Privacy Policy

This Privacy Policy explains how Cendrawasih Technologies LLC (“Cendrawasih,” “we,” “us,” or “our”), a Delaware limited liability company, collects, uses, discloses, and protects personal information when you use Sloppeh. Cendrawasih is the operator of Sloppeh and the controller of personal information described here. Mobile store listings may identify Ibrahim Yusuf as the individual developer or publisher acting for the Service.

1. Information we collect

Information you provide

• Account and profile: email address, authentication provider, user ID, display name, username, biography, avatar, language and cultural preferences, and policy acceptance records.
• Content: prompts, stories, captions, universes, characters, reference files, uploads, generated images and videos, comments, and collaboration activity.
• Social and safety activity: follows, likes, blocks, reports, report details, moderation appeals, and support messages.
• Purchases: product, subscription, entitlement, credit balance, transaction status, and purchase-provider identifiers. We do not receive your full payment-card number from an app store or payment processor.

Information collected automatically

• Device and network data: IP address, device and operating-system information, app version, language, time zone, identifiers, push token, and security or App Check signals.
• Usage data: screens and content types viewed, feature interactions, generation events, follows, reactions, publishing activity, session information, and approximate timestamps.
• Diagnostics: crashes, errors, stack traces, performance information, and technical logs. Analytics and crash reports may be linked to your Sloppeh user ID.

We collect information directly from you, automatically from your device and use of Sloppeh, and from authentication, app-store, purchase, and service providers.

2. How we use information

We use personal information to:

• create and secure accounts, authenticate users, and synchronize content;
• provide AI generation, uploads, publishing, feeds, collaboration, and social features;
• operate subscriptions, entitlements, generation limits, and credits;
• send requested service and push notifications;
• personalize language, recommendations, and the product experience;
• measure feature performance and improve reliability and usability;
• detect fraud, enforce our policies, review reports, and protect users and the Service;
• respond to support, privacy, legal, and safety requests; and
• comply with law and establish, exercise, or defend legal claims.

3. AI processing and model training

When you request generation or when content requires safety review, relevant prompts, instructions, reference media, and output may be sent to Google’s Gemini services or OpenAI. We limit this processing to providing the requested feature, safety review, troubleshooting, and abuse prevention.

We do not use your prompts, uploads, private content, or generated creations to train general-purpose AI models. We contract and configure our AI providers not to use content processed for Sloppeh to train their general-purpose models.

4. Analytics boundaries

We use event names and controlled properties to understand product activity. We do not intentionally put prompt text, captions, email addresses, comment text, or uploaded image data into analytics event properties. Operational systems and crash reports may still process content or identifiers when necessary to perform a request, diagnose a failure, or investigate abuse.

5. When we disclose information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or use it to serve targeted advertisements.

We disclose information as needed to the following recipients:

• Google and Firebase: cloud hosting, databases, storage, authentication, App Check, analytics, crash reporting, notifications, and Gemini AI services.
• OpenAI: AI image generation when that provider is selected for a request.
• RevenueCat, Apple, Google Play, and Stripe: subscriptions, purchases, entitlements, payment processing, and financial reconciliation, depending on where you purchase.
• Professional advisers and vendors: providers supporting security, operations, legal compliance, and customer support under appropriate confidentiality and data-protection obligations.
• Authorities and affected parties: when reasonably necessary to comply with law, respond to valid legal process, protect rights or safety, investigate fraud or abuse, or report apparent child exploitation or serious threats.
• Business transactions: in connection with a merger, financing, acquisition, reorganization, bankruptcy, or transfer of assets, subject to appropriate safeguards and notice where required.

We require providers processing personal information for us to protect it consistently with this Policy and applicable law and to use it only for the services they provide to us.

6. Public, unlisted, and private content

Public profiles, public universes, published Slops, comments, usernames, and engagement may be visible to anyone, indexed by search engines, downloaded, captured, or reshared outside Sloppeh. Unlisted content can be viewed by anyone with its link. Private content is limited according to the controls shown in the product, but it is still processed by us and relevant providers to operate, secure, and moderate the Service.

7. Legal bases for EEA and UK users

Where the GDPR or UK GDPR applies, we rely on:

• Contract: to create your account and provide generation, storage, publishing, social, purchase, and support features you request.
• Legitimate interests: to secure and improve the Service, prevent fraud and abuse, understand feature performance, moderate content, and protect users, balanced against your rights.
• Consent: where we ask for it, such as optional notification permissions or processing that legally requires consent. You may withdraw consent at any time without affecting earlier lawful processing.
• Legal obligation and legal claims: to meet accounting, safety, regulatory, and lawful-request obligations and establish, exercise, or defend claims.

8. International transfers

Cendrawasih is based in the United States, and Sloppeh’s primary cloud functions operate in the United States. Information from the EEA, UK, Australia, and other locations may therefore be transferred to and processed in the United States and in other countries where our providers operate. Those countries may have different privacy laws.

Where required, we use recognized safeguards such as adequacy decisions, contractual protections including the European Commission’s Standard Contractual Clauses, and supplementary security measures. Australian users should understand that likely overseas recipients include providers in the United States and potentially other countries listed by those providers for their support and subprocessors.

9. Retention and deletion

We keep account and content information while your account is active or as needed to provide the Service. We keep usage, transaction, security, moderation, and support records only for as long as reasonably necessary for the purpose collected. Generation-allowance and rate-limiting records are retained for the duration of the applicable quota or billing window plus a short operational buffer for reconciliation and abuse prevention.

When you delete your account, we remove the account and associated content from active Sloppeh systems, subject to technical processing time. Limited information may remain where necessary for fraud prevention, safety, financial reconciliation, legal compliance, dispute resolution, and enforcement. Residual copies may remain temporarily in protected backups until overwritten under normal backup cycles. Information retained by an app store, payment provider, or other independent controller is governed by that provider’s policy.

You can delete your account in the app or through our Delete Account page.

10. Your rights and choices

You can edit profile information, manage visibility, control notification permission, unpublish or delete content, block users, and delete your account. Depending on where you live, you may also have rights to:

• access and obtain a copy of personal information;
• correct inaccurate information;
• delete information;
• restrict or object to processing;
• receive portable information;
• withdraw consent; and
• appeal our refusal of a privacy request.

Email admin@cendra.co to exercise a right. We may need to verify your identity and authority. You may use an authorized agent where applicable. We will not discriminate against you for exercising privacy rights.

EEA and UK users may complain to their local data-protection authority. Australian users should contact us first; if the concern is not resolved, they may complain to the Office of the Australian Information Commissioner. US residents may contact their state attorney general or applicable privacy regulator.

11. Automated moderation

We use automated systems to classify content, prioritize reports, detect abuse, and recommend or take moderation action. Human review may also be used. If your content or account is materially restricted, you may request review by emailing admin@cendra.co. We do not use automated decisions to determine eligibility for employment, credit, housing, insurance, education, or similarly significant services.

12. Cookies, local storage, and mobile permissions

Our website uses cookies or similar local storage for authentication, security, App Check, and functional preferences such as content language. Depending on your region, we either ask before enabling Google Analytics or provide clear notice and an immediate opt-out. We honor browser Global Privacy Control signals. Advertising storage and ad personalization remain disabled, and web analytics events are not attached to your Sloppeh account ID. You can disable analytics without losing access to Sloppeh. Mobile operating systems separately control permissions such as notifications and photo-library access; you can change those permissions in device settings.

13. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls and encryption in transit. No system is completely secure, and we cannot guarantee absolute security.

14. Children and age eligibility

Sloppeh accounts are for people aged 13 and older (or the applicable legal age of digital consent in your jurisdiction, such as 16 in certain European countries). We do not knowingly allow children under 13 (or the applicable local age) to create an account or knowingly collect their personal information without parental consent. If you believe a child under the required age has provided personal information, contact us at admin@cendra.co so we can investigate and delete or restrict the account as appropriate.

15. Changes to this Policy

We may update this Policy as our practices, providers, or legal obligations change. We will post the new effective date and provide additional notice when a change materially affects your rights or how we use personal information.

16. Contact

Cendrawasih Technologies LLC (Delaware) is the controller responsible for Sloppeh. For privacy requests, complaints, or questions, email admin@cendra.co. We aim to acknowledge privacy complaints promptly and respond within the period required by applicable law.