Legal

Privacy Policy

Effective and last updated: September 5, 2026

This policy explains how MovoPop, operated by Xiaoyue Labs as an independent developer (“MovoPop”, “we”, “us”), handles information when you use our mobile applications, website, and related services.

Information we process

• Content you provide: portraits you select, generation choices and prompts, feedback, wishes, reports, and support messages.
• Generated content: video jobs, outputs, creation status, and technical metadata needed to deliver and troubleshoot the service.
• Account and device data: an app installation identifier and, when sign-in is offered, the identifier returned by Apple or Google. We do not receive your Apple or Google password.
• Transactions and entitlements: product ID, transaction ID, subscription state, Credits granted or spent, and refund or revocation state. Apple and Google process your payment details; we do not receive full card numbers.
• Usage and diagnostics: app interactions, likes, device platform, approximate region, language, IP-derived security signals, crash data, and abuse-prevention events.
• Advertising data: consent choices, advertising identifiers where permitted, reward verification data, and ad interactions handled through Google AdMob.

Why we use it

We use information to generate and deliver videos, maintain Credits and subscriptions, personalize the feed, prevent fraud and repeated trial abuse, moderate unsafe content, provide support, improve reliability, comply with law, and show or measure ads when permitted.

Reliability diagnostics may include a random request identifier, app version and build, device platform and language, operation duration, and standardized upload or playback error codes. We use these fields to correlate a problem reported in the app with server logs. Diagnostic events do not include your portrait or video bytes, full prompts, signed media links, payment receipts, device-session tokens, or raw application exception text.

AI processing and likeness

When you ask us to create a video, the selected portrait and instructions are sent to our AI processing provider solely to perform that request. Only upload content you own or have permission to use. Do not create deceptive impersonations or non-consensual intimate content.

Service providers and sharing

We may use AWS for hosting, short-lived private input storage, and private generated-video storage and delivery; we may also use Cloudflare R2 for private generated-video storage and delivery. We use approved AI model providers for video generation, Google AdMob for advertising and reward verification, Apple and Google for sign-in and purchases, and licensed media providers for template discovery. We share only the information needed for those services, do not sell personal information, and require service providers to protect personal information consistently with this policy and applicable platform requirements.

Retention and deletion

Input portraits are deleted from our active storage after the generation reaches a completed or failed state. A storage lifecycle rule removes any leftover input within 24 hours as a safety fallback. Generated videos are retained from completion for up to 30 days for free generations and 90 days for Credit-funded generations. Videos created while Pro is active remain available while the subscription stays active and then for a 30-day download grace period after it ends. Each creation shows its current storage status; a short-lived playback link does not change that period. You can permanently delete an individual creation sooner from My Creations, or delete all associated active cloud files by deleting your account.

Safety reports are normally retained for up to 180 days. If you delete your account, the reporter link and free-text details are removed; an anonymized safety record may remain until expiry. Limited transaction, fraud-prevention, dispute, tax, security, and legally required records may be retained for the applicable obligation. Encrypted backups age out under their normal rotation.

You can delete your account and associated cloud data from Profile → Account & data. See the account deletion page for details.

International processing

Our launch infrastructure is located in Singapore. Providers may process information in other countries. We use appropriate contractual and security measures for international processing where required.

Your choices and rights

Depending on where you live, you may request access, correction, deletion, portability, restriction, or objection. You can withdraw optional ad consent through Profile → Privacy & ad choices and delete your account through Profile → Account & data. You may also contact us to exercise a right or appeal a decision.

Children

MovoPop is not directed to children under 13, or the higher minimum age required in their country. We do not knowingly collect personal information from children below the applicable age.

Security

We use encrypted transport, private storage, limited administrative access, short-lived upload links, access controls, and monitoring. No system is completely secure, so please avoid uploading highly sensitive images.

Contact

Privacy and data requests: support@xiaoyuelabs.com. Website: xiaoyuelabs.com.