ApplycasTR
Laternist

Laternist — Privacy Policy

Last updated: 29 September 2026

This policy explains how Laternist handles your data. It is the same as the privacy declarations in the stores (App Privacy on the App Store, Data safety on Google Play).

Data we collect

Laternist collects the following data as a developer:

  • User content (e.g. documents)
    Purpose: App functionality · Not linked to your identity · Not used for tracking
  • Identifiers
    Purpose: App functionality · Not linked to your identity · Not used for tracking
  • Purchase information
    Purpose: App functionality · Not linked to your identity · Not used for tracking
  • Usage data
    Purpose: App functionality · Not linked to your identity · Not used for tracking
  • Diagnostics (crashes, performance)
    Purpose: App functionality · Not linked to your identity · Not used for tracking

Data stored on your device

Everything you write and create in Laternist is stored in the app's storage on your device: scripts, scenes, notes, ideas, character and location cards, reference images you add, voice notes, storyboards and exports. We have no access to it.

Voice notes are recorded with your permission (microphone) and transcribed on your device with the system's speech recognition. Neither the recording nor the text is sent to us.

Reference images are picked from your photo library with the system picker. The app only receives the photos you choose.

Files you import or export (Final Draft, Fountain, Word, PDF, Laternist packages) go only where you send them.

Sync between your devices (Laternist Pro)

If you have Laternist Pro and sync is on (Settings → Sync), your projects are copied as project packages to your own cloud storage so your other devices of the same platform can use them.

iPhone and iPad: the app's private folder in your iCloud Drive, under your Apple Account. Apple's privacy policy applies.

Android: the hidden app data folder of your Google Drive, under your Google Account. The app asks for the drive.appdata permission, which only lets it see the files it creates there; it can't see or change your other Drive files. Google's privacy policy applies.

We don't receive or store these copies. You can turn sync off in Settings at any time; the projects stay on your device. On Android you can also remove the app's access in your Google Account settings (Security → Third-party connections) and delete its hidden data in Google Drive settings (Manage apps). The sample project that comes with the app is not synced.

AI storyboards (cloud)

The “Light it” button draws your scene as storyboard panels. Drawing happens in the cloud, and you're asked once before anything is sent. You can turn all AI features off in Settings → AI settings. Blocking storyboards (without AI) are made on your device.

What is sent: for each panel, a short English description made from the scene (who is in the shot, what they do, the setting, the shot size), and the character cards of the people in it. For a new character card, the character's name and appearance description are sent.

What is never sent: your full script, your notes, your other scenes, your project titles and your voice notes.

Who processes it: requests go through our server functions on Google Firebase to OpenAI, which draws the images (see Third-party services).

What we keep on our servers: character cards (the image, the character's name and appearance description), kept in your anonymous account's storage so your characters look the same in every panel; you can delete them all in Settings → AI settings → Delete character cards, which also deletes them from your device. Panel descriptions and drawn panels are not kept on our servers; the panel goes straight back to your device. For each drawn panel, a usage record without its content (time, number of cards, description length, the model, cost and duration) is kept to count your lights and protect against abuse. Server logs (your anonymous identifier, request identifiers and error codes) are kept for a limited time for troubleshooting.

The image service may refuse requests that break its usage policies. A refused panel doesn't use a light.

Anonymous identifier and app integrity

When you first use a cloud feature, the app gets an anonymous identifier from Firebase Authentication. It isn't linked to your name, e-mail or phone number; it holds your lights and your character cards. To make sure requests come from the genuine app, Firebase App Check is used; it checks the app and device integrity, not your identity.

Purchases

Subscriptions and light packs are bought through the App Store or Google Play. We never see your payment details. Purchases are managed with RevenueCat; our server stores your plan, its renewal date and your remaining lights.

What we don't do

No ads, no advertising SDKs, no data brokers; no advertising identifiers, and we don't track you across other apps or websites. We don't sell or rent your data. Your content is not used to train AI models, by us or on our behalf.

Where data is processed

Our server functions run on Google Cloud in the European Union (europe-west1). OpenAI, RevenueCat, Apple and Google may process data in the United States and other countries, under their own safeguards (such as the EU Standard Contractual Clauses).

How long we keep it

Your projects: on your device (and in your own iCloud/Google Drive if you sync), until you delete them.

Character cards: until you delete them in the app, or until your server data is deleted.

Plan, lights and usage records: while your anonymous account is in use, and as long as needed for billing, refunds and legal obligations. A record that a store purchase already used its free trial is kept, without your content, so the trial can't be taken twice.

Server logs: a limited period, then deleted automatically.

Your choices

Turn off AI: Settings → AI settings. Nothing is sent to the cloud after that. Delete character cards: Settings → AI settings → Delete character cards. Turn off sync: Settings → Sync. Delete everything on your device: delete your projects, or uninstall the app.

Delete your server data (lights, usage records, character cards, anonymous identifier): in the app, Settings → AI settings → Delete my server data. This deletes it right away and the app starts again with a new anonymous identifier. If you can't use the app, write to the address below. Active subscriptions are managed and cancelled in the App Store or Google Play.

Legal bases: to provide the service you asked for (contract) for AI drawing, lights and purchases; your consent for the first AI drawing, microphone and photo access, and sync; our legitimate interests for security and abuse prevention. Your rights are detailed in the KVKK and GDPR sections below.

Children

Laternist is not directed to children under 13 (or the minimum age in your country), and we don't knowingly collect their data. If you believe a child has sent us data, contact us and we'll delete it.

Third-party services

Laternist uses the following third-party services:

  • Google Firebase
    Our server functions, the anonymous identifier (Firebase Authentication), app integrity checks (Firebase App Check; Apple App Attest on iOS, Google Play Integrity on Android) and character card storage. Runs on Google Cloud in the European Union (europe-west1). Firebase Analytics is not used.
  • OpenAI
    Draws AI storyboard panels and character card images. Only panel descriptions and character cards are sent. OpenAI processes API data under its API data usage policies; by default it does not use it to train its models, and it may keep it for up to 30 days to detect abuse.
  • RevenueCat
    Manages subscriptions and light packs. It receives the anonymous identifier, the purchase receipts and the store country, so that it can tell the app what you're entitled to.
  • Google ML Kit
    Used in the Android app only, for script translation. Translation runs on the device and no text is sent; translation models are downloaded from Google, and device/app identifiers and performance and diagnostic metrics are sent to Google. On iOS, translation uses Apple's on-device tools.

Changes

If we change this policy, we will update the date and publish the new text on this page.

Contact

If you have questions about this policy, write to support@applycas.com.

KVKK Notice

Under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), we inform you about how your personal data is processed. This section is for people located in Türkiye.

Data controller. Oktay Tanrıkulu (Applycas). Address: Bağlar Mah., 46. Sokak No: 22, Flat 8, Bağcılar/Istanbul, Türkiye. Contact: support@applycas.com.

Personal data processed. When you email us: your email address, your name (if you give it), the content of your message and any information you attach. When you visit the website: technical data such as your IP address and browser information in the hosting infrastructure’s server logs. We do not process special categories of personal data.

Purpose of processing. Answering your support requests and messages, fixing problems in the apps, keeping the site running securely and meeting legal obligations.

Legal basis. KVKK Art. 5/2(f) (the controller’s legitimate interests, provided they do not harm your fundamental rights and freedoms) and Art. 5/2(ç) (the controller’s compliance with a legal obligation).

Method of collection. By email, and automatically through the website’s hosting infrastructure.

Transfers. To the extent necessary to provide the service, your personal data is processed by our hosting and email forwarding provider Cloudflare, Inc. (USA) and Google LLC (USA), which hosts our mailbox, and to that extent is transferred abroad. A data processing agreement under KVKK Art. 12 is in place with Cloudflare. Google’s Gmail service is used under Google’s standard terms of service and privacy policy for account holders. As the Personal Data Protection Board has issued no adequacy decision for these countries, the transfer is made under paragraph six of KVKK Art. 9, on an incidental basis and only to the extent strictly necessary for the technical performance of the operation you initiated — delivering the email you sent us and our reply to you, serving the page you asked to view. Your data is not transferred to any other third party and is not sold.

Retention. Correspondence is kept for no more than twenty-four months after your request is resolved, and, where a legal dispute is possible, for the applicable limitation period. It is then deleted or anonymised. Server logs are kept for a short period under the hosting provider’s own retention policy.

Automated decision-making. No profile is built about you and no decision against you is produced by automated analysis.

Your rights. Under Article 11 of the KVKK, you may apply to the data controller to:

  • Learn whether your personal data is processed,
  • Request information if it has been processed,
  • Learn the purpose of processing and whether it is used accordingly,
  • Know the third parties to whom it is transferred, in Türkiye or abroad,
  • Request correction if it is incomplete or inaccurate,
  • Request deletion or destruction under the conditions set out in the law,
  • Request that corrections, deletions and destruction be notified to third parties to whom the data was transferred,
  • Object to a result against you that arises from analysis of the data by automated systems,
  • Request compensation for damage arising from unlawful processing.

How to apply. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may apply: in writing with a wet signature to the address above; by email to support@applycas.com using a secure electronic signature or mobile signature; or by a message sent to support@applycas.com from an email address you have previously notified to us and which is registered in our system. Your application should state your name and surname, your signature (for written applications), your Turkish ID number (for foreign nationals, your nationality and passport number), your address for service, your email address and phone number if any, and the subject of your request.

Time limit and cost. Your application is concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. If the request requires an additional cost, the fee set out in the Board’s tariff may be charged.

Complaints. If your application is rejected, our reply is insufficient, or we do not reply within thirty days, you may complain to the Personal Data Protection Board within thirty days of learning of our reply and in any event within sixty days of the date of your application.

GDPR Notice

This section explains your rights under the General Data Protection Regulation (GDPR) and the UK GDPR if you are located in the European Economic Area (EEA) or the United Kingdom.

Controller. Oktay Tanrıkulu (Applycas), Bağlar Mah., 46. Sokak No: 22, Flat 8, Bağcılar/Istanbul, Türkiye. Contact: support@applycas.com. Given the scope of our processing, we are not required to appoint a Data Protection Officer.

EU representative. We have no establishment in the EEA. Because the processing described here is occasional, limited in scope and involves no special categories of data, we have not appointed a representative, relying on the exemption in Article 27(2)(a) GDPR. We will reassess this if our processing changes.

Data, purposes and legal bases.

  • Email correspondence (your email address, your name, the content of your message and any attachments) — to answer your support request. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in responding to requests addressed to us; where the request concerns performance of an app contract, Art. 6(1)(b).
  • Server logs (IP address, browser information) — to serve the page you asked for and keep the infrastructure secure. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping the site running and secure.
  • Legal obligations — Legal basis: Art. 6(1)(c) GDPR.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; the data processed is minimal and is never used for marketing.

Recipients. Cloudflare, Inc. (hosting and email forwarding) and Google LLC (the Gmail service that hosts our mailbox). Cloudflare acts as our processor under Art. 28 GDPR and process data only on our instructions. Google’s Gmail service is used under Google’s standard terms of service and privacy policy for account holders. There are no other recipients; your data is not sold and not shared for advertising.

International transfers. These providers (including Google) process data in the United States. Transfers rely on the European Commission’s Standard Contractual Clauses included in Cloudflare’s data processing agreement and, where the provider is certified, on the EU–US Data Privacy Framework. You can request a copy of the safeguards in place by writing to support@applycas.com.

Retention. Correspondence is kept for no more than twenty-four months after your request is resolved, and, where a legal dispute is possible, for the applicable limitation period. Server logs are kept for a short period under the hosting provider’s own retention policy.

Your rights. Under Arts. 15–22 GDPR you have the right to access your data, to have it rectified, to have it erased, to restrict its processing, to receive it in a portable format, and to object at any time to processing based on legitimate interests. Our processing is not based on consent, so there is no consent to withdraw.

Automated decision-making. We carry out no decision-making based solely on automated processing, and no profiling, within the meaning of Art. 22 GDPR.

Do you have to provide data? You need to provide nothing to browse the site. The information you share when emailing us is used only so that we can reply; without it we may not be able to answer your request.

Right to complain. You may lodge a complaint with the data protection authority of your EEA member state. In the United Kingdom the competent authority is the Information Commissioner’s Office (ico.org.uk). If you contact us first, we will do our best to resolve the matter.