Last updated: 13 May 2026
This Privacy Policy describes how the ClipBlend application (the "App"), created and made available by Sławomir Toporek, an independent developer of the ClipBlend Android application (the "Controller" or "Developer"), processes personal data of users (the "User", "you") in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and other applicable data protection laws.
The Controller does not sell user data. However, certain data may be shared with service providers (in particular Google Firebase and Google AdMob) for app functionality, analytics, and advertising purposes, as described in this Policy. Under some U.S. privacy laws, such transfers may be considered "sharing". In U.S. states where applicable law provides such rights, you may opt out of the sale or sharing of your personal information (see Section 3.1). The Controller does not share user data with third parties for their own independent marketing purposes.
For certain services (in particular Google Analytics for Firebase and Google AdMob), Google may act as a processor or as an independent controller, depending on the specific service and its use.
For users in the EEA/UK, the mobile App (Android) presents a consent message (CMP via Google UMP SDK) on first launch before analytics and advertising-related processing begins; consent signals are applied through Google Consent Mode. In the mobile app (Android), analytics and ads are not started before the user gives consent in the EEA. The primary product surface is the Android app distributed via Google Play. In production builds, Firebase Analytics collection is disabled until the UMP flow completes (then enabled only if consent status allows).
App navigation (labels in the App): The main bottom tabs are My Videos, Liked, Playlists, Charts, and Create. Account settings, privacy controls, and this Privacy Policy are under Account (open via the account icon, top right).
App account sign-in: To use the App's core features you sign in with Firebase Authentication — either with email and password (minimum eight characters, including at least one letter and one number) or with Continue with Google (Google OAuth for both sign-in and registration). This is distinct from connecting YouTube for API access.
YouTube sign-in for certain tabs: The interactive chart video list in the Charts tab and viewing or reordering videos in the Create tab require you to sign in to YouTube (Google account) in the App.
The controller of your personal data is Sławomir Toporek, an independent developer of the App:
The Controller does not have a tax identification number (NIP) or a company seat. The Controller is also the contact person for all personal data protection matters (no separate DPO appointed).
| Data category | Examples | Source |
|---|---|---|
| Account identification data | Email address, display name, user identifier (UID) | Firebase Authentication — email/password and/or Google Sign-In for the App account (OAuth) |
| YouTube-related data | List of liked videos, playlists and their content, YouTube channel title | YouTube Data API v3 (OAuth) and a local copy in AsyncStorage (keys such as video-storage-{id}-{opaque suffix}) |
| OAuth token security metadata | Server-side token exchange diagnostics, anti-abuse/security event metadata, callable/function verification status | Cloud Functions for Firebase and Firebase Logging/Monitoring (security operations and abuse prevention) |
| Operational limits and reward data | Per-user sync / reward usage counters (abuse prevention) | Firestore (userFetchLimits, per-user users document for rewards and limits) |
| User preferences | Selected theme (light/dark), display settings, and whether to allow library synchronization over a mobile (cellular) data connection | Device (AsyncStorage, usually in the same persisted store as the YouTube cache) |
| Advertising-related data | Google advertising ID (Ad ID), ad interactions, ad-free mode status | Google AdMob SDK |
| Technical data | Device type, OS version, IP address (processed by Google services) | Automatically via SDKs |
| App stability and crash reports | Uncaught JavaScript exceptions, native crashes, ANRs, stack traces, device model, OS version, app version, a stable per-install pseudonymous identifier, and optional non-personal breadcrumb log lines | Firebase Crashlytics SDK in the App. Crashlytics collection is gated by the same consent toggle as Google Analytics for Firebase (GA4) — if you do not accept analytics in the UMP consent flow, no crash data is sent. The App does not place personal data into Crashlytics breadcrumbs. |
| Device region (locale) | ISO 3166-1 alpha-2 region code (e.g. PL, US, GB) | Read on-device via expo-localization to choose the default YouTube Charts list; not sent to the Developer's servers for user identification |
| Network connection type (local) | Whether the device is on Wi-Fi or cellular/mobile data when you start a synchronization | Read on-device via expo-network only when a sync is started, to apply your mobile-data preference; not stored and not sent to the Developer's servers |
| App usage and product analytics | Pseudonymous identifiers (e.g. per-install app user id), session and engagement metrics, feature usage events (e.g. editor actions, Charts interactions, playlist saves, errors, ad and reward-related events), optional coarse country from device locale as user property | Google Analytics for Firebase (GA4) via the Firebase JavaScript (Web) SDK embedded in the mobile App (React Native). Google processes data in accordance with its own Privacy Policy and may act as an independent controller of personal data. The App does not send video files to analytics. |
| On-device analytics flags | Dates and flags used to send one-time lifecycle events — stored in AsyncStorage under keys such as anl_* |
Device (AsyncStorage), read only by the App; not the same as server-side analytics |
Data safety (Google Play): The information in this Privacy Policy is consistent with the Data safety declaration submitted in Google Play Console for this App.
The Controller does not sell user data and does not share it with data brokers. Certain data may be shared with service providers (e.g. Google Firebase and Google AdMob) for app functionality, analytics, and advertising, as described in this Policy.
User data is not shared with third parties for their own independent marketing purposes.
The App does not use advertising identifiers for cross-app tracking in third-party apps.
Analytics and technical data are processed in pseudonymised form and are not directly linked to user identity.
| Purpose | Legal basis (GDPR) |
|---|---|
| Authentication and user account management | Art. 6(1)(b) — performance of a contract (Terms) |
| Access to YouTube data (liked videos, playlists) at your request | Art. 6(1)(b) — performance of a contract; Art. 6(1)(a) — consent (OAuth) |
| Displaying ads (including personalised ads) | Art. 6(1)(a) — consent (UMP / ad consent mechanisms) |
| Displaying non-personalised ads | Art. 6(1)(f) — legitimate interests (supporting a free app model) |
| Storing user preferences (theme, settings, mobile data sync) | Art. 6(1)(f) — legitimate interests (app functionality) |
| Applying the mobile data sync preference (local network check at sync start) | Art. 6(1)(f) — legitimate interests (respecting your connectivity choice; no server transmission) |
| Security and abuse prevention | Art. 6(1)(f) — legitimate interests |
| Default YouTube Charts list (device region) | Art. 6(1)(f) — legitimate interests (convenient default matching your locale) |
| Product and usage analytics (Google Analytics for Firebase (GA4)): understanding how the App is used, improving features, measuring errors and conversion funnels, security signals | In the EEA/UK, the legal basis for Google Analytics for Firebase (GA4) is Art. 6(1)(a) — consent (ePrivacy and national rules on storage/access to information on the device). Consent is collected via the Google UMP SDK (CMP) on first launch, before analytics and ad-related processing begins; where consent is not obtained, Firebase Analytics collection remains disabled in the App. Outside the EEA/UK, where local law permits without prior consent, Art. 6(1)(f) — legitimate interests may apply to pseudonymous analytics. |
| App stability monitoring and crash reporting (Firebase Crashlytics) | In the EEA/UK, the legal basis for Firebase Crashlytics is Art. 6(1)(a) — consent. Crashlytics collection is linked 1:1 to the analytics consent toggle. Outside the EEA/UK, where local law permits, Art. 6(1)(f) — legitimate interests may apply to pseudonymous crash data. |
Processing is based primarily on performance of the contract (authentication, YouTube features), legitimate interests (security, non-personalised ads, and — outside the EEA/UK where permitted — pseudonymous analytics), and consent (personalised ads and Google Analytics for Firebase (GA4) in the EEA/UK).
We use Google's User Messaging Platform (UMP) to request and manage user consent for data processing, including analytics and advertising purposes.
Depending on your location, you may be asked to:
Your choices affect:
You can change your preferences at any time in the App under Account → Privacy Settings, which reopens the UMP consent form.
For users in the EEA, UK, and Switzerland, data processing for analytics and personalised ads is based on your consent (Art. 6(1)(a) GDPR).
For users in certain U.S. states with applicable privacy regulations, you may opt out of the sale or sharing of personal information, as required by applicable law.
If you withdraw consent, the App stops processing data for the affected purposes from that moment onward.
Where supported by Google services, consent choices are communicated using Google Consent Mode signals, including: ad_storage, analytics_storage, ad_personalization, and ad_user_data.
Depending on your consent status, the App may either request ads (personalised or non-personalised), request only non-personalised ads, or not request ads at all.
Before you provide consent, the App does not collect analytics data and does not use data for personalised advertising. Firebase Analytics collection is disabled and no personalised ad request is made until the consent flow is completed.
However, limited technical data may be processed in order to:
This is strictly necessary to comply with consent obligations and is not used for tracking, profiling, analytics, or ad personalisation.
The App uses the following third-party services, which may process your data:
userFetchLimits) and abuse-prevention fields under your Firebase user path (users); when your Firebase Authentication user is deleted using Account → Delete account, related rows in these collections are deleted by automated Cloud Functions cleanup; (ii) public, non-personal documents in the popularVideos collection holding cached YouTube Charts metadata. Those documents are readable by any App installation and do not contain your name, email, or OAuth tokens.youtube.readonly) and does not modify content on your YouTube channel in the current version.video-storage-{user identifier}-{opaque suffix}; the email is not stored in plaintext in the key).Google services (Firebase, AdMob, YouTube API) may process data on servers located outside the EEA, including in the United States. Transfers are based on:
App state is partly stored locally using a persistence mechanism (Zustand + AsyncStorage), including YouTube-related cache and preferences under keys video-storage-{user identifier}-{opaque suffix}.
users and userFetchLimits).video-storage record): may remain on the device after log-out. To permanently remove the local copy: uninstall the App or clear App data in Android settings.video-storage record unless you clear app data or uninstall.Deletion of account data starts as soon as you confirm the action: the Authentication user is removed and Cloud Functions clean linked Firestore rows, subject to propagation and backup delays on Google's systems.
Under the GDPR you have the right to:
Withdrawing consent: where processing is based on consent (personalised ads, Google Analytics for Firebase (GA4), and Firebase Crashlytics in the EEA/UK), you may withdraw consent at any time via the App's consent settings, your device settings, or by contacting the Controller. Crashlytics collection is bound to the same toggle as analytics.
To exercise these rights (except erasure of your App account and linked Firebase / Firestore data, which is available only in the App as described in Section 8), contact the Controller at clipblendapp@gmail.com. The Controller will respond within 30 days where Art. 12(3) GDPR applies.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl.
Instructions for deleting your data are also published as a standalone web page at https://clipblend.com/delete-data.html, linked from the App (Account section) and from the Google Play listing.
The page does not require login or submission of personal data.
The Controller does not keep additional copies of user data outside Google's services used by the App (including Firebase, Google Analytics, AdMob, and Firebase Crashlytics when enabled); all data deletion operations are performed directly in those services.
You have the right to request permanent deletion of your account and all associated personal data held by the Controller. That erasure is performed only inside the App after you sign in, using Account → Delete account. The Controller does not delete Firebase Authentication accounts or linked Firestore data by email — use the in-app flow.
Other GDPR requests (access, rectification, objection, portability, restriction, complaints) may be sent to clipblendapp@gmail.com as described in Section 7.
Note on local AsyncStorage data: data is kept only on the device and is not used by the Controller to identify you. It is not additionally encrypted at the application level (OS sandbox). Remove it by uninstalling the App or clearing app data. Locally stored data is not shared with other apps or transmitted to the Developer's servers.
You can delete or restrict data as follows:
video-storage record from AsyncStorage.Some data may continue to be held by third-party providers in accordance with their own policies (e.g. Google).
The App is not intended for persons under 16 years of age and is not directed at children as the primary target audience. The Controller does not knowingly collect personal data from children. If you believe a child has provided data through the App, contact clipblendapp@gmail.com.
Personal data collected through the App is not used for automated decision-making or profiling within the meaning of Art. 22 GDPR. Standard ad personalisation by third-party providers (Google AdMob) is governed by those providers' policies and your consent choices.
The Controller applies appropriate technical measures to protect personal data, including:
The mobile App does not use cookies in the traditional web sense. However, it uses technologies with similar purposes, including:
For users in the EEA, UK, and Switzerland, analytics and advertising technologies are only activated after consent is obtained via the Google UMP consent flow (see Section 3.1).
The Controller may update this Privacy Policy. Material changes will be communicated via an in-app notice or by updating the date at the top. Please review this Policy periodically.
For questions about this Privacy Policy or processing of personal data: