NovaGlow AI — Privacy Policy

Last updated: 1 June 2026

NovaGlow AI ("we", "us", "the App") is operated by HK Nova XR Production. This policy explains what data we collect, how we use it, and your rights.

1. Data we collect

Category	Data	Purpose	Storage
Account	Email, display name, Firebase user ID, sign-in provider (Google / Apple / Phone / Email)	Authenticate you, sync subscription, prevent abuse	Firebase Authentication
Subscription & credits	Premium status, credit balance, purchase tokens	Gate Pro features, refill daily credits, verify in-app purchases	Cloud Firestore
User photos	Images you choose to upload to AI tools (style transform, object remove, upscale, background swap, seamless blend)	Generate the AI-edited result. Each upload is sent to our serverless AI provider (RunPod), processed, and returned. We do not retain copies after the response is delivered to you.	Transient: RunPod processing memory + Firebase Cloud Functions cache (≤ 30 days). Not stored permanently.
Job metadata	AI job IDs, status, type, credit cost, timestamps	Power the "AI Jobs" screen and refund failed work	Cloud Firestore (runpodJobs collection)
Crash data	Stack traces, device model, OS version, app version	Diagnose and fix bugs	Firebase Crashlytics
Advertising ID	Google Advertising ID (free users only)	Personalised ads via Google AdMob	Held by Google per their policy

We do not collect contacts, location, microphone, calendar, SMS, browsing history, or health data.

2. How we share data

• Firebase / Google Cloud (Google LLC): authentication, database, hosting, crash reports, ads.
• RunPod (RunPod Inc.): serverless GPU compute for AI image processing. Your uploaded image is sent to RunPod over HTTPS, processed, and discarded.
• Google Play (in-app purchases): receipt verification.
• We never sell your data to third parties.

3. Children

NovaGlow AI is not directed to children under 13. We do not knowingly collect data from children under 13.

4. Your rights

• Access / export: email us — we'll send your stored data within 30 days.
• Delete account: in-app: Account → Sign Out → email us to delete the Firebase record and any cached job data.
• Withdraw consent for ads: subscribe to Pro to remove ads, or adjust Google ad personalisation in your device settings.

5. Security

• All network requests use HTTPS / TLS.
• Firebase App Check verifies every API call comes from a genuine app install.
• API keys for RunPod are stored in Firebase Secret Manager — never shipped in the client.
• Production builds are signed with Play App Signing.

6. Changes

We will update this page when our practices change. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced inside the app.

7. Contact

• Email: contactus@hknovaxrproduction.com
• Operator: HK Nova XR Production, Hong Kong