Last Updated: September 24, 2026
1.1. This Privacy Policy (the "Policy") is issued by NUCLEAR MAN ("we," "us," or "our"). It governs the data practices for our mobile application, Snaptou: Camera & AI Photo Editor (the "App"), and all related services (the "Services").
1.2. About Snaptou: Snaptou is a photography and AI-powered photo editing application. It provides a Pro Camera including video recording, short video and boomerang, retouch tools including crop, filters and background removal, a Template Background library, and AI-powered image generation tools (the "AI Features"). Certain AI Features are accessed using Coins, an in-app unit described in our Terms of Use.
1.3. By downloading, installing or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with it, you must not use the Services. For the purposes of applicable data protection law, including the EU General Data Protection Regulation (GDPR) and the UK GDPR, we are the Data Controller of your Personal Data.
Our approach to privacy is founded on the following core principles:
a. Transparency: We are open and clear about how we handle your data, in particular in the context of our AI Features.
b. Purpose Limitation: We collect and process your data only for the specified, explicit and legitimate purposes set out in this Policy.
c. Data Minimisation: We collect only the data that is necessary to provide and improve the Services. Where an account is involved, we store an account identifier and your Coin balance, and no more.
d. Responsible AI: We do not use your personal content to train our AI models.
e. Security by Design: We apply technical and organisational measures to protect the confidentiality, integrity and availability of your Personal Data, including encryption of data in transit between your device and our servers.
f. Local Processing Where Possible: Standard editing operations are performed on your device. Only the AI Features require your media to be transmitted for processing, and only for as long as it takes to return your result.
3.1. User Media and Prompts, processed for the AI Features
3.1.1. What we collect: Photographs, videos and other media you capture through the Pro Camera or select in the App for editing ("User Media"), and the text prompts generated by your choice of Template Background or submitted by you ("User Prompts").
3.1.2. Local editing: Standard editing operations, such as applying a filter, cropping, adjusting brightness or recording a short video, are performed on your device. User Media used only for those operations is not transmitted to our servers.
3.1.3. AI Features: When you use an AI Feature, the relevant User Media and User Prompts are transmitted over an encrypted connection to our servers and to our third-party AI provider, for the sole purpose of generating the result you requested.
3.1.4. Immediate deletion: Once the result has been delivered to you, the source User Media and User Prompts are deleted from our server infrastructure. They are not retained, cached or logged.
3.1.5. No training: Your User Media, your User Prompts and the resulting output are not used to train or improve any AI model.
3.2. Account Data, collected only if you choose to sign in
3.2.1. Signing in with a Google account is optional. It is offered so that a Coin balance you have paid for can be associated with you rather than with a single installation of the App.
3.2.2. What we store: a stable account identifier ("User ID") issued in connection with your Google sign-in.
3.2.3. What we display but do not store: your account name, email address and profile photo are shown to you in the App so that you can confirm which account you are signed in to. We do not transmit them to, or retain them on, our servers.
3.2.4. If you do not sign in, no Account Data is created and your Coin balance is held only on your device.
3.3. Purchase and Coin Data
3.3.1. Payment processing: Coin purchases are processed by Google Play Billing. We do not receive or store your payment card details, bank details or billing address.
3.3.2. What we receive and store: the purchase token, order identifier, product identifier and transaction date for each Coin purchase, together with the resulting Coin balance and the record of Coins granted and consumed, linked to your User ID.
3.3.3. Why: to verify that a purchase is genuine, to credit the correct number of Coins, to restore your balance when you reinstall the App or sign in on another device, to handle refunds and billing disputes, and to detect fraudulent or duplicated transactions.
3.4. Technical and Usage Data, collected automatically
3.4.1. Device and network information: IP address, device manufacturer and model, operating system version, screen dimensions, time zone, network state and system language.
3.4.2. Application and advertising identifiers: your device's advertising identifier, the App version and unique device identifiers.
3.4.3. Usage and interaction data: app launches, features used, time spent on screens, clicks, and your interaction with advertisements.
3.5. Communications Data, provided voluntarily
When you contact us for support or submit feedback, we collect your email address and the content of your message. This includes any content or image submitted through the in-app reporting mechanism for the AI Features, used solely to review and act on your report.
4.1. AI Functionality: The AI Features use generative AI to apply digital effects, create artistic styles and perform other creative transformations based on your input.
4.2. No Training on Your Data: Your User Media and the resulting AI-generated output are not used to train or improve our AI models.
4.3. Third-Party AI Providers: We use Google's APIs, including the Gemini API, for core image and video generation. When you use an AI Feature, your input data is sent to Google's API for processing and is handled in accordance with Google's API Terms of Service and Privacy Policy.
We only process your Personal Data when we have a valid legal basis for doing so under applicable data protection laws like the GDPR.
To Provide Core AI Creative Functionality: User Media, User Prompts - Performance of a Contract. We process this data to deliver the AI-generated result you requested. Processing is ephemeral and essential to deliver the result.
To create and maintain your account: Account Data (User ID) - Performance of a Contract. Signing in is optional. Where you choose to sign in, we need an identifier to associate your Coin balance with you.
To sell, deliver and restore Coins: Account Data, Purchase and Coin Data - Performance of a Contract. We process this data to verify your purchase, credit the correct Coin balance, and restore that balance on reinstall or on a new device.
To handle refunds, billing disputes and accounting obligations: Purchase and Coin Data - Legal Obligation and Legitimate Interest. We retain transaction records to answer refund requests and to meet accounting and tax obligations.
To maintain and improve the Services: Technical and Usage Data - Legitimate Interest. We analyse usage data to resolve technical issues, fix bugs and inform the development of new features.
To enable and personalise advertising: Technical and Usage Data, primarily advertising identifiers - Consent and/or Legitimate Interest. Where required by law, for example in the European Economic Area and the United Kingdom, we rely on your consent for personalised advertising. Elsewhere, contextual advertising relies on our legitimate interest in funding the free Services.
To ensure security and prevent fraud: Technical and Usage Data, Purchase and Coin Data - Legitimate Interest. We process this data to detect duplicated or fraudulent transactions, abuse of the Coin system, and threats to the security of the Services.
To comply with legal obligations: All relevant categories as required - Legal Obligation. We may process Personal Data to comply with a legal requirement, such as a lawful request from a government authority.
We integrate third-party Software Development Kits to provide the full functionality of the Services, including authentication, payment, analytics and advertising. These partners may collect data directly from your device and generally act as independent Data Controllers. We encourage you to review their privacy policies.
Google (AdMob, Firebase, Google Sign-In, Google Play Billing, Gemini API): https://policies.google.com/privacy/
Meta (Facebook Audience Network & Analytics): https://www.facebook.com/about/privacy/
AppLovin: https://www.applovin.com/privacy/
Adjust: https://www.adjust.com/terms/privacy-policy/
AppsFlyer: https://www.appsflyer.com/legal/privacy-policy/
Vungle: https://vungle.com/privacy/
InMobi: https://www.inmobi.com/privacy-policy/
Pangle: https://ad.oceanengine.com/union/media/privacy
Mintegral: https://www.mintegral.com/en/privacy/
Unity: https://unity3d.com/legal/privacy-policy/
IronSource: https://developers.is.com/ironsource-mobile/air/ironsource-mobile-privacy-policy/
The App requests only the permissions necessary to provide its features. You can manage them at any time in your device settings.
android.permission.CAMERA: To access your device's camera. This is essential for taking photos and recording videos directly within the app to support core features.
android.permission.RECORD_AUDIO: To access your device's microphone. This is essential for recording audio, enabling voice input, and supporting features like voice search or audio messaging within the app.
com.ai.photo.editor.collage.retouch.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION: To protect internal app communications. This ensures that background processes run privately within the app and cannot be accessed or intercepted by other apps on your device.
android.permission.WAKE_LOCK: To keep your screen on while the camera is active. This prevents your device from locking or dimming during use, ensuring a smooth and uninterrupted shooting experience.
android.permission.ACCESS_NETWORK_STATE: To check your device's network connection. This allows the app to detect whether you are on Wi-Fi or mobile data, ensuring a smooth and seamless experience at all times.
android.permission.INTERNET: To connect your device to the internet. This allows the app to load content, display ads, and communicate with our servers, ensuring a fast and seamless experience at all times.
android.permission.POST_NOTIFICATIONS: We may send you notifications to share helpful tips, feature updates, and reminders. You can disable notifications at any time in your device settings.
com.android.vending.BILLING: This permission enables in-app purchases, allowing you to buy premium features or items within the app.
android.permission.ACCESS_WIFI_STATE: We check your Wi-Fi connection status to optimize ad loading performance and reduce data usage.
com.android.vending.CHECK_LICENSE: This verifies that the app was legitimately installed from Google Play, helping protect against unauthorized copies.
android.permission.ACCESS_ADSERVICES_CUSTOM_AUDIENCE: Used to access the Privacy Sandbox Topics API, which enables interest-based advertising without tracking individual user activity.
android.permission.FOREGROUND_SERVICE: Required for the app to perform essential background tasks and maintain core functionality.
android.permission.ACCESS_ADSERVICES_TOPICS: Used to support interest-based advertising through Android's Privacy Sandbox framework.
android.permission.VIBRATE: Provides haptic feedback during key interactions such as capturing a photo, enhancing your user experience.
com.google.android.c2dm.permission.RECEIVE: A standard Android permission that allows the app to receive push messages from Google's cloud messaging service.
com.google.android.gms.permission.AD_ID: Used to retrieve your advertising identifier for serving relevant ads. You can reset or opt out of ad personalization in your device settings.
android.permission.ACCESS_ADSERVICES_ATTRIBUTION: Allows the app to measure ad performance through Android's Privacy Sandbox, helping us understand which ads led to app installs.
android.permission.ACCESS_ADSERVICES_AD_ID: Used to access your advertising ID through Android's Privacy Sandbox for ad measurement purposes.
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE: A standard permission that helps us understand how you discovered and installed the app from Google Play.
android.permission.USE_FULL_SCREEN_INTENT: Used to display important notifications in full-screen format, reminding you not to miss key features of the app.
android.permission.RECEIVE_BOOT_COMPLETED: To restore your scheduled reminders and background tasks after your device restarts, so notifications continue working without you needing to reopen the app.
com.huawei.appmarket.service.commondata.permission.GET_COMMON_DATA: Allows our install-attribution partner (AppsFlyer, via Huawei's install referrer service) to identify which marketing campaign led to the app installation on Huawei devices, for advertising measurement and attribution purposes only. No personal user data is collected through this permission.
com.samsung.android.mapsagent.permission.READ_APP_INFO: Allows our install-attribution partner (AppsFlyer) to identify which marketing campaign led to the app installation on Samsung devices, for advertising measurement and attribution purposes only. No personal user data is collected through this permission.
8.1. User Media and User Prompts: deleted from our server infrastructure immediately after the AI result has been delivered to you. They are not retained.
8.2. Account Data: retained for as long as your Account exists. Deleted when you delete your Account, in accordance with Section 11.
8.3. Coin balance: retained for as long as your Account exists. Deleted when you delete your Account.
8.4. Purchase records: retained for as long as necessary to handle refunds and billing disputes and to meet accounting and tax obligations, and thereafter deleted or anonymised. A purchase record retained for this purpose after you delete your Account no longer identifies you by Account.
8.5. Technical and Usage Data: retained in accordance with the retention practices of the relevant analytics or advertising partner listed in Section 6.
8.6. Communications Data: retained for as long as necessary to resolve your enquiry and for a reasonable period thereafter for our records.
We operate globally, and your Personal Data may be transferred to, stored in and processed in jurisdictions outside your country of residence, where we or our third-party partners operate. We ensure that such transfers comply with applicable data protection law by using legally recognised transfer mechanisms, including Standard Contractual Clauses.
10.1. Opt out of personalised advertising: you can limit ad tracking by resetting or deleting your device's advertising identifier in your device settings. This limits, but does not eliminate, the advertisements you see.
10.2. Your rights: depending on your country of residence, you may have the right to access, rectify, erase, restrict or object to the processing of your Personal Data, to withdraw consent, and to data portability. Because we do not retain your User Media, an erasure request applies primarily to your Account Data, Coin balance, Purchase records, Technical Data and Communications Data.
10.3. How to exercise them: submit a request to the address in Section 16, or use the deletion process in Section 11. We respond within one month of receiving your request, and may extend that period by two further months for a complex request, in which case we will tell you.
10.4. Verification: we may ask you to sign in to the Account concerned so that we can confirm the request comes from you.
10.5. Complaints: you may lodge a complaint with the data protection authority of your country of residence.
11.1. In the App: open Profile, then Delete Account. The App shows your remaining Coin balance and warns you that it will be lost, then asks you to confirm.
11.2. On the web: you may also request deletion of your Account and associated data at Section 16.
11.3. What is deleted: your User ID, your Coin balance including any purchased Coins you have not used, and the other Account Data associated with you, both in the App and in our database.
11.4. What may be retained: a record of your past transactions, to the extent required for refunds, billing disputes, fraud prevention, accounting or tax obligations, as described in Section 8.4.
11.5. Effect on Coins: deletion permanently forfeits any unused Coins, including purchased Coins. If you would prefer to request a refund for unused purchased Coins, contact us at the address in Section 16 before deleting your Account.
11.6. Timing: deletion requests are actioned within 30 days of verification.
12.1. European Economic Area, United Kingdom and Switzerland: you have the rights set out in Section 10, as well as the right to data portability and the right to lodge a complaint with a supervisory authority. The legal bases we rely on are set out in Section 5.
12.2. California: you have the right to know what personal information is collected, to delete it, and to opt out of the "sharing" of your personal information for cross-context behavioural advertising. Our use of third-party advertising SDKs may constitute "sharing." You can exercise the opt out by managing your device's advertising identifier as described in Section 10.1. We do not "sell" your data for monetary consideration.
12.3. Other United States states: where the privacy law of your state grants equivalent rights of access, correction, deletion or opt out, we honour those rights through the mechanisms described in Sections 10 and 11.
13.1. Not directed at children: the App is intended for a general audience and is not directed to children under the age of 13, or under 16 in jurisdictions such as the European Economic Area and the United Kingdom.
13.2. No collection from minors: we comply with the Children's Online Privacy Protection Act and equivalent regulations, and we do not knowingly solicit, collect or maintain personal information from anyone under those ages.
13.3. Purchases: Coin purchases are processed through the marketplace account of the device owner. If you are under the age of majority in your jurisdiction, you may make a purchase only with the permission of a parent or legal guardian.
13.4. Enforcement and deletion: if we become aware that a child has provided us with Personal Data, we will delete it. If you are a parent or guardian and believe your child has provided us with Personal Data, contact us immediately.
We apply technical and organisational measures appropriate to the risk, including encryption of data in transit between your device and our servers, access controls on our backend systems, and server-side verification of every purchase before Coins are credited. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
We may update this Policy from time to time. If we make a material change, we will give notice through the App or by other means before it takes effect, so that you can review it. Your continued use of the Services after a revision becomes effective constitutes acceptance of the updated Policy.
- Developer: NUCLEAR MAN
- Support and privacy requests: nuclear.backup.260126@outlook.com
For questions specific to our AI-powered features, see our AI Content and Acceptable Use Policy at https://sites.google.com/view/ai-content-and-acceptable-use/home