Privacy Policy

This policy explains what data the XCStudio apps (VideoLUT, iColorama, KinoGlitch, MatchColours and our other iOS apps) and this website collect, why, and what you can do about it. We keep it short and plain.

Last updated: 11 October 2026

In short

  • Your photos and videos are processed on your device. We do not upload them.
  • We collect anonymous usage statistics (Firebase Analytics) and crash reports (Firebase Crashlytics) to improve the apps.
  • Purchases are handled by Apple. Some apps also use RevenueCat to check your subscription status.
  • We do not show ads, we do not sell data, and we do not ask to track you across other companies' apps and websites.

Who is responsible (data controller)

XCStudio
Email: [CONTACT EMAIL]
You can also reach us through our contact form.

What we collect and why

Usage analytics (Firebase Analytics)

The apps send anonymous usage events to Google Firebase Analytics, for example which screens and features are used, app version, device model, operating system version and language. Google derives an approximate country or region from your IP address. Events are linked to a random app-instance identifier, not to your name or email. We use this to understand which features matter and to fix problems. Legal basis: our legitimate interest in improving the apps (GDPR Art. 6(1)(f)).

Crash reports (Firebase Crashlytics)

If an app crashes, Firebase Crashlytics sends a crash report: the technical stack trace, device model, operating system version, app version and a random installation identifier. Crash reports do not contain your photos or videos. Legal basis: legitimate interest in keeping the apps stable (Art. 6(1)(f)).

Purchases and subscriptions (Apple, RevenueCat)

All payments are processed by Apple through the App Store. We never see your payment details. In apps that use RevenueCat (currently VideoLUT), the app sends your App Store purchase receipt and a random, anonymous user identifier to RevenueCat so that it can confirm which subscriptions or purchases are active. Other apps check purchases directly with Apple on your device. Legal basis: performance of the contract you entered by buying (Art. 6(1)(b)).

Photos and videos

The apps open photos and videos only after you give access, and they edit them on your device. They are not uploaded to us or to any third party.

Sharing LUTs by QR code (VideoLUT)

If you choose to share a LUT or a camera profile by QR code, the app uploads that LUT or profile file (a small colour table, which can include a small preview thumbnail) to Google Firebase Storage under a random identifier. Anyone who scans the QR code can download it. Nothing is uploaded unless you use this share feature. Legal basis: your request (Art. 6(1)(b)).

Location (VideoLUT camera only)

The VideoLUT camera has optional "save location" settings for photos and videos. They are off by default. If you turn one on, iOS asks for permission to use your location while the app is in use, and the app writes the GPS position into the metadata of the photos or videos you capture, as the built-in Camera app does. The location stays in your files on your device. We do not send it to us or to analytics, and we do not track your location. Other apps can show existing location metadata of your own photos, but they do not access your current location.

No advertising tracking

The apps contain no advertising. They never ask for App Tracking Transparency permission, so iOS does not give the apps or Google your advertising identifier (IDFA). We do not sell or share your data for advertising.

This website

If you use our contact form, your name, email address and message are sent through Formspree and delivered to us by email. We use them only to reply to you.

Third parties we use

These providers can process data in the United States. They use safeguards approved by the European Commission (such as Standard Contractual Clauses or the EU-US Data Privacy Framework) for these transfers.

How long we keep data

  • Analytics data: kept by Firebase for the retention period set in our Firebase project, then deleted.
  • Crash reports: kept by Crashlytics for 90 days.
  • Purchase records: kept as long as needed to provide your purchases and as required by law.
  • Shared LUT files: kept so that the QR code keeps working. Ask us to delete a file at any time.
  • Contact messages: kept as long as needed to answer you.

Your rights

You have the right to access, correct or delete your data, to restrict or object to its processing, and to data portability. Because analytics and crash data are not linked to your name, tell us the app and, if possible, the approximate date, so we can find it. Contact us at [CONTACT EMAIL] or through the contact form. We answer within one month. You can also complain to your local data protection authority.

You can stop all data collection by deleting the app. You can turn off location access at any time in iOS Settings.

Children

Our apps are not directed at children under 13 (under 16 in the EU), and we do not knowingly collect personal data from them. If you think a child has sent us personal data, contact us and we will delete it.

Changes to this policy

If we change this policy, we update this page and the "Last updated" date above. If a change is significant, we also say so in the app's release notes.