Effective date: the date the Mitty app is first made publicly available on the App Store
Last updated: September 16, 2026
Mitty LLC ("Mitty," "we," "us," "our") is a Wyoming limited liability company. This Privacy Policy explains how we collect, use, disclose, retain, and delete information when you use the Mitty mobile application, the mitty.film website, and related services (together, the "Service").
Related documents: our Terms of Service and our Biometric Data Policy.
Contact: Mitty@mitty.film · (415) 689-3757 · Mitty LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA
Mitty is under active development. This policy describes the categories of information we collect and the purposes we use them for across the Service as a whole, including features available today and features we are building. Not every practice described here is active in every release. What is actually collected from you depends on the features you use, the permissions you grant, and your plan.
Features that require your permission — photo library access, precise location, tracking across other companies' apps and websites, face recognition, and using your content to train AI models — are requested separately and are off until you turn them on. Your permission choices and in-app privacy settings always control what is collected from you, and you can change them at any time.
| Category | Examples |
|---|---|
| Account information | Name, email address, password or authentication token, profile photo, phone number, company or brokerage, job title, and third-party sign-in identifiers (Sign in with Apple, Google) |
| Billing information | Plan, transaction and receipt identifiers, billing history, partial payment details. Full card numbers are handled by Apple or our payment processor, never by us |
| Media | Photos, videos, and audio you grant us access to, upload, import, or connect from other sources |
| Content you create | Ideas, edits, captions, projects, settings, and favorites |
| Communications | Support requests, diagnostic reports, onboarding and survey answers, feedback |
| Team data | Information about colleagues, teams, or clients you invite or share work with |
Analysis of your media — on your device, on our servers, or both — produces:
| Category | Examples |
|---|---|
| Device and app data | Device model, OS version, app version, language, time zone, carrier, storage state, crash and performance logs |
| Identifiers | Account identifiers, installation and vendor identifiers, and the Apple advertising identifier (IDFA) only if you allow tracking |
| Usage and analytics | Features used, screens viewed, session length, generation and export counts, errors, onboarding progress, and referral source |
| Location | Coarse location from IP address; place names derived from media coordinates; precise location only with your permission |
| Advertising and attribution | Which campaign led to your install, conversion events, and interaction with our ads, via measurement partners |
| Cookies and similar technologies | On our website and web features — see Section 9 |
Advertising, attribution, and analytics partners; app stores and platforms; sign-in providers you connect; fraud-prevention vendors; publicly available sources; real estate industry systems you connect; and other users who invite, share with, or refer you.
Mitty performs substantial analysis on your device. Depending on the feature and your plan, media and media-derived information may also be sent to and processed on our servers or by our service providers, including for generating ideas and edits, analysis impractical on a device, backup and sync, rendering and delivery, and abuse prevention.
We ask for your permission before any of the transfers below happens, and we tell you at that moment what is being sent and to whom. Each processor is contractually required to provide protection of your data equal to what this policy promises, and none of them is permitted to use your data to train its own models.
| Who receives it | What we send | Why | When |
|---|---|---|---|
OpenRouter, Inc. (openrouter.ai), which routes the request to the model provider serving the model we have selected — currently an OpenAI GPT-5 series model |
Text descriptions of the media in a session: shot summaries, transcribed speech, timing, place names, and the editing plan. Not the photo or video files themselves. | To generate video ideas, captions, and editing decisions | Each time you ask Mitty to generate an idea or an edit |
Epidemic Sound AB (partner-content-api.epidemicsound.com) |
Music search terms derived from the mood and pacing of your session. When you export a video, also a random identifier created on your device, which track was used, and the fact that an export happened. No media and no descriptions. | To select a licensed soundtrack, and to report track usage as our licence requires | When a video is scored to music, and again when it is exported |
| Apple Inc. (geocoding) | The location coordinates already attached to your photos and videos by the camera | To turn coordinates into a place name the editor can use | When a video idea is prepared from media that carries location |
Telegram Messenger (api.telegram.org) |
A diagnostic report containing the session's media descriptions, transcribed speech, location context, the generated plan, the AI inputs and outputs, and device and app version. No photos or videos. | To let you send us a bug report | Only when you tap "Send debug report." Never automatically |
The random identifier sent to Epidemic Sound is not linked to your name, email, or Apple account, and it is not used for advertising. You can reset it in the app, which ends any connection between past exports and future ones.
If we add, remove, or replace a processor in this list, we update this policy and, where the change is material, ask for your permission again.
Media files themselves. Depending on the feature and your plan, the media files may also be sent to our own servers and to our cloud hosting provider for processing, rendering, backup, and delivery. We tell you which features do this before you use them.
Transmission uses encrypted connections, and stored media is encrypted at rest.
Some features — recognizing the same person across your library, grouping media by who appears, or finding footage of a particular person — use facial recognition and create biometric identifiers and biometric information, including facial geometry ("faceprints").
These features are off by default. We will not collect, capture, or store biometric data until you give separate, express written consent, presented in the app before any collection begins. Our full disclosures, purposes, and retention schedule are in our Biometric Data Policy. In summary:
Your media may contain other people. Under our Terms of Service, you are responsible for obtaining any consent the law requires from them.
Providing results. The Service uses AI on your device and on servers to describe footage, transcribe speech, suggest ideas, write captions, and plan edits.
Training on your content is opt-in. We will not use your media, media-derived data, prompts, or outputs to train, fine-tune, or evaluate AI models unless you turn that setting on. You can turn it off at any time in settings, which stops future use. Content already incorporated into a trained model cannot practically be extracted, and we will say so when you consent.
Never used for training, regardless of your setting: biometric and face data; content in workspaces where an administrator has disabled training; and content we are contractually or legally barred from using.
Human review. Our personnel and contractors may review content, prompts, and outputs to investigate reported problems, improve quality, and enforce our Terms. Access is limited to those who need it.
Accuracy. AI output can be wrong. You are responsible for reviewing anything you publish.
Service providers acting on our instructions under contract: cloud hosting and storage; AI and model providers; music licensors; analytics and crash reporting; advertising, attribution, and measurement; payment processing; customer support; and security vendors. We require each to provide protection of user data equal to what this policy promises.
Advertising and analytics partners. We may share account identifiers, device identifiers, and usage and campaign data to market the Service, measure performance, and build audiences.
A hard limit we apply. We do not use your photos, videos, audio, the descriptions, transcripts, embeddings, or labels derived from them, or any face or biometric data for advertising, marketing, or use-based data mining, and we do not disclose any of it to advertising networks, analytics providers, data brokers, or information resellers. This restriction applies regardless of your other settings.
At your direction — with teams, brokerages, collaborators, and platforms you publish to.
Corporate transactions — in a merger, acquisition, financing, reorganization, or sale of assets, information may transfer as a business asset.
Legal and safety — where required by law or legal process, to enforce our agreements, or to protect rights, property, or safety.
Affiliates — our current and future parents, subsidiaries, and affiliated entities.
Aggregated or de-identified information — with anyone, for any lawful purpose.
Some state laws define "sale" and "sharing" broadly enough to include disclosures of identifiers and usage data to advertising partners. To the extent our practices constitute a sale or sharing of personal information, or processing for targeted advertising, you may opt out.
Opt out by: using "Do Not Sell or Share My Personal Information" in the app's privacy settings or on our website; declining the iOS tracking prompt; emailing Mitty@mitty.film; or sending an opt-out preference signal such as Global Privacy Control (GPC), which we honor on our website as a valid request for that browser.
We never sell or share media, media-derived data, or biometric data — see the limit in Section 7. We do not knowingly sell or share the personal information of consumers under 16.
Sensitive personal information. Precise geolocation and biometric information used for identification are "sensitive personal information" under California law. You may limit our use of it to purposes necessary to provide the Service, using the same controls.
Our website and web features use cookies, pixels, tags, and local storage. Our app includes software development kits from analytics and advertising partners.
App Tracking Transparency. If the Service tracks you across apps and websites owned by other companies, or accesses your device's advertising identifier, iOS asks your permission first. No feature, content, or price depends on your answer. If you decline, we do not access the advertising identifier for that purpose, and we do not use other means to identify your device for tracking.
| Category | Typical retention |
|---|---|
| Account information | While active, plus up to 24 months |
| Media and derived data on our servers | While your account is active, or until you delete the item |
| Deleted content in backups | Up to 90 days |
| Biometric data | Per the Biometric Data Policy — never more than 3 years after last interaction |
| Usage, analytics, advertising data | Up to 25 months |
| Diagnostic reports | Up to 24 months |
| Billing records | As required by tax and accounting law, typically 7 years |
| Marketing contacts | Until you unsubscribe |
Deleting your account. You can delete your account from within the app. You do not need to call us, email us, or visit a website, and we do not offer deactivation in place of deletion.
Deletion removes your account record and everything associated with it — including videos, projects, and content you shared or published through the Service — from active systems promptly, and from backups within 90 days. The only exceptions are records we are legally required to keep: billing and tax records, and records we must retain to comply with a legal hold or an open legal claim. Those are listed with their periods in the table above.
Deleting your account does not cancel an App Store subscription. Apple controls that billing relationship, so cancel through your Apple account settings before deleting, or charges continue.
Data stored only on your device is removed when you delete the app.
In-app controls. Manage permissions, enable or disable features, delete individual items, clear stored analysis, adjust advertising and AI-training preferences, withdraw consent, and delete your account.
US state privacy rights. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have rights to know, access, obtain a portable copy, correct, and delete personal information; to opt out of sale, sharing, targeted advertising, and certain profiling; and to limit use of sensitive personal information. We will not discriminate against you for exercising them. If we deny a request, you may appeal by replying to our decision; if denied, contact your state Attorney General.
Illinois, Texas, and Washington residents: see our Biometric Data Policy for rights concerning biometric identifiers and biometric information.
EEA, UK, and Switzerland. Rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your supervisory authority. Legal bases: contract (providing the Service), consent (photo access, precise location, biometrics, tracking, AI training, marketing), legitimate interests (securing and improving the Service, preventing fraud, marketing our own products), and legal obligation. You may withdraw consent at any time.
How to exercise. Use in-app controls or email Mitty@mitty.film. We respond within the time your law requires, generally 45 days. We may need information to verify your identity. Authorized agents may submit requests with proof of authorization.
We are based in the United States. If you use the Service from elsewhere, your information will be transferred to and processed in the United States and other countries. Where required, we rely on safeguards such as the European Commission's Standard Contractual Clauses.
The Service is not directed to children under 13, and we do not knowingly collect their personal information. Face recognition features are limited to users 18 and older. If you believe a child has provided us information, email Mitty@mitty.film.
We use administrative, technical, and physical safeguards, including encryption in transit and at rest, access controls, and monitoring. No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.
We may update this policy. For material changes we will revise the effective date and give notice in the app, by email, or on our website before the change takes effect. We will not apply a materially different use to information previously collected without your consent.
We collect the categories in Section 2 — identifiers, customer records, commercial information, internet and network activity, geolocation, audio/visual and biometric information, professional information, and inferences — for the purposes in Section 5, retained per Section 10. Some categories may be sold or shared as described in Section 8; media, media-derived data, and biometric data are never among them. To exercise rights, see Section 11.
Mitty LLC, a Wyoming limited liability company 30 N Gould St Ste N, Sheridan, WY 82801, USA Mitty@mitty.film · (415) 689-3757
Mitty@mitty.film is the single contact point for every request under this policy — access, deletion, correction, opting out of sale or sharing, biometric data questions, and appeals.