuration is not authorisation.
• Secret Manager. Provider keys are never stored in the database and never returned to a client. See section 7.
• Reference paths are validated server-side. A reference must name a file inside your own uploads folder. The backend refuses a path outside it rather than reading it, because the backend reads with administrative credentials that bypass the storage rules.

One thing you control rather than we do: sharing. The player has a share button. It shares a direct download link to the film's file. Anyone who receives that link can open the file without signing in to Luxim, because the link carries its own access token rather than relying on your account. Treat a shared link as public.

No system is perfectly secure, and this policy does not promise that one is.

9. Your rights

• Access. Everything Luxim holds about you is readable in the app: your stories, characters, places, films, ratings, monthly spend, cost estimates and the per-shot provider logs.
• Export. Finished films and PDF exports can be saved out of the app. There is no single-button archive of the whole account today. TODO(owner): decide whether to build a machine-readable export, and state a mechanism here if a legal request for one has to be answered manually in the meantime.
• Correction. Stories, character profiles, place descriptions and styles are editable in the app.
• Deletion of individual items. A film, a draft story, a character look, a supporting cast member and a place can each be deleted from the app. Deleting a film removes its files, its job record and the story behind it, subject to the exceptions in section 6.4.
• Deletion of the account. TODO(owner): no account-deletion endpoint exists in the backend today, and Apple requires apps that support account creation to offer in-app account deletion. Either build that path before submission, or state here the exact manual process, the address that receives the request, and the time within which it is completed. Do not publish this page describing an in-app deletion control that does not exist.
• Objection and complaint. TODO(owner): if any user is in the EEA or the UK, name the supervisory authority a complaint can be made to and the legal basis relied on for each processing purpose.

Requests about any of the above go to TODO(owner): support and privacy email address.

10. Children

Luxim is not for children. The minimum age to use it is TODO(owner): state a single number and make it match the age rating filed in App Store Connect, which is not recorded in this repository. Accounts are not knowingly created for anyone below that age, and an account discovered to belong to someone below it is deleted.

11. Changes

Material changes to this policy will be posted here with a new effective date, and where the change affects how your existing content is processed, notice will be given in the app before it takes effect.

12. Contact

TODO(owner): legal entity name, postal address, and the email address that receives privacy requests.

Terms of Use · Support

These terms are an agreement between you and TODO(owner): legal entity name ("we", "us"). They are not an agreement with Apple. Read section 14, which sets out the terms Apple requires and the ways in which Apple's role is limited.

By downloading or using Luxim you accept these terms. If you do not accept them, do not use the app.

1. What Luxim does

Luxim takes a sentence, a story, and optionally reference images you supply, and produces short AI-generated film sequences by brokering the work to third-party generation services. The app itself starts and observes work; every paid call runs on our backend behind a cost estimate and an explicit confirmation step.

2. Licence

We grant you a personal, non-transferable, non-exclusive, revocable licence to use Luxim on Apple-branded devices you own or control, as permitted by the App Store Terms of Service and the Usage Rules in it. You may not sublicense, resell, rent, reverse engineer, decompile or attempt to derive the source of the app, except where that restriction is prohibited by law.

3. Your account

An account requires Sign in with Apple. You are responsible for the device and Apple ID used to sign in, and for everything done through your account.

4. Lumens, purchases and refunds

The intended terms:

• Lumens are a consumable virtual currency. They exist only inside Luxim. They have no cash value, are not money, are not a stored-value or payment instrument, cannot be redeemed for cash, and cannot be transferred, sold or exchanged outside the app.
• Lumens are consumed when a generation runs, not when you like the result. A generation that produces something you do not want has still consumed the Lumens it cost. Generation is paid compute, and the compute was spent. A generation that fails before anything is submitted to a provider is not charged.
• Purchases are made through Apple. All purchases of Lumen packs and subscriptions are processed by Apple through the App Store under Apple's terms, and prices are as shown at the time of purchase.
• Refunds are Apple's. We cannot issue refunds for an App Store purchase. Refund requests go to Apple. We will help investigate a technical failure and will restore Lumens where our systems are at fault, at our discretion.
• Subscriptions renew automatically until cancelled in the Apple ID settings on your device. TODO(owner): state the term, price and included Lumens for each subscription exactly as configured in App Store Connect.
• Unused Lumens are forfeited when an account is terminated for a breach of these terms, and expire as stated at the point of purchase. TODO(owner): decide whether Lumens expire at all, then state it here or say plainly that they do not.

5. Provider keys and provider billing

Where Luxim lets you connect your own provider API key, the generation service bills you directly for the work done with that key, and that billing is between you and the provider. You are responsible for keeping your key valid and for the charges incurred under it. Your key is stored write-only and is never returned to the app.

6. Acceptable use

You must not use Luxim to create, upload or distribute:

• Real, identifiable people without their consent. Do not upload a photograph of someone as a reference, and do not describe a real named person, unless you have that person's permission. This includes public figures.
• Any sexual content involving a minor, or any depiction of a minor in a sexualised context, in any style, real or drawn. There is no exception to this and no artistic framing that makes it acceptable. Luxim renders adults.
• Deceptive impersonation. Content presented as a genuine recording of a real person, organisation or event, or intended to make a viewer believe something false happened.
• Content that violates a generation provider's own terms. Your prompts and references are executed by fal.ai, Higgsfield, Google or Anthropic, and their policies apply to that work in addition to these terms.
• Content that is unlawful, that infringes someone's intellectual property, that harasses or defames, or that is designed to incite violence.

Providers run their own content checks and may refuse a request. A refusal stops that shot and asks you to decide what to do next; it is not a fault in the app.

We may remove content and suspend or terminate an account for a breach of this section.

7. Your content and the output

You keep what you bring. Uploads, prompts, stories, character profiles and everything else you author remain yours. You grant us only the licence needed to run the service: to store your content, to process it, and to transmit it to the generation provider that fulfils your request. That licence exists so the product can work, ends when you delete the content, and does not permit us to use your content to train models or to publish it.

You warrant that you have the rights to everything you upload or describe, including the rights of any person appearing in a reference image.

Output. As between you and us, you own the films, frames and exports Luxim produces for you, and may use them commercially, subject to two limits that are not ours to waive: the terms of the generation provider that produced them, and whatever the law where you are says about copyright in AI-generated material, which in several jurisdictions is that such material may not be protected at all. TODO(owner): a lawyer should look at this paragraph, and at each provider's current commercial-use terms, before it is published.

Similar output for other users. Generative models can produce similar results from similar prompts. We do not promise your output is unique, and we make no claim on output produced for anyone else.

Sharing is your decision and it is public. The share button produces a direct download link that works for anyone who receives it, without a Luxim account. Sharing a film is publication, and you are responsible for what you publish.

8. AI output is not accurate

Luxim produces synthetic images and video. Output may be wrong, distorted, implausible, or unlike what you asked for. It is not a record of anything that happened. Do not present it as one, and do not rely on it as a factual, medical, legal, financial or safety-relevant depiction of anything.

The prompt actually sent to a provider may differ slightly from the text you wrote: brand names, a small set of words that providers have refused before, and numeric ages are rewritten before the request goes out, to reduce refusals. Your saved document is not altered.

9. Cost, estimates and caps

Before a render, Luxim produces an itemised estimate with a limited validity window, and no paid work begins until you confirm it.

Estimates are estimates. Actual billed cost can differ, and when it drifts far enough the app raises an alert you can see.

A monthly spending ceiling is enforced on the server. When a render would push the month past that ceiling, generation halts rather than continuing, and stays halted for the rest of the calendar month.

If a shot has to fall over to a different provider and that provider is materially more expensive, the render stops and asks you before spending the difference.

In one situation the system cannot tell whether a submission reached the provider. It stops and tells you so, rather than resubmitting and risking a second charge for the same shot; you decide whether to resubmit.

10. Availability and provider dependency

Luxim depends on third-party generation services. If one of them is down, degraded, rate-limited, changes its API, changes its content policy, or ends your access, the corresponding part of Luxim stops working. We do not control those services and do not guarantee that any particular model, provider or quality level remains available. We may change or discontinue features.

Storage limits apply: a single image upload is capped at 15 MB, a single video upload at 50 MB, and total uploads per account at 2 GiB. Uploads are blocked when an account is over its ceiling until enough is deleted to get back under it.

Files are deleted automatically as described in the Privacy Policy: intermediate frames and clips 30 days after they are written, and any image file 180 days after it is created. Keep your own copy of anything you want to keep indefinitely.

11. Termination

You may stop using Luxim at any time and may delete your content in the app. We may suspend or terminate access for a breach of these terms, for a legal requirement, or where continuing would put the service or other users at risk. On termination the licence in section 2 ends. Sections 6, 7, 8, 12, 13 and 15 survive.

12. Disclaimer of warranties

To the maximum extent permitted by law, Luxim is provided "as is" and "as available", without warranty of any kind, express or implied, including merchantability, fitness for a particular purpose, non-infringement, accuracy, and uninterrupted or error-free operation. Some jurisdictions do not allow the exclusion of implied warranties, so parts of this section may not apply to you.

13. Limitation of liability

To the maximum extent permitted by law, we are not liable for indirect, incidental, special, consequential or exemplary damages, or for lost profits, lost data, lost content, or the cost of substitute services, arising from your use of Luxim. Our total liability for any claim relating to Luxim is limited to the greater of the amount you paid us through the App Store in the twelve months before the claim, or TODO(owner): a fixed floor figure, or delete this clause. Some jurisdictions do not allow these limits, so parts of this section may not apply to you.

14. Apple

These terms are between you and us, not Apple. Apple is not responsible for Luxim or its content.

• Maintenance and support. We are solely responsible for providing maintenance and support for Luxim. Apple has no obligation to provide any maintenance or support services.
• Warranty. In the event of any failure of Luxim to conform to any applicable warranty, you may notify Apple, and Apple will refund the purchase price of the app to you, if any. To the maximum extent permitted by law, Apple has no other warranty obligation with respect to Luxim, and any other claims, losses, liabilities, damages, costs or expenses attributable to a failure to conform to a warranty are our sole responsibility.
• Product claims. We, not Apple, are responsible for addressing any claims by you or a third party relating to Luxim or your possession and use of it, including product liability claims, any claim that Luxim fails to conform to a legal or regulatory requirement, and claims arising under consumer protection, privacy or similar legislation.
• Intellectual property. In the event of a third-party claim that Luxim or your possession and use of it infringes that third party's intellectual property rights, we, not Apple, are solely responsible for the investigation, defence, settlement and discharge of that claim.
• Legal compliance. You represent and warrant that you are not located in a country subject to a US Government embargo or designated by the US Government as a "terrorist supporting" country, and that you are not listed on any US Government list of prohibited or restricted parties.
• Third-party beneficiary. Apple and Apple's subsidiaries are third-party beneficiaries of these terms, and upon your acceptance of these terms Apple will have the right, and is deemed to have accepted the right, to enforce these terms against you as a third-party beneficiary of them.
• Third-party terms. You must comply with any applicable third-party terms when using Luxim, including the terms of the generation providers named in the Privacy Policy.
• Contact. Support questions go to the address in section 15. Apple has no obligation to furnish support for Luxim.

15. Governing law and contact

Governing law and forum: TODO(owner): name the governing law and the courts, and check that the choice is compatible with mandatory consumer protections where your users are.

Contact: TODO(owner): legal entity name, postal address and support email.

16. Changes to these terms

We may update these terms. Material changes will be posted here with a new effective date, and continued use after that date is acceptance of the updated terms.

Privacy Policy · Support

Troubleshooting

A render stopped and says the monthly limit was reached

Luxim enforces a spending ceiling per calendar month on the server. Once a month hits it, generation halts and does not resume until the next calendar month begins. Nothing further is charged while it is halted, and work already finished is unaffected.

A render is waiting for a decision

Luxim stops and asks rather than spending money on your behalf. There are three reasons it does this:

• The shot failed over to a different provider and costs materially more. You are shown the original estimate, the new one, and the difference, and you choose whether to proceed.
• The provider refused the shot. The provider's own content check rejected the prompt or the reference. You are shown the reason and can edit the shot, try the fallback provider, or skip it. A refused shot never retries on its own, so nothing is spent while it waits.
• The submission was ambiguous. The system could not confirm whether the request reached the provider. It stops instead of resubmitting, because a resubmission could buy a second clip for the same shot. You decide.

A film can owe more than one decision. After you resolve one, the next may appear. Keep going until the film stops asking.

Results look like placeholders, or nothing reaches a provider

A generation step with no connected provider key runs against a built-in stub instead of the real model. Open Settings, then Providers, and check that the provider for that step shows as connected. Connected means the key passed a live test call, not merely that a key was entered.

Adding a key fails, or a step that worked stops working

The key is validated with a cheap test call when you save it. A failure normally means the key is wrong, has been revoked, or the provider account is out of balance or credits. Re-add the key to re-test it. Luxim never displays a stored key back to you, including your own, so if you are unsure whether the right key is stored, replace it.

Everything fails with an authorisation or unauthenticated error

Every server call requires both a valid sign-in and a valid Firebase App Check attestation of the app itself. If App Check cannot attest the app, every call fails rather than some. Try, in order: confirm the device has a network connection; close and reopen the app so it can obtain a fresh token; confirm you are running an official build from the App Store or TestFlight, since a modified or re-signed build will not attest. If it persists, email support with the time it started.

An upload is rejected

A single image must be 15 MB or smaller and a single video 50 MB or smaller. An account can hold 2 GiB of uploads in total, and uploads are blocked once it is over that until enough is deleted. Deleting is always allowed, including while over the limit. After deleting, allow up to an hour for the limit to lift, or sign out and back in to refresh it immediately.

Older frames and clips have disappeared

Intermediate frames and per-shot clips are deleted automatically 30 days after they are written, and any image file is deleted 180 days after it is created. Finished videos and PDF exports are not deleted automatically. Save anything you want to keep for longer.

No notification when a film finishes

Notifications are best-effort. Check that notifications are enabled for Luxim in iOS Settings. The film's page in the app is always the authoritative state, whether or not a notification arrived.

Deleting your content and your account

Individual items. A film, a draft story, a character look, a supporting cast member and a place can each be deleted in the app. Deleting a film removes its stored files, its job record and the story it was made from. Your ratings, your saved places, and your character plates are kept, because they belong to your library rather than to that film. Deleting a film does not change the spend already recorded for it.

Storage only. If you want to free space but keep the film's record and the prompts behind it, delete just the videos for that film.

Your whole account. TODO(owner): no account-deletion path exists in the backend today, and Apple requires an in-app one for apps that support account creation. Either build it before submission, or write here the exact manual process: the address to email, what to put in the message, how identity is confirmed, what gets deleted, what is retained and why, and the number of days within which it is done. Do not describe a control the app does not have.

Reporting generated content

To report content generated with Luxim, email TODO(owner): support email address with "Report" in the subject line, a description of the content, where you encountered it, and any link or file you can share.

Content generated in Luxim is private to the account that made it. Files and records are readable only by that account, enforced at the database and storage layer, and Luxim has no public feed or gallery. The one way a film leaves that boundary is the share button in the player, which produces a direct download link that works for anyone holding it. A report will therefore concern either such a link or something a user exported and published elsewhere; include the link if you have it. Reports are reviewed against the acceptable-use section of the Terms of Use, and accounts found in breach are suspended or terminated.

TODO(owner): state the target time to first response on a report, and name the address for urgent reports involving a minor or a credible threat, which should be handled ahead of ordinary support.

Privacy Policy · Terms of Use