Privacy Policy

Who is responsible

Stikumi is operated by Hongyu Yang, an individual developer based in Shenzhen, China. In this policy, “Stikumi”, “we”, “us” and “our” refer to Hongyu Yang. Contact us at support@stikumi.onvori.ai.

This policy covers the Stikumi app, the website at stikumi.onvori.ai, and support related to these services. It explains what we process, why we process it and the choices available to you.

Information we process

Account information: your account identifier, email address, sign-in method and profile information you provide, such as your name, avatar and biography. Sign-in and security services also process session and verification information. When you sign in with Apple or Google, the information we receive depends on the provider and your choices.

Content: photos you choose to upload and any metadata attached to those files, template selections, captions, prompts, creation settings, generated images and the records needed to save, retrieve and manage your creations. We do not upload your entire photo library. Selecting a photo is separate from permission to upload it for AI processing.

Service information: generation requests, progress, errors, creation-credit and consent records, device model, operating system and app version, language, time zone, IP address and approximate region inferred from it, request identifiers and security-session records. Push delivery uses installation identifiers and push tokens when enabled. We do not request precise-location access for these purposes.

Purchases and support: orders, store transaction and purchase-verification records needed to deliver and reconcile purchases, plus the messages and attachments you send to support. Store payment details are handled by the relevant app store; do not send payment credentials, passwords or verification codes to support.

App usage analytics processes usage events, installation identifiers and device/app information. It is on by default after you accept the startup notice, and you can turn it off in Settings → Privacy & permissions. A saved off choice stays off. Crash diagnostics is separate and off by default; if you enable it, we process errors, crash reports and diagnostic information for troubleshooting. These settings are separate from AI processing permission and website cookie choices.

How we use information

We use account and content information to authenticate you, create the stickers you request, show progress, keep your library, enable saving and sharing, and respond to support requests. Usage records help us administer creation credits and reconcile completed, failed or cancelled work.

We process necessary technical and security information to operate the service, prevent abuse, investigate failures and comply with legal obligations. Where consent is required, we obtain it for the relevant processing. Where applicable law permits, processing may also be necessary to perform our agreement with you, meet a legal obligation, or pursue legitimate interests in operating and securing the service.

App analytics helps us understand feature use; optional crash diagnostics helps us investigate faults. You can turn analytics off and leave crash diagnostics off without losing browsing, generation or purchase features. Optional website analytics follows the separate choices described in our Cookie Policy.

Photos and AI processing

Sticker generation takes place in the cloud. After your separate AI processing permission and a creation action, Stikumi sends selected images or authorised image links, prompts and generation options to Atlas Cloud for previews and stickers. Atlas Cloud is the API recipient for the configured GPT Image 2 model; that model name does not mean the app connects directly to OpenAI. Storage also forms part of the requested creation workflow. Content-safety checks may examine sticker captions, generation descriptions, processed copies of selected photos and generated images, as described below.

Your uploaded content and generated stickers are associated with your account and are not made public by us simply because you create them. You decide when to save or share them. Sharing through another app sends content to the recipient or service you choose, under that service’s own policies.

Photos and attached metadata may contain personal information about you or others. Upload only content you have the right to use, and obtain permission from people shown or their guardian where required. The image-rights declaration applies to the selected image; it is not a general permission for other images.

Provider processing, including any downstream model services, is governed by the applicable service terms. We do not promise that every downstream provider has zero retention or excludes all model-training use. Accepting the startup notice alone does not grant AI processing permission.

Service providers and other disclosures

Apple: when you use Apple sign-in, push notifications or in-app purchases, Apple processes the relevant sign-in assertions and permitted identity details, device push tokens and notification payloads, or store transaction and purchase-verification information. These are separate features, not a single permission.

Google and Firebase: Google sign-in exchanges sign-in assertions and permitted identity details when selected. Firebase Cloud Messaging processes installation identifiers, push tokens and notification payloads for push delivery. After you accept the startup notice, Firebase Analytics receives usage events, installation identifiers and device/app information unless you have turned analytics off. Crashlytics receives errors, crash reports and diagnostics only if you separately enable crash diagnostics, which is off by default.

Alibaba Cloud Object Storage Service (OSS): stores selected uploads, generated images and related files so that we can process and deliver your creations.

Alibaba Cloud Content Moderation: when checking creation content for safety, our servers send the text to be reviewed (such as sticker captions and generation descriptions), temporary access links to processed copies of your selected photos or generated images, and task identifiers to detect prohibited or harmful content. Alibaba Cloud retrieves the corresponding images through those links. This is server-side content processing, separate from OSS file storage.

Atlas Cloud: receives the images or authorised image links, prompts and generation options needed for AI processing after your permission.

Cloudflare email delivery: processes recipient email addresses and message content to deliver account and service emails, and marketing emails when you subscribe. This email use does not imply permission for unrelated analytics or advertising.

We do not sell your personal information. We may disclose information when required by law, to respond to valid legal process, or when necessary to protect users, investigate abuse or establish and defend legal rights. If operation of the service is transferred, any relevant transfer of personal information will remain subject to applicable law and notice requirements.

How long information is kept

We keep account information and saved creations for as long as needed to provide your account and library, unless you delete them or another lawful retention requirement applies. Temporary uploads, intermediate images and failed or abandoned work are kept only for the processing, recovery and security purposes for which they are needed.

AI input files, generated outputs and request or billing records have different retention rules. Atlas Cloud’s standard service can retain content; enterprise zero-data-retention is a separate contractual configuration, not a guarantee for Stikumi requests. The applicable provider terms and settings determine retention for provider-held copies. Completing a generation or withdrawing AI permission does not itself delete those copies.

Retention depends on the type of information, whether a task remains active, your choices, and legal or security requirements. Deletion may involve several services and is processed asynchronously. Where information must be retained by law or cannot immediately be removed from isolated backups, we restrict further use and remove it when the retention reason ends or the relevant backup is replaced.

Access, choices and deletion

You can edit your profile, manage device permissions, save copies of your creations and delete creations through the available app controls. You can request account deletion in the app, or contact us for help exercising data rights. Our Account and Data Deletion page explains the available paths and what deletion covers.

In Settings → Privacy & permissions, you can turn usage analytics and crash diagnostics on or off independently. These are device-wide choices and remain when you switch accounts. Turning collection off does not delete reports already sent. Camera, selected-photo, saving and notification permissions are requested for the related action and can be managed through the supported system settings; denying notifications does not remove your in-app inbox.

You can withdraw AI processing permission for the signed-in account on the current device. This stops new AI requests there, including requests using previously uploaded photos, until you agree again. It does not change choices on other devices, undo requests already sent or delete existing data. Use the available task-cancellation, creation-deletion or account-deletion controls for those separate actions.

Depending on the law that applies to you, you may have rights to access, correct, delete or obtain a copy of your personal information, restrict or object to certain processing, withdraw consent and complain to a relevant data-protection authority. Withdrawing consent does not affect processing that was lawful before withdrawal; a feature may stop working if it needs the affected information.

Send requests to support@stikumi.onvori.ai. We may verify that the request concerns your account before releasing or deleting information, and will respond within the period required by applicable law. Please do not send passwords, verification codes or identity documents unless we explain why specific verification is necessary.

Security

We use measures appropriate to the information and risks, including access controls, authenticated access to private content and protected transmission. Access is limited to providing, maintaining and securing the service. No internet transmission or storage system can be guaranteed completely secure. Keep your sign-in credentials private and contact us if you suspect unauthorised account access.

Children

Stikumi is not directed to children under 13, or a higher minimum age required where they live. If you are a minor who may lawfully use the service, use it with the permission and supervision of a parent or guardian where required. We do not knowingly collect children’s personal information without the legally required authorisation. A parent or guardian who believes a child has provided such information can contact us to request review and deletion.

Website and browser storage

The website receives technical information necessary to deliver pages, such as IP addresses, browser details and requested addresses. Your display theme and website analytics consent may be stored in your browser. Language is selected through the page address or language menu. See our Cookie Policy for storage categories, retention and analytics choices.

Changes and contact

We update this policy when our services or data practices change. The date at the top identifies the current version. We provide additional notice and seek consent when required for a material change. For privacy questions or requests, email support@stikumi.onvori.ai.