Privacy Policy

This Privacy Policy explains how Daniel Ocanto Hernandez, the independent developer of COVERAGE ("we", "us", "our"), collects, uses, discloses, and safeguards personal data in connection with the COVERAGE mobile application (the "App"). It is written to comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"), and the Brazilian Lei Geral de Proteção de Dados ("LGPD"), as well as the relevant guidance from the Apple App Store and Google Play.

If you have questions about this Policy, contact us at support@coverage-app.xyz.

1. Data controller

For the purposes of the GDPR and equivalent laws, the data controller is:

Daniel Ocanto Hernandez, the independent developer who publishes the App on the Apple App Store.
NIF: 51226811S
Address: Calle del Duque de Tovar 15, 4L, 28005 Madrid, Spain
Contact: support@coverage-app.xyz · +34 635 26 77 98

We have not appointed a formal Data Protection Officer because we are not required to do so under Article 37 GDPR — we do not process special-category personal data at scale and do not engage in large-scale systematic monitoring. Our point of contact for privacy questions is the email address above; you can also write to the postal address.

2. Scope

This Policy covers personal data we collect when you use the App or interact with our support channels. It does not cover:

The Apple App Store or Google Play, which are operated by Apple Inc. and Google LLC and have their own privacy policies.
Third-party websites or services you reach through links in the App.
The lens-manufacturer, camera-manufacturer, or rental-house websites that we cite as sources for Reference Data.

3. Design principle: local-first

The App is designed to work as much as possible on-device. The following functions do not require any account and do not transmit personal data to our servers:

Browsing the lens and camera Reference Data catalogue.
Depth-of-field, hyperfocal, and field-of-view calculations.
Anamorphic squeeze and image-circle visualisations.
The Director's Viewfinder overlay on the device camera preview.
Local project storage (before you enable cloud sync).
On-device PDF export of shot lists and coverage sheets.

Personal data leaves your device only when you actively sign in for cross-device sync, when you share a project or shot yourself, or when you email us for support.

4. What we collect

We collect only the data described below. We do not collect data outside these categories.

4.1 Account data (only if you sign in)

If you choose to create an account for cross-device sync, we collect:

Your email address.
A hashed authentication credential (managed by Firebase Authentication; we never see your password in plain text).
The sign-in method you used (email and password in the iOS app; Google is also offered on the web version) and the provider-supplied identifier.
Sign-in timestamps and IP address at sign-in (for security).

You can use the App without signing in. If you do not sign in, none of this section applies.

4.2 Content you create

If you have signed in, we sync the following to Firestore under your account:

Projects: their names, lens lists, pinned camera and sensor mode, framelines, look settings (including the name of a LUT you assigned), and any crew credits you typed in (for example, the names of the production company, cinematographer, or camera assistants).
Favourites: the lens sets and cameras you have starred.
Theme preference.

Shots, photos, video clips, and LUT files are not synced: they stay on your device unless you share or export them yourself. If you do not sign in, nothing is synced.

4.3 Sensor and location data

The App can capture the following sensor readings only when you grant the corresponding operating-system permission, and only at the moment of use:

Camera: for the Director's Viewfinder overlay and for capturing a reference frame. Camera frames are shown live and are only stored on your device (or synced under section 4.2) when you tap the capture button.
Microphone: records sound only while you record a video clip from the Director's Viewfinder. The audio stays with the clip on your device.
Device location (GPS): attached to a shot when you capture it, if you have allowed location access. We do not track your location in the background or when the App is not open.
Device compass and motion sensors: the heading and camera tilt at the moment of capture are saved with the shot.
Device photo library: only when you tap "Import from library" or "Save shot to album".

You can withdraw any of these permissions at any time in your device's OS settings. Withdrawing a permission may disable the feature that depends on it.

4.4 Diagnostic data (crash reports)

The App does not include a third-party crash-reporting or analytics SDK. If you have chosen to share analytics with app developers in your device's settings, Apple may provide us with anonymised crash reports (the error, the App and OS versions, and the device model). They do not include your User Content, your location, or your email address.

If we later add crash reporting or behavioural analytics, we will update this Policy first and, where required, ask for your consent.

4.5 Support correspondence

If you email us for support, we retain your email address, your message, and any attachments you send for as long as needed to answer your request and to keep a record of the resolution.

4.6 What we do NOT collect

For the avoidance of doubt, the App does not collect:

Your contacts.
Your calendar or reminders.
Your browsing history.
Your health, fitness, or biometric data.
SMS, phone-call, or messaging content.
Advertising identifiers such as IDFA (iOS) or GAID (Android). We do not serve advertising and we do not participate in the Apple App Tracking Transparency framework, because we do not track you across other companies' apps or websites.
Any data that could uniquely identify you across other unrelated apps or services.

Under the GDPR, we rely on the following legal bases:

Contract (Art. 6(1)(b)): to provide account features, cloud sync, and support. Without your account data we cannot log you in.
Consent (Art. 6(1)(a)): for camera, location, compass, and photo library access, and for any future addition of behavioural analytics. You give consent through the operating-system permission prompt or an in-app toggle. You may withdraw it at any time.
Legitimate interest (Art. 6(1)(f)): for the crash reports Apple shares with us when you have opted in, which are minimally intrusive and necessary to keep the App working. We have carried out a balancing test; you may object to this processing (see section 9).
Legal obligation (Art. 6(1)(c)): where we must retain records for tax, accounting, or regulatory reasons.

6. How we use your data

We use the data described above only for the purposes we collected it for:

To provide the App and its features (rendering the catalogue, syncing your projects, exporting PDFs).
To let you sign in, recover access, and secure your account.
To respond to your questions and provide support.
To fix bugs and improve stability.
To send you occasional service messages about changes to the App, to these Terms, or to this Privacy Policy. We do not send marketing emails without a separate opt-in.
To comply with legal obligations.
To defend our legal rights where necessary.

We do not use your personal data to make automated decisions with legal or similarly significant effects.

We do not sell or "share" (as those terms are defined under the CCPA/CPRA) your personal data.

We rely on a small number of third-party service providers ("processors") who process personal data on our behalf under a data-processing agreement. Each is bound to use the data only for the purposes we specify.

Google LLC (Firebase Authentication, Firestore, Firebase Storage) — identity and cross-device sync. Data-processing terms: https://firebase.google.com/terms/data-processing-terms. Privacy: https://policies.google.com/privacy.
Expo Application Services (650 Industries, Inc.) — delivers App updates. Privacy policy: https://expo.dev/privacy.
Apple Inc. and Google LLC — App Store and Play Store distribution, and any in-app purchase processing. Their privacy policies apply.
Our email provider — to receive and answer the emails you send us.

We may also disclose data:

To professional advisers (lawyers, accountants) bound by confidentiality.
To a competent authority when we are legally required to do so, and only to the minimum extent necessary.
To a buyer or successor in the event of a merger, acquisition, or sale of substantially all our assets, subject to the same protections you have under this Policy.

We do not sell your personal data. We do not disclose it for cross-context behavioural advertising. We do not participate in data brokerage.

8. International transfers

Our processors — in particular Google (Firebase) — store and process data in a multi-region infrastructure that may include datacenters in the United States and in other jurisdictions outside the European Economic Area, the United Kingdom, and Brazil.

When personal data of EEA, UK, Swiss, or Brazilian users is transferred to a country that does not have an adequacy decision, we rely on the following safeguards:

Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision (EU) 2021/914), plus the UK International Data Transfer Addendum where applicable.
The EU-US Data Privacy Framework for transfers to Google LLC in the United States, to the extent Google is certified.
Supplementary measures (encryption in transit and at rest, pseudonymisation where feasible).

By signing in for cloud sync, you understand that your account data and synced content may be processed outside your country. If you do not consent to this, do not enable cloud sync — the App will continue to work locally.

9. Your rights

You have the rights described in this section. To exercise any of them, email support@coverage-app.xyz from the address associated with your account, or use the in-app Profile screen. We will respond within the timeframe the applicable law requires — one month under the GDPR, forty-five days under the CCPA/CPRA — and may extend that period where the request is complex, notifying you of the extension.

9.1 GDPR / UK GDPR / LGPD rights

Right of access — to receive confirmation of whether we process your personal data and, if so, a copy of that data.
Right of rectification — to have inaccurate or incomplete data corrected.
Right of erasure ("right to be forgotten") — to have your personal data deleted where the legal grounds for holding it no longer apply.
Right to restriction of processing — to have processing paused in certain circumstances.
Right to data portability — to receive your personal data in a structured, commonly used, machine-readable format and, where technically feasible, to have it transmitted to another controller.
Right to object — including to processing based on our legitimate interest.
Right to withdraw consent — for any processing based on your consent (for example, camera or location permissions). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Right not to be subject to a decision based solely on automated processing — we do not carry out such decisions.
Right to lodge a complaint with a supervisory authority — in the EU member state where you live or work, or where the alleged infringement took place. For Brazil, the ANPD, https://www.gov.br/anpd.

9.2 CCPA / CPRA rights (California)

If you are a California resident, you have the right to:

Know what personal information we collect, use, disclose, and (in theory) sell about you. We disclose these purposes in this Policy.
Delete the personal information we hold about you, subject to legal exceptions.
Correct inaccurate personal information.
Opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, so there is nothing to opt out of, and we do not need to display a "Do Not Sell or Share My Personal Information" link.
Limit the use of sensitive personal information. We collect only the minimum sensitive personal information necessary to operate the App (for example, precise geolocation attached to a shot, when you choose to save it).
Non-discrimination. We will not deny you service, charge you a different price, or provide a lower quality of service because you exercised a privacy right.

You may designate an authorised agent to make a request on your behalf. We will verify identity through the email address on your account.

9.3 Other jurisdictions

If you live in Brazil, Canada (PIPEDA), Australia, or another jurisdiction with a comprehensive privacy law, equivalent rights apply. Contact us and we will honour them.

10. How to delete your data

You can delete synced data in several ways:

In-app: Profile → DELETE ACCOUNT. This removes your account from Firebase Authentication and deletes the Firestore data stored under your user ID.
Uninstall the App to remove all local data from the device. Note: if you signed in, this alone does not delete data stored on our servers. Use DELETE ACCOUNT before uninstalling, or email us afterwards.
Email: support@coverage-app.xyz with the email address of your account and the request "Please delete my account and all associated data".

We will complete the deletion within thirty (30) days, subject to any legal obligation to retain certain records (for example, tax or compliance logs, and short-term backups as described in section 12).

11. Children

The App is not directed at children under the age of digital consent in their country (16 in the EEA by default, lower in some member states; 13 in the United States; other thresholds in other countries). We do not knowingly collect personal data from children below those thresholds. If you believe a child has provided us data, contact support@coverage-app.xyz and we will delete it.

12. Retention

Account data: kept while your account is active, and deleted within thirty (30) days of account deletion.
User Content in cloud sync: kept while your account is active; on account deletion, removed from live systems within thirty (30) days and from backups within a further sixty (60) days.
Crash reports shared by Apple: retained for up to ninety (90) days, after which they are deleted.
Support correspondence: retained for up to twenty-four (24) months.
Records required by law (for example, tax records if you have purchased a paid feature): retained for the period the applicable law requires.

13. Security

We take reasonable and appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, and destruction. These include:

Transport-layer encryption (TLS) for data in transit.
Encryption at rest on our processors' infrastructure.
Firebase Security Rules that restrict access to a user's data to that user only.
Least-privilege access controls on internal tooling.
Prompt patching of dependencies and reasonable code review.

No system is perfectly secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within seventy-two (72) hours of becoming aware of it, and notify affected users where required by law.

14. Cookies and similar technologies

The App itself does not use cookies. The App does use local storage (AsyncStorage, and platform-standard secure storage) to remember your preferences and to keep you signed in. These are strictly necessary for the App to function; you cannot disable them without breaking the App.

If you visit our marketing website, that site may use cookies under its own cookie policy, which is not part of this document.

15. Changes to this Policy

We may update this Policy from time to time. When we do, we will change the "Last updated" date at the top and, for material changes, notify you in-app on next launch (and by email if you have provided one). Continued use of the App after the effective date of the updated Policy constitutes acceptance of the change.

Change history

2026-10-12 — v1.1 — The App is now published by its developer, Daniel Ocanto Hernandez, as an individual; contact details (email, address, phone, NIF), the synced-data list, and the crash-reporting section updated to match the App.
2026-09-01 — v1.0 — Initial version.

16. Contact

For any question about this Policy or your personal data:

Daniel Ocanto Hernandez Calle del Duque de Tovar 15, 4L, 28005 Madrid, Spain support@coverage-app.xyz +34 635 26 77 98

For complaints, you may also contact the data-protection supervisory authority of the country where you live or work.