Privacy Policy

Last updated: September 10, 2026

This Privacy Policy describes how we collect, use, and share information when you use the Alakazam application ("App") and our website at luma.website (the "Website"), including any demonstration of our service offered there. By using the App or the Website, you agree to the practices described in this policy.

Who We Are

Alakazam is made by Luma, the trading name of Rasmus Linnemann, an independent developer based in Copenhagen, Denmark ("we", "us", or "our"). Luma is a trading name rather than a registered company, so the person legally responsible — and the data controller for the personal information described in this policy, meaning the one who decides why and how it is processed — is Rasmus Linnemann.

You can reach us about anything in this policy at support@alakazamapp.com.

Our postal address is Kløverbladsgade 13, 2500 Valby, Denmark.

Links You Submit

Alakazam works by taking a link to a video clip and finding the longer video it came from. You can submit links from YouTube — both Shorts and full-length videos. Search results always point to YouTube videos.

When you submit a link, we retrieve basic public details about that clip — its title, description, the account that posted it, and when it was published. We use this to search for the original video and for nothing else. We do not download, store, or republish the video or audio itself, we do not read or transcribe what is said in it, and we do not access private, restricted, or follower-only content.

Information We Collect

We collect the following types of information:

Account information: When you create an account, we collect your email address, and your name and profile picture where your sign-in provider supplies them. You can sign in with Google or with Apple. If you sign in with Apple and choose to hide your email address, we only ever receive Apple's private relay address, not your real one. We never see or store your password — authentication is handled entirely by Google or Apple.
Searches: The links you submit, when you submitted them, the results we returned, which result you opened, and whether you marked a result as right or wrong. This is what the Recent list in the App is built from.
Usage counters: A count of how many searches you have run in the current period, so we can apply the allowance your subscription includes.
Subscription and purchase data: If you subscribe, we record which plan you are on, whether it is a free trial, whether it is active, cancelled or lapsed, when the current period ends, the identifier Apple gives the product and the identifier Apple gives the transaction, and whether the purchase came from Apple's live or test environment. We keep this so we know what you are entitled to and so we can help you when a purchase goes wrong. We never see or store your card details or your Apple ID — Apple takes the payment and tells us only whether it succeeded.
Technical telemetry: For each search, how long it took, which stage it reached, whether it succeeded, and how many calls it made to each of our providers. We use this to keep the service fast and to control what it costs to run.
Notification tokens: If you allow notifications, your device gives us an Apple Push Notification service token so we can update the Live Activity on your Lock Screen when a search finishes. It identifies a device, not a person, and it is deleted when the search job ends or when you delete your account.
Diagnostic data: When the App or our servers hit an error, we record what went wrong so we can fix it: the error and where in our code it happened, your device model, operating system version, and App version, and a short trail of the actions leading up to it (for example, "opened Recent", "started a search"). This is attached to your account identifier so we can tell one person hitting a problem repeatedly from many people hitting it once. Because your device has to connect to our crash reporting provider to send a report, that connection can reveal your IP address, and an approximate location such as your city or country may be derived from it. We have asked the provider not to store IP addresses. We do not send the contents of your requests or the links you search to our crash reporting provider.
Usage analytics and session recordings: We record how the App is used so we can see where it is confusing and fix it: which screens you visit and in what order, when you start, cancel or complete a search, which platform a link came from, whether you opened one of the results and which position it was in, and whether you told us the match was right. This is attached to your account identifier. We also record a replay of your session — a series of screenshots of the App as you used it — in which the thumbnail of any video we matched for you, and anything you type, are masked out before the recording leaves your device, so the recording shows how you moved through the App but not the links you searched, the videos you matched, or anything you typed. As with diagnostic data, sending this reveals your IP address to our analytics provider, from which an approximate location such as your city or country may be derived. We never send the links you search, your email address, or your name.
Feedback you give us: When we ask whether we found the right video, we record your yes-or-no answer against your account so we can measure and improve how accurately we match clips. Separately, we may ask how you are finding the App in general; that answer, and anything you write if you tell us it could be better, is sent to our analytics provider along with your account identifier rather than stored with your account. The written box is optional and free-form — please do not put anything in it you would not want us to read.
Website usage: On the Website we record which pages you visit, and a replay of your visit in which all text, all images and everything you type are masked out before the recording leaves your browser — including anything you enter into a demonstration of our service. We do not create a profile for you from Website visits, and you do not need an account to use the Website. As above, your IP address is revealed to our analytics provider by the act of sending this, and an approximate location may be derived from it.

We do not collect personal information through YouTube API Services. Video metadata and search result data retrieved via the YouTube API is cached on our servers to improve performance, but this cached data is not linked to individual user accounts.

We do not use advertising identifiers, we do not track you across other apps or websites, and we do not build advertising profiles.

Why We Use It, and Our Legal Basis

If you are in the European Economic Area or the United Kingdom, data protection law requires us to have a legal basis for each use. Ours are:

To provide the App — creating your account, keeping you signed in, running your searches, showing your history, and applying the allowance your subscription includes. Legal basis: performance of a contract with you.
To sell and manage your subscription — recording what you bought, giving you the access you paid for, ending it when it lapses, and helping you when a purchase goes wrong. Legal basis: performance of a contract with you.
To send you notifications about your own searches — the Lock Screen Live Activity and its completion update. Legal basis: your consent, given through the iOS notification permission prompt, which you can withdraw at any time in iOS Settings.
To keep the App working and improve it — diagnosing faults, measuring accuracy, preventing abuse, and controlling what the service costs to run. Legal basis: our legitimate interests in operating and improving a service people can rely on, balanced against your interests — which is why diagnostic reports carry an account identifier rather than your email, and never the links you search.
To comply with the law — responding to valid legal process and keeping records we are required to keep. Legal basis: compliance with a legal obligation.

We do not make decisions about you by purely automated means that produce legal or similarly significant effects.

YouTube API Services

Alakazam uses the YouTube API Services provided by Google to power video search and discovery features. By using Alakazam, you are also subject to the YouTube Terms of Service and Google's Privacy Policy.

We use YouTube API Services to search for candidate videos and to retrieve public details about them — titles, channel names, durations and publication dates. We store that information on our servers only for as long as the YouTube API Services Developer Policies allow, and we do not use it to build a profile of you.

You can revoke Alakazam's access to your data at any time through the Google security settings page at myaccount.google.com/permissions. You can read more about how Google handles data at policies.google.com/privacy.

Google Sign-In

If you sign in with Google, we receive only your email address, your name, and your profile picture. We ask for no other access to your Google account — we cannot see your Gmail, your Drive, your contacts, or your YouTube account.

Alakazam's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How We Share Your Information

We do not sell your personal information, and we do not share it for advertising. We share it only with the providers we need to run the service, and only for that purpose:

Authentication and database: We use Supabase for sign-in and to store your account and search history. See Supabase's Privacy Policy.
YouTube / Google: Search queries and video requests are transmitted to YouTube API Services as necessary to fulfil your requests. This is governed by Google's Privacy Policy.
Text analysis: To work out what a clip is about and which video it came from, we send the public details of the clip and of the candidate videos — titles, descriptions, channel names and publication dates — to OpenAI. Only those details are shared — never your account, your email address, or your search history. OpenAI does not use data submitted through its API to train its models. See OpenAI's Privacy Policy.
Crash reporting: Diagnostic data described above is sent to Sentry, which stores it for us so we can find and fix faults. It is stored on servers in the European Union. Sentry receives your account identifier but never your email address, your name, or the links you search. See Sentry's Privacy Policy.
Usage analytics: The usage data and masked session recordings described above are sent to PostHog, which stores them for us so we can see how the App is used and improve it. They are stored on servers in the European Union. PostHog receives your account identifier but never your email address, your name, or the links you search. See PostHog's Privacy Policy.
Notifications: To update the Live Activity on your Lock Screen we send your device token and the finished state of your search to the Apple Push Notification service. See Apple's Privacy Policy.
Payments: Subscriptions are sold and charged by Apple, which handles your payment details itself and never passes them to us. See Apple's Privacy Policy.
Subscription management: We use RevenueCat to read the state of your subscription from Apple and tell our servers what you are entitled to. RevenueCat receives your account identifier and the purchase details Apple returns — never your email address, your name, or the links you search. See RevenueCat's Privacy Policy.
Hosting: Our servers and our website run on infrastructure providers who store data on our behalf and act only on our instructions.
Legal requirements: We may disclose information if required to do so by law or in response to valid legal process.

These providers process data on our behalf under contracts that oblige them to protect it and to use it only for the purposes we set.

Where Your Data Is Processed

Your account, your search history and our diagnostic data are stored in the European Union — our database is hosted in Frankfurt, Germany, our crash reporting uses Sentry's European region, and our usage analytics and session recordings use PostHog's European region.

Some of the providers listed above operate outside the European Economic Area, including in the United States. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or by an adequacy decision, together with the technical measures described in this policy — most importantly that we send those providers a link, or public details about a video, and not your identity.

Cookies and Device Storage

The App stores your authentication session and your preferences in your device's own storage so you stay signed in between launches. This is not used for advertising and not shared with anyone.

Our website, where these documents are published, sets no advertising or cross-site tracking cookies. The internal area we use to operate the service sets a session cookie for the people who administer it.

Data Retention

We retain your account information — including your email address, your name, your search history and your subscription record — for as long as your account exists, and delete it when you delete your account. What survives deletion in de-identified form is described under "Deleting Your Account" below.

Server-side caches of YouTube video metadata (titles, channel names, durations, and similar publicly available data retrieved via the YouTube API) are automatically deleted or refreshed before they are 30 calendar days old, as the YouTube API Services Developer Policies require, and are not linked to individual user accounts.

Diagnostic reports are kept by our crash reporting provider for a limited retention window and are then deleted automatically. Usage analytics and session recordings are kept by our analytics provider for a limited retention window and are then deleted automatically; session recordings are kept for a shorter period than usage events.

Your Rights

If you are in the European Economic Area or the United Kingdom, you have the following rights over your personal information. They apply wherever you live if you ask us — we do not intend to run two standards.

Access — ask what we hold about you and get a copy.
Rectification — have inaccurate information corrected.
Erasure — have your information deleted. You can do this yourself at any time; see "Deleting Your Account" below.
Restriction — ask us to pause processing while a dispute is resolved.
Portability — receive the information you gave us in a machine-readable form, or have us send it elsewhere.
Objection — object to processing we carry out on the basis of our legitimate interests, including our use of diagnostic data.
Withdrawing consent — turn off notifications at any time in iOS Settings. This does not affect anything done before you withdrew it.

To exercise any of these, email us at support@alakazamapp.com. We will respond within one month. We will not charge you or treat you differently for asking.

If you think we have handled your information badly, you can complain to a data protection authority. Ours is the Danish Data Protection Agency, Datatilsynet, and you may also complain to the authority where you live.

If you are in the United States, note that we do not sell your personal information and do not share it for cross-context behavioural advertising, as those terms are used in state privacy laws. The rights above are available to you on request.

Deleting Your Account

You can permanently delete your account at any time from Settings → Profile → Delete account in the App. You may also request deletion by contacting us at the address below.

When you delete your account, we permanently erase all personal information we hold about you. This includes your email address, your name, your profile picture, the link between your account and the sign-in provider you used (Google or Apple), and the store identifiers that tie a subscription to your Apple ID. This cannot be undone, and we cannot restore a deleted account.

We keep a de-identified record of the searches made from the account — the links searched for, when, and whether a match was found — and a de-identified record of the subscription itself: which plan it was, and when it started. Both are held against a randomly generated identifier that is no longer connected to you or to any other information we hold. We use the first to understand how the App is used in aggregate and to improve its accuracy, and the second because a business has to be able to account for what it earned. Because we no longer hold any means of connecting either to you, these records do not identify you.

Deleting your account does not cancel your subscription. Only Apple can do that. Cancel it in Settings → your name → Subscriptions before you delete your account, or Apple will keep charging you for a service you can no longer reach.

If you would prefer that these de-identified records be erased as well, contact us at the address below and we will remove them.

Security

Everything travels between the App and our servers over an encrypted connection, and your data is stored on managed infrastructure with access restricted to the people who operate the service. We never see your password, because sign-in is handled by Google or Apple, and we never handle your payment details.

No service can promise perfect security, but if a breach ever affected your personal information we would tell you and the relevant authority as the law requires.

Content Creator Data Requests

Alakazam's search results may surface publicly available metadata about YouTube videos and channels, retrieved via the YouTube API, and our cache may hold that publicly available metadata for the videos that users have searched for. If you are a creator or account owner and would prefer that we do not store data associated with your account or your content, you are welcome to contact us and request deletion. We will process such requests and remove the relevant cached data as soon as possible, and within 7 calendar days of receiving your request.

Please note that deleting data from Alakazam's cache does not affect your content on YouTube itself. To manage that, please use YouTube's own tools or contact them directly.

Children's Privacy

The App is not directed to children. You must be at least 13 to use it, and older if the country you live in sets a higher age for consenting to online services on your own. We do not knowingly collect personal information from children below that age. If you believe we have, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page, and — where the change materially affects your rights — inside the App. Your continued use of the App after changes are posted constitutes your acceptance of the updated policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us at:

support@alakazamapp.com