Lastra 3D Magic Privacy Notice

Effective October 27, 2026

Lastra 3D Magic is provided by Miguel Lastra. For privacy questions or requests, contact lastra.sant.ma@icloud.com.

Photos, audio and your choices

You choose which photos to open, capture, edit or save. Camera and Photos access are used for the features you select and depend on your device permissions. Local editing works on your device. Cloud AI tools upload the selected photo, editing instructions and any optional style reference to our Render-hosted service. Talking Photo also uploads the audio recording you select. Photos and audio may contain faces, voices and other personal information. Only submit content you are authorized to use.

Cloud processing and service providers

Our service sends selected media to OpenAI for cloud photo editing and to Replicate for Cloud Figure, other applicable image effects, animation and Talking Photo. The provider depends on the tool. These services process the inputs to generate the requested result. Render hosts the service and its PostgreSQL database. Apple provides Sign in with Apple and processes iOS in-app purchases. Google provides basic Google sign-in for the Android testing version; Google Play purchases are not yet enabled in that version. These providers' processing locations, security practices and retention policies may differ from your location and are governed by their applicable terms and policies.

We use facial appearance in the selected image to perform the requested visual effect. We do not create a separate facial-recognition identity database. AI results may change a person's appearance and should be reviewed before sharing. We do not promise immediate deletion or zero retention at external providers.

Apple sign-in and credit accounts

Sign in with Apple is required for purchased cloud credits and recovery of your balance across devices. Our server verifies Apple's sign-in credentials, keeps a hashed Apple subject identifier linked to an app account identifier, and stores session-token hashes and encrypted Apple refresh credentials. The app stores its session securely in the device Keychain. We do not receive your Apple Account password or full payment-card details.

We store purchase transaction identifiers, product identifiers, verification timestamps, refund status, credit balances, generation reservations and charges to deliver purchases, prevent duplicate charges and reconcile transactions. Test and live purchase environments use separate credit balances.

Android testing accounts

The Android testing version uses Google sign-in. Our server verifies the Google identity token and stores a hashed Google subject identifier linked to an app account, plus session-token hashes. The app stores its session and Google account email using encrypted device storage. We do not receive your Google password and do not request access to Gmail, contacts or Drive. Google and Apple accounts are separate unless an authenticated account-linking feature is explicitly provided; matching email addresses do not merge accounts or balances.

In Android Account & Settings, Delete account removes the server sign-in association and sessions. No Google refresh token is retained by our server. Pseudonymous accounting and generation recovery records may remain as described below. Contact support for requests about remaining records or locally saved media.

Saved work and retention

My Creations stores completed photos and videos locally in the app. Copies exported to Photos are separate. Preferences, editing state and usage history may be stored locally; private owner access credentials may be stored in the Keychain.

Our server stores pending generation records, provider job identifiers and completed outputs so interrupted requests can be recovered. A completed output is released from the app's recovery database when the app confirms it has saved that output locally. Unrecovered outputs and pending records may remain while recovery or reconciliation is necessary. Infrastructure logs, backups and external provider copies can have separate retention periods. Purchase and credit accounting records may remain in pseudonymous form for financial reconciliation, fraud prevention and dispute handling. Contact us for requests about retained data.

Account deletion and controls

In Credits & Plans, use the Account menu to sign out or request account deletion. Account deletion revokes the stored Apple authorization and removes the server's sign-in association, sessions and stored refresh credentials. It does not cancel an Apple subscription; use Manage Subscriptions to cancel renewal separately. Accounting records may be retained as described above. Contact support for questions about remaining generation records or media.

Removing the app removes its local gallery and other app files; Keychain entries and separately exported Photos may remain. Delete exported photos or videos through Photos. You can change Camera, Microphone and Photos permissions in device Settings. Decline cloud tools and use local tools if you do not want to upload media.

Support and operational data

If you contact support, we receive the email address and information you choose to send. Service logs may include network addresses, request paths, timestamps, response codes and error information used for security and troubleshooting. Do not send passwords, private access codes, API keys, payment-card information or sensitive media when reporting an issue.

Advertising and tracking

We do not use the app for cross-app advertising tracking or sell personal information to advertisers.

Questions and updates

Contact lastra.sant.ma@icloud.com for privacy, access or deletion requests. We may ask for information needed to verify that a request concerns your account. We will update this notice when the app's data practices change.

Provider privacy information: Google — https://policies.google.com/privacy ; Apple — https://www.apple.com/legal/privacy/ ; OpenAI — https://openai.com/policies/privacy-policy/ ; Replicate — https://replicate.com/privacy ; Render — https://render.com/privacy