Privacy Policy

1. Who we are

aCaad ("aCaad", "we", "us") operates the aCaad service at acaad.app, this site at about.acaad.app, and the related apps and APIs. aCaad lets you create personalized digital cards, called moments, that combine your text, images, music, voice recordings, animations and particle effects, share them by link, and download them as video.

For anything in this policy, you can reach us at privacy@acaad.app.

2. What we collect

Content you create

The heart of aCaad is the content you put into a moment: the message you write or record, photos you upload, the music you pick or generate, the design choices you make, and the name of the person it is for if you choose to add one. We collect it because without it there is no card.

Guest tokens instead of identity

You do not need an account. When you create without one, we issue a random guest token that is stored on your device. It links your drafts and cards together so you can come back to them, and it carries no name, email or phone number. If you later sign up, cards made under your guest token can be claimed into your account.

Account information, if you sign up

An account is optional. If you create one we collect your email address, a password (stored only as a secure hash) or your sign-in from a provider such as Google, and the settings you choose. Accounts add convenience: cross-device sync, a dashboard, higher limits.

Usage and device information

Like most services we receive basic technical data when you use aCaad: IP address, browser type, device type, pages viewed and actions taken (for example that a moment was played), and error reports when something breaks. We use per-IP counters to enforce fair-use quotas for anonymous creation.

3. Your voice and voice cloning

Voice is what makes aCaad personal, so it gets its own section.

Voice recordings

When you record a voice note for a moment, the recording is stored with that moment and played to the people you share it with. It is processed to sync playback with the card (for example word-by-word highlighting) and to mix it into the downloadable video.

Voice cloning

If you choose the voice cloning feature, your voice sample is processed by a specialist third-party speech provider acting on our behalf to build a synthetic voice that reads your message. This happens only when you explicitly start it, never silently. Three rules apply:

• We only build a clone from a sample you provide for that purpose, with your consent.
• You may only clone your own voice, or the voice of someone who has given you their permission. Cloning someone without their permission breaks our Terms of Service.
• You can delete a voice clone at any time, and we remove it from our systems and instruct our provider to do the same.

We do not use your voice, cloned or recorded, to train machine learning models, and we do not sell it to anyone.

4. How we use information

We use the information above to:

• Create, play, share and render your moments, including producing the video download you request.
• Keep your drafts and cards connected to you, whether through a guest token or an account.
• Send the emails you ask for, such as sign-in codes, share notifications and reminders. Every email includes a working unsubscribe link.
• Protect the service: rate limits, abuse and bot detection, and security logging.
• Understand, with your consent, how the product is used overall so we can improve it.
• Meet legal obligations when they apply to us.

We do not sell personal information, and we do not show third-party advertising inside moments.

5. AI features

Some optional features, such as message suggestions, voice cloning, synthetic narration and background music generation, are powered by specialist third-party AI service providers acting on our behalf.

Content is shared with these providers only when you use the matching feature, and only the content that feature needs: the text you ask for help with, the voice sample you choose to submit, or the music style you pick. Our providers are bound by contractual confidentiality and data protection obligations, may process your content solely to provide the feature to us, and are not permitted to use it for their own purposes, including training their models.

A current list of the subprocessors we work with is available on request at privacy@acaad.app.

6. Cookies, analytics and consent

acaad.app shows a cookie banner and honors it strictly. We use Google Analytics 4 with Consent Mode v2, which means analytics, advertising and personalization storage are all denied by default. Nothing beyond strictly necessary storage is set until you choose to allow it, and IP addresses are anonymized.

• Strictly necessary: security, consent choices, your theme, your guest token. These keep the service working and cannot be switched off.
• Analytics: only if you accept, to understand aggregate usage such as which features are used and where the flow loses people.
• Functionality and personalization: only if you accept, to remember preferences beyond the essentials.

You can change your mind at any time from the cookie settings link in the app footer. This about site itself sets no analytics cookies at all.

7. Bot protection (Cloudflare Turnstile)

To keep anonymous creation free without letting bots abuse it, we use Cloudflare Turnstile, including its invisible mode, on actions such as rendering a video. Turnstile evaluates limited device and browser signals to tell humans and automated traffic apart, without tracking you across the web and without showing you puzzle CAPTCHAs.

Turnstile is operated by Cloudflare, Inc. and processes this data as described in the Cloudflare Turnstile Privacy Addendum, which supplements the Cloudflare Privacy Policy. Because we use the invisible widget mode, this notice serves as the disclosure that Turnstile may run on a page even when no challenge is shown.

8. Security and where your data lives

Your data is stored on secure infrastructure located in the European Union and delivered worldwide through a global content delivery network, so moments load quickly wherever they are opened.

We protect it with industry-standard safeguards: all traffic between you and aCaad is encrypted in transit with TLS, access to production systems is restricted and logged, media is stored in access-controlled object storage, and backups are taken regularly. Like every honest company, we cannot promise that no incident will ever happen; if one occurs that affects your personal data, we will notify you and the relevant authorities as the law requires.

Where we rely on service providers for hosting, delivery or email, they act under contracts that limit their processing to providing the service to us. Categories of recipients include: hosting and storage providers, content delivery and security providers, email delivery providers, AI service providers (section 5), analytics providers (section 6), and gift card partners (section 10).

9. Who can see a moment

Moments are unlisted, not public. Each one lives behind a share link with a hard-to-guess address. We do not publish a directory of moments, and search engines are not invited to index them. Anyone who has the link can open it, so treat the link like the card itself: give it to the people it is for.

When you share a link into a chat app, that platform may fetch a small preview (title and image) to display it. That preview comes from us; what the platform does with it is governed by the platform's own policy.

10. Gift cards

You can attach a gift card to a moment. Gift cards are issued and fulfilled by third-party merchants and gift-card providers, and payment happens with those providers, not on our servers: we do not collect or store your full payment card details. We keep the details needed to attach the gift to the right moment and show its status. Some gift links are affiliate links, which means aCaad may earn a commission at no extra cost to you.

11. How long we keep things

• Moments and their media stay available so the people you shared them with can keep replaying them, until you delete the moment or ask us to.
• Drafts that never become a shared moment are kept under your guest token or account so you can finish them, and may be cleaned up after long inactivity.
• Voice clones exist until you delete them or your account.
• Account data is deleted when you delete your account, except records we must keep briefly for security or legal reasons.
• Server logs and quota counters are short-lived and rotate automatically.

12. Your rights and choices

Wherever you are, we extend the same core rights, including those under the GDPR if they apply to you:

• Access and export: ask for a copy of the data we hold about you. Registered users can export their data from account settings.
• Correction: fix inaccurate account information.
• Deletion: delete a moment, a voice clone, or your whole account. Guests can contact us with the share link to have a moment removed.
• Consent withdrawal: change cookie choices at any time, and stop voice cloning by deleting the clone.
• Objection and complaint: object to processing, and if we do not resolve your concern, complain to your local data protection authority.

To exercise any of these, email privacy@acaad.app. We answer within 30 days.

13. Children

aCaad is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us at privacy@acaad.app and we will delete it.

14. International transfers

aCaad serves creators and viewers worldwide, so data crosses borders: our servers are in the European Union and our delivery network is global. Where personal data is transferred internationally, we rely on our providers' safeguards, such as standard contractual clauses, and keep transit encrypted.

15. Changes to this policy

When we change this policy in a meaningful way, we will update the date at the top and, for significant changes, tell you inside the app before the change takes effect. Earlier versions are available on request.

16. Contact us

Privacy questions: privacy@acaad.app
Everything else: hello@acaad.app