Privacy

1.Controller

Leon Glas “Hookies”
Mardorfer Straße 31
31535 Neustadt am Rübenberge, Germany

Email: [email protected] · in the app: Profile & settings → Support

2.Data we process

• App ID: a random device ID created on first launch and stored in your iPhone's keychain. Without an account it is your key to your data.
• Account (optional): with Sign in with Apple, your Apple user identifier, your email address (or Apple's relay address) and your name if you share it.
• Your content: videos, photos, voice recordings and text you add, and the videos, captions and transcripts created from them.
• Chats: your messages to Hooki, the replies and the history of your editing requests; messages to our support.
• Purchases: subscription tier, term and transaction identifiers sent by Apple. We never receive payment details; Apple handles payment.
• Usage and device data: app version, language, last use, days of use, onboarding and consent status (with version and time), technical events and errors, country (derived from the IP address), your device's push token and notification setting.
• Abuse prevention: Apple's DeviceCheck bits for your device, so free videos can't be multiplied by reinstalling.
• Server logs: for every connection our servers technically process IP address, time and requested address, for security and troubleshooting.

How we collect it: directly from you when you add content, write or speak messages, sign in or contact support; automatically through the app (app ID, version, language, usage, technical events and the push token once you allow notifications); from Apple (purchases, sign-in, DeviceCheck); and by creating transcripts, image descriptions and edit plans from your content.

The app has no ads, no tracking and no third-party analytics.

3.Purposes and legal bases

• Providing the app: creating and editing videos, storing chats and videos, unlocking subscriptions, support: performance of contract (Art. 6(1)(b) GDPR).
• Processing by AI services (section 4): your consent in the app (Art. 6(1)(a) GDPR). Nothing is sent to these services before you agree.
• Improving Hookies: we analyse chats and editing decisions (what was asked, what Hookies did, how it turned out) so Hookies learns your preferences and edits better, also as a basis for a model of our own. Based on your consent in the app; it does not happen without your permission, on test devices or for deleted data.
• Abuse prevention, security and statistics (DeviceCheck, counters, error and server logs, days of use): legitimate interest in a safe and fair service (Art. 6(1)(f) GDPR). You may object.

4.AI services and other recipients

We use service providers who process your data on our behalf and under our instructions:

• Hosting and storage: servers and editing machines in data centres in Germany and Finland, encrypted storage of your files in the Netherlands (EU).
• Network and security service (USA): routes connections to the app and protects against attacks; processes IP addresses.
• Anthropic, PBC (USA): an AI language model understands your messages and transcripts, plans your edit and searches the web when you ask for it. For this it receives your messages to Hooki, transcripts of your videos and voice recordings, individual still images and image descriptions from your material, and your first name if you entered it (Hooki uses it to address you).
• fal.ai (Features & Labels, Inc.) (USA): runs the AI models of the providers listed below for us. For this it receives your videos, photos and audio recordings or excerpts of them, plus the text a feature needs. Only the content needed for the feature you are using is passed on. Your own voice is only recreated if you explicitly want that.
  • ElevenLabs, Inc. (USA): transcription of your speech, AI voices, music, sound effects, voice isolation and dubbing. Receives audio recordings and text.
  • Google LLC (USA): image analysis, photo editing and video from photos. Receives photos, still images and text.
  • OpenAI, L.L.C. (USA): photo editing. Receives photos and text.
  • Black Forest Labs GmbH (Germany): creating and editing images. Receives photos and text.
  • Kuaishou Technology (Kling) (China): video from photos and video effects. Receives photos, video excerpts and text.
  • ByteDance Ltd. (China): camera moves and images. Receives photos and text.
  • MiniMax (China): video from photos and music. Receives photos and text.
  • PixVerse (China): sound effects for videos. Receives video excerpts.
  • Topaz Labs, LLC (USA): sharper, larger videos. Receives videos.
  • Bria AI Ltd. (Israel): removing objects from photos. Receives photos.
• Apple: Sign in with Apple, App Store purchases, push notifications and DeviceCheck.
• Platforms whose links you share (e.g. TikTok): when you send Hookies a link, the video is fetched from there; the platform sees that request.

Nothing is sent to Anthropic, fal.ai or the providers listed above until you explicitly allow it in the app. The app asks you in a separate step (“Allow” or “Don’t Allow”) and, as long as you haven’t allowed it, again before every AI feature. Without permission the app stays usable: browsing, outfits, subscription, profile, support and “Just cut” (your draft and your finished edit are then stored on our servers without AI). You can withdraw the permission at any time under Profile & settings → Privacy → AI data sharing. The app then stops sending content to these services, and our servers no longer pass your content to them either (an edit that has already started still finishes).

All recipients listed here process your data only on our behalf and for the purposes described, and are contractually bound to protect it at least as well as described in this policy (the same or an equivalent level of protection).

All AI services that receive your content are named above. On request we also tell you which of them processed your data (Art. 15 GDPR).

5.Transfers outside the EU

Some recipients process data outside the EU, in particular in the USA and China. Transfers rely on the EU-US Data Privacy Framework (where the recipient is certified) or the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, for AI processing, additionally on your explicit consent (Art. 49(1)(a) GDPR). The level of data protection in third countries may be lower than in the EU, for example because of government access rights.

6.Notifications

We send updates about your own videos (e.g. “Your video is ready”) and support replies once you allow notifications in iOS. Tips and reminders (i.e. marketing) only if you turn on “Tips & reminders” in the app (Art. 6(1)(a) GDPR). The switch is off by default and you can turn it off again at any time.

7.Retention

We keep your content, chats and videos while you use the app, until you delete them. When you delete everything in the app (section 8), we remove your files from storage and every record of your device or account. Only two check values without plain text remain:

• a hash of your device ID with the current month's counters, so deleting doesn't unlock new free videos; it expires with the month,
• a hash of your Apple identifier, which prevents a second sign-in bonus.

We keep server logs only as long as needed for security and troubleshooting. Data processed by our service providers is removed according to their deletion periods.

8.Deleting your data

In the app under Profile & settings → “Delete Account” (with an account) or “Delete my data” (without an account) you remove all your data immediately and permanently. If you signed in with Apple, we also revoke the link to your Apple ID.

An active subscription is billed by Apple and keeps running after deletion until you cancel it: iPhone Settings → your name → Subscriptions → Hookies.

9.Waitlist on hookies.app

On our website hookies.app you can join the waitlist for Hookies for ads with your email address. For this we store your email address, the language of the page and the time you signed up on our servers. Right after that we send you an email with a link to confirm your address. We store the time of confirmation as proof of your consent. Without confirmation we will not write to you again. Every email contains a link to unsubscribe.

We only use the address to let you know when Hookies for ads launches. That email also tells you how to redeem the three free ads you get for signing up. We send this email through an email delivery provider. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by signing up.

You can withdraw your consent at any time; a short email to [email protected] is enough. We then remove your address from the waitlist. We delete the entire waitlist no later than twelve months after the launch.

10.Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can withdraw consent at any time with effect for the future, in the app or by writing to us.

You may also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us in Lower Saxony (LfD Niedersachsen).

11.Age and changes

Hookies is intended for people aged 16 and over. If the way we process data changes, we update this notice; the date above shows the current version.