Danceify Security Practices

1. Account and media access

Danceify uses a Firebase account identifier to associate a user with their jobs, creations and purchases. Standard use does not require a name or password. An anonymous sign-in is still a persistent account; it does not make the associated data unidentifiable.

The backend checks ownership, account restrictions and output approval before issuing a media link. Photos and videos are stored privately, and direct client uploads or reads through Storage are blocked. The backend requires public-access prevention to be enforced before it uploads media or signs a read link.

Playback and download links expire after five minutes. A source-photo link supplied to Kie.ai is valid for up to 30 minutes. Anyone possessing a signed link can use it while it remains valid. Downloading and native sharing produce a separate file copy outside these access controls.

Public access to media uploaded through earlier versions has been disabled. Previously downloaded, shared or cached copies cannot be recalled. Contact us if you need an earlier upload removed.

2. Processing safeguards

• App and provider requests use encrypted network connections. This is not end-to-end encryption: Danceify and the processing providers need access to the media to perform their services.
• Kie.ai generation credentials are held on the backend, rather than included in the mobile app.
• The backend validates submission type, size and settings and applies account-based request limits.
• A provider callback is treated as a signal to check a registered task. Its claimed result, status or video address is not accepted as proof of completion.
• Output files are held in private review storage. A result is added to the user's library only after the required safety review succeeds.

Storage settings, provider availability and access permissions are part of these protections. If a required safety check or private-storage check cannot complete, the pipeline does not release an unreviewed result. Automated checks and access controls reduce risk but cannot detect every threat.

3. Content safety and image rights

Only submit photos you have permission to animate, including appropriate guardian permission for images of minors. Nudity, sexual content, child exploitation, nonconsensual intimate content, harassment and harmful impersonation are prohibited, including when a user has paid for the service.

Danceify requires explicit permission before submission and uses Google Cloud Vertex AI to review the input photo and prompt, then the generated video and its audio where present. Automated checks can miss harmful content or reject harmless content. They cannot prove that a person gave permission. A user's confirmation does not remove our responsibility to investigate reports and address misuse.

Report an inappropriate result hides a reported creation pending review. Authorized reviewers can remove content or restrict an account. An account restriction applies to that account; it is not a guarantee that the same person cannot attempt to return through another identity.

4. Deletion and withdrawal of permission

Deleting a creation removes its library entry and deletes the associated source photo and stored video. Account deletion removes the account's active Firebase media and generation history. Separate deletion markers prevent delayed processing from restoring deleted creations. Failed file operations can require cleanup retries.

Limited account-restriction, safety-report and purchase records may remain for security, report handling or transaction verification. Deletion does not cancel an App Store subscription, erase files already downloaded or shared, or automatically delete copies held by an AI provider. Contact us if you need help removing an older upload.

Withdrawing AI permission blocks new processing and release of in-flight results under that permission. It does not reverse work already performed. Approved creations you own remain accessible until you delete them or your account.

5. Purchase verification and permissions

Apple processes App Store payments and RevenueCat provides purchase information for backend verification. The app cannot award credits by editing a displayed balance. The backend checks eligible products and transaction identifiers and records each credit grant once, including when verification requests are repeated. A generation reserves its allowance or credit on the backend; failure restoration is recorded to prevent the same use from being restored more than once. A network or provider delay can delay a balance update.

Account deletion removes the balance and removes the account identifier from the credit-grant ledger. Limited transaction records remain to prevent a previously credited purchase from being credited again to a replacement account. These records are not a substitute for resolving a billing dispute or exercising a legal refund right.

Payment does not authorize media processing. Camera, selected-photo access, saving to Photos, notifications and AI processing serve separate purposes described in the Privacy Policy. The backend checks current AI permission and account restrictions before accepting a generation, including requests funded by purchased credits. Turning off reminders leaves video-ready alerts available; disabling notifications does not bypass or interrupt generation checks.

6. Report a vulnerability or harmful use

Email dydemiryasir@gmail.com with a description of the issue. For a security report, include the affected feature, app version and steps needed to reproduce the problem. For image-rights concerns, include a creation identifier or link if available. You do not need a Danceify account to report misuse of your image.

Do not send passwords, API keys, illegal imagery or unnecessary identity documents. Do not access another person's data, disrupt the service or publish private information to demonstrate a vulnerability. We review security and safety reports and may ask for the information needed to investigate and address the issue.