Privacy Policy

Last updated: May 26, 2026

Summary (TL;DR)

Your videos stay on your iPhone. Reframe and caption processing is 100% on-device — we never upload your content to our servers.
We collect the bare minimum. Email for account creation, Apple transaction ID if you subscribe to Pro, encrypted X token if you opt to connect.
Age verification via Apple. To comply with Brazilian Law 15.211/2025 (ECA Digital), we require Apple-verified adult age before processing videos marked as sensitive on X. We do not collect your date of birth.
We don't sell anything. No ads. No marketing partners. We don't train AI on your data.
You can delete everything anytime. "Delete account" button inside the app — irreversible and immediate.

This policy forms part of the Terms of Service. By using Klyp you agree to both.

1. Who we are

Klyp Reframe is an iOS app developed and operated by:

IPCOM Tecnologia Ltda.
Brazilian Tax ID (CNPJ): 06.163.889/0001-04
Rua Paraguai, 605, Vivacoworking
Alto Alegre — Cascavel/PR — ZIP 85.805-020
Brazil

Data Protection Officer (DPO), under art. 41 of Brazil's LGPD:
IPCOM Tecnologia Ltda. (same legal entity as the controller)
Dedicated channel: dpo@klyp.uk
General channel: hello@klyp.uk

The DPO is responsible for receiving communications from the Brazilian National Data Protection Authority (ANPD) and from data subjects, providing clarifications, and adopting measures under art. 41 §2º of LGPD. Liaison is carried out by a natural person responsible for performing the role, designated by IPCOM Tecnologia Ltda.'s management through an internal Designation Instrument formalized pursuant to art. 41 of LGPD and art. 2(2) of ANPD Resolution No. 18/2024, available to ANPD upon formal request.

This policy describes how Klyp collects, uses, stores, and shares personal information when you use the app. By using Klyp, you agree to this policy.

2. Data we collect

We collect only what is strictly necessary to authenticate you and operate the app's functions:

Data	Purpose	Legal basis (LGPD)	Retention
Email (and encrypted password, if email signup)	Identify your account, recover access	Contract execution (Art. 7, V)	While your account is active + 30 days after deletion
Apple unique identifier (Sign in with Apple)	Identify your account without a password	Contract execution (Art. 7, V)	Same
Display name (optional)	Show on the "Account" screen	Contract execution (Art. 7, V)	Same
Apple transaction ID (if you subscribe to Pro)	Validate your subscription and grant access to paid features	Contract execution + legal obligation (Art. 7, II and V)	5 years (Brazilian tax obligation)
X OAuth token (if you connect)	Enable access to your X account inside Klyp	Consent (Art. 7, I)	While the connection is active; revoked on disconnect
Apple-declared age range (DeclaredAgeRange) and declaration category for audit	Comply with Brazilian Law 15.211/2025 (ECA Digital) by restricting sensitive content to adults — combined with the App Store 17+ download gate (primary platform check)	Compliance with legal obligation (Art. 7, II) — Law 15.211/2025	While the account is active; we store only the range bracket (e.g., "18+") and the declaration category as an audit signal — never your date of birth
Record of acceptance of the Terms / Privacy Policy (device identifier, accepted version, language, timestamp, app version)	To evidence your consent to the Terms of Use and Privacy Policy (proof of consent)	Compliance with a legal obligation and legitimate interest (Art. 7, II and IX)	For as long as needed to evidence consent; retained even after account deletion, unlinked from your identity
Technical logs (IP address, request ID)	Security, anti-fraud, debugging	Legitimate interest (Art. 7, IX)	90 days
Transactional email (via SendGrid)	Email verification, password reset	Contract execution (Art. 7, V)	30 days (SendGrid logs)
Pre-launch waitlist email (klyp.uk)	Notify you when the app ships to the App Store on 07/01/2026	Consent (Art. 7, I) — opted in by submitting the form	Until launch + 30 days; or until you click "unsubscribe" in the email
Cloudflare Turnstile signals (IP, User-Agent, TLS fingerprint) on waitlist form	Distinguish humans from bots, prevent spam	Legitimate interest (Art. 7, IX)	Processed in real time by Cloudflare; retention per Cloudflare's policy

3. Data we do NOT collect

Important: Klyp does NOT collect or transmit

The videos you download or process. Everything is stored locally on your iPhone — we never upload to our servers.
Audio, transcripts, or generated captions. All computed on-device using Apple Speech and Apple Vision.
Location (GPS, Wi-Fi, IP geo).
Contacts, calendar, photo library. The only Photos permission we use is to save videos to your camera roll — we never read your gallery.
Camera, microphone.
IDFA / advertising identifiers.
Browsing history, web tracking.

4. On-device processing

Klyp uses AI models and media processing exclusively on your iPhone, through Apple's Core ML, Vision, and Speech frameworks. This means:

Downloaded videos never travel through our servers.
Automatic reframe (person and object detection) runs on Apple's chip — no external API call.
Transcripts and captions are generated locally, without sending audio to third parties.
Sensitive content screening (computer vision classifier) also runs 100% on-device. No video frame is sent to us or to third parties for content analysis.
We do not train AI models with your content.

5. Age verification and sensitive content

Klyp operates as a client application of the X platform's API — the decision about which content is available to your session is made by X Corp., according to your X account settings. To comply with Brazilian Law 15.211/2025 (ECA Digital, known as "Lei Felca"), Law 12.965/2014 (Brazilian Civil Internet Framework) and the Child and Adolescent Statute (Law 8.069/1990), we adopt a multi-layer age verification model before processing content that X marks as sensitive:

5.1 App Store 17+ rating (primary platform-level verification)

Klyp is rated 17+ on the App Store. Apple performs objective adult-age verification at download time in Brazil following the post-DECA regulations: a combination of the age declared on the Apple ID, account history, verified payment methods, and the system "Confirm You Are 18+" prompt introduced in 2026.

This means that anyone who installs Klyp in Brazil has already passed Apple's adult-age gate — the verification happens before the app is even available for download. Klyp relies on this platform signal as the primary verification, consistent with Apple's developer documentation guidance ("You are solely responsible for ensuring compliance with associated laws or regulations").

5.2 In-app confirmation via Apple DeclaredAgeRange

As an additional layer, when you attempt to access videos marked as sensitive by X, Klyp asks iOS for the current device's age range via the DeclaredAgeRange API (iOS 26+). We confirm that the returned bracket is greater than or equal to 18 before granting access.

What we collect: only the age range (e.g., bracketMin: 18) and an opaque audit category indicating how the range was declared on the Apple ID. We do not collect your date of birth, identity document, or any biometric data.
Who provides it: iOS returns the data based on the Apple ID configuration — it may have been declared by the holder, by a legal guardian (in Apple family accounts), or confirmed by Apple via card, document, or other method. Klyp receives only the result.
What unlocks access: the bracket must be ≥ 18 years. If it is lower, sensitive content access is denied regardless of any other configuration.
Where we store it: bound to your Klyp account on our server, encrypted in transit (TLS) and protected at rest. Access is restricted to the authenticated backend.
How we revoke it: you can revoke the verification anytime under Account › Privacy; deleting your Klyp account erases the range along with the rest of your data (see section 9).

Legal basis: compliance with legal obligation (Art. 7, II of LGPD), due to the obligation imposed by Brazilian Law 15.211/2025.

5.3 On-device sensitive-content screening

As an additional layer of protection, Klyp may run a computer vision classifier entirely on your iPhone for videos downloaded outside the full adult verification flow. The model is a small neural network embedded in the app that estimates the probability of the video containing sensitive content.

When it runs: in paths where the user has not yet completed all adult verification layers (e.g., cache bypass, race condition). For users with paid Klyp Pro + active Apple DeclaredAgeRange ≥ 18 verification, on-device screening is skipped — the age gate has already been satisfied by the previous layers.
Where it runs: 100% on your iPhone, using Core ML / Apple Neural Engine. No frame is sent to us or to third parties.
What we collect: nothing. The classifier does not send the result, frames, embeddings, hashes, or metadata to any server.
What happens on detection: the video is immediately deleted from your iPhone, the download is aborted, and you receive a message explaining why. We retain no copy.
False positives: AI classifiers are imperfect. If a legitimate video is blocked by mistake, you can report it through the takedown channel for manual review.
CSAM and absolutely prohibited content: regardless of verification status, illegal content can be reported anytime via klyp.uk/takedown with <24h triage SLA and, in CSAM cases, with direct NCMEC cooperation, as required by Brazilian Law 15.211/2025.

This section describes how we handle personal data in these flows. Usage rules (minimum age, allowed content) are in the Terms of Service — section 4.

6. X login (optional)

If you choose to connect your X (Twitter) account — feature available only to paid Pro subscribers — Klyp requests an OAuth 2.0 access token from X with the following scopes:

users.read — read your public profile (username, ID).
tweet.read — read posts (required to process videos from your links).
offline.access — keep access active without prompting login every time.

The token is stored encrypted with AES-256-GCM on our server, isolated per user. Only Klyp can decrypt it, and only for actions you initiated.

We do not post anything on X on your behalf. We do not read your direct messages. We do not access your timeline.

You can disconnect at any time:

Inside Klyp: Account → Integrations → @your_handle → Disconnect X account.
On X directly: twitter.com/settings/connected_apps → Revoke Klyp access.

7. In-app purchases (IAP)

Klyp Pro subscriptions (monthly and yearly) are processed by Apple via StoreKit and the App Store. We never see your payment data (card number, CVV, iCloud account).

What we receive from Apple via server-to-server webhook:

Unique transaction identifier (originalTransactionId)
Purchased product ID (monthly or yearly)
Subscription status (active, expired, in trial, cancelled)
Expiration date

For more information on how Apple handles your payment data, see Apple's Privacy Policy.

8. Sharing with third parties

We share personal data only with providers that make the service possible:

Third party	Purpose	Country
Apple Inc.	Sign in with Apple, App Attest, IAP processing, App Store	USA
X Corp. (Twitter)	OAuth (only if you connect)	USA
SendGrid (Twilio)	Transactional email delivery	USA
Amazon Web Services (AWS RDS)	Database	Brazil (São Paulo)
Cloudflare	CDN, DDoS protection, DNS routing, and bot protection (Turnstile) on the waitlist form at klyp.uk	Globally distributed

We do not sell your data. We do not share with data brokers, advertising networks, or for third-party marketing purposes.

Cloudflare Turnstile (bot protection on the waitlist)

When you submit the waitlist form at klyp.uk, we use Cloudflare Turnstile to distinguish humans from bots. Turnstile collects technical signals from your browser (IP address, TLS fingerprint, User-Agent, and site identifier) that are processed by Cloudflare on our behalf as a data processor.

Legal basis: legitimate interest (Art. 7, IX of LGPD; Art. 6(1)(f) of GDPR) in preventing spam and abusive use of the form.
Cookies: Turnstile uses cookies strictly necessary for bot detection, exempt from prior consent under LGPD and GDPR/ePrivacy.
Limited purpose: the signals are used only to distinguish human traffic from automated traffic — not to identify, profile, or track you.
More details in Cloudflare's official addendum: cloudflare.com/privacypolicy/turnstile/.

International transfers

Some of these providers (Apple, X, SendGrid, Cloudflare) process data outside Brazil. In all cases, transfers are made under the safeguards of Art. 33 of Brazil's LGPD, with standard contractual clauses ensuring an adequate level of protection.

9. Data retention and deletion

See the "Retention" column in the table at section 2 for periods per data type.

You can delete your account at any time inside the app: Account → DANGER ZONE → Delete account.

This action is permanent and cannot be undone, not even by contacting us. After deletion:

Your email, name, and login ID are immediately unlinked.
Your X connection (if any) is revoked instantly.
Your Klyp access on all devices is terminated.
Subscription history is kept for 5 years for Brazilian tax obligation, but unlinked from you to the extent legally possible.

If you want to use Klyp again after deletion, you'll need to create a new account from scratch.

10. Security

Passwords are stored as hashes using the Argon2id algorithm (resistant to GPU and ASIC attacks).
X OAuth tokens are encrypted with AES-256-GCM before being stored.
Client ↔ server communication uses TLS 1.2 or higher.
Apple App Attest verifies that requests come from the authentic app, not from scripts or modified apps.
Database access is restricted to internal IPs of our infrastructure.

No system is 100% immune. If we identify a security incident affecting your data, we will notify you and the relevant Brazilian authority (ANPD) as required by Art. 48 of the LGPD.

11. Your rights (LGPD)

Per Art. 18 of Brazil's General Data Protection Law (Law 13.709/2018), you have the right to:

Confirm whether we process your personal data
Access your data
Correct incomplete, inaccurate, or outdated data
Request anonymization, blocking, or deletion of unnecessary or excessive data
Port your data to another provider
Delete personal data processed with your consent
Obtain information about with whom we share your data
Obtain information about the possibility of not providing consent and its consequences
Revoke consent at any time

To exercise any of these rights, email hello@klyp.uk. We respond within 15 days as required by the LGPD.

You also have the right to file a complaint with the ANPD (Brazilian National Data Protection Authority) if you believe we've violated the law: gov.br/anpd.

12. California-specific rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant the following additional rights:

Right to know: what personal information we collect, use, disclose.
Right to delete: request deletion of your information.
Right to correct: inaccurate data.
Right to opt-out of sale/sharing: We do not sell or share your personal information, so this right is automatically honored.
Right to non-discrimination: exercising these rights does not affect service.
Global Privacy Control (GPC) signal: we automatically respect the GPC signal as required by CCPA (effective from 01/01/2026).

To exercise CCPA rights, email hello@klyp.uk with the subject "California Privacy Request".

13. Minors

Klyp is rated 17+ on the App Store and is not intended for users under 17. We do not knowingly collect personal data from minors.

In compliance with Brazilian Law 15.211/2025 (ECA Digital) and the Child and Adolescent Statute (Law 8.069/1990, art. 18-A), we implement objective age verification through Apple (DeclaredAgeRange) before processing sensitive videos — see section 5. Additionally, we run on-device screening on every downloaded video.

If you are a legal guardian of a minor under 17 who created a Klyp account, email hello@klyp.uk and we will delete the account immediately.

14. Changes to this policy

We may update this policy periodically. The date at the top of this page always indicates the last revision. Material changes affecting the processing of personal data will be communicated 30 days in advance via email (if you have an account) or prominent in-app notice.

15. Contact

For questions, rights requests, or legal matters:

Email: hello@klyp.uk
Postal address:
IPCOM Tecnologia Ltda.
Rua Paraguai, 605, Vivacoworking — Alto Alegre
Cascavel/PR — ZIP 85.805-020 — Brazil