Privacy Policy

Who we are

Act It Up is operated by EveeShare LLC. If you have a question about this policy or want to exercise any of the rights below, write to privacy@actitup.app.

Information you give us

Practice takes stay on your phone unless you post one

A take you keep privately rather than posting is written to your device and nowhere else. Keeping a take uploads nothing, and there is no record of it on our servers. The one thing the app tells us is the date you first finish a take, with nothing about the take itself, so we don't send a reminder to someone who has already recorded. The only way one leaves your phone through the app is if you choose Post on it yourself: a copy is then uploaded and published like any other take, and the one in your locker stays where it is.

The trade-off is stated rather than hidden: those files are excluded from iCloud backup, so a new phone starts with an empty locker, and deleting the app deletes them. Deleting your account deletes them too. A note you write on a take, and any slate details, are held the same way.

If you save one to your camera roll or send it somewhere, that copy is then yours, and what happens to it is outside the app. One you post is a take like any other, covered by the rest of this policy.

Information collected automatically

Usage and analytics

We record events about how the app is used — that an account was created, that a performance was watched or reported, that a permission prompt was answered, how far through a video someone got. These are tied to your account so we can tell returning use from new use.

Analytics are processed by PostHog on their US cloud, which means this data is stored in the United States.

On our website

On actitup.app we count page views, note when you close the page so we can tell how long a visit lasted, and count a few named clicks, such as the “Book a day” button on the sponsors page, and a few named actions in the web feed, such as posting a take or buying Coins, also with PostHog. If the website's own code fails, we also send PostHog a report of the error: what went wrong and on which page, so we can fix it. The website sets no cookies and stores nothing on your device for this, does not build a profile of you, and does not connect your visit to an Act It Up account, even when you are signed in. If your browser sends a Do Not Track signal, nothing is recorded.

The one thing the website does collect is what you type into it. If you join the waitlist, the email address you enter goes to Kit, the mailing service that holds the list, sends the launch email, and provides the unsubscribe link in it. It is stored in the United States. We use it to tell you when the app is available and for nothing else, it is not connected to any Act It Up account, and you can unsubscribe from any message we send.

If you open a creator’s invitation link to Act It Up and then start creating an account, the website remembers that creator’s username on your device for up to seven days, so the sign-up can finish if you leave and come back. Nothing is stored just for opening the link. When the account is made, we note on it which creator’s link you used, so we can tell creators how many people they brought, and the website forgets the username. We also count that sign-up in PostHog under the creator’s username, with nothing about you. The note is deleted with your account.

What the website stores on your device

Only what it needs to do what you ask, so it asks for no consent and shows no cookie banner:

• Your sign-in, while you are signed in to the web feed, so you stay signed in. Signing out removes it.
• Video cookies, while you are signed in, so the takes you choose to watch can play. They expire within an hour.
• Teleprompter settings, if you change them in the web recorder.
• A creator’s username, as described above, only once you start creating an account from their link.
• Stripe sets its own cookies when you buy Coins, to check the payment for fraud, and Apple or Google may when you sign in with them.

No advertising or tracking cookies, and nothing for the analytics above.

Connection and server logs

Like any service on the internet, ours sees the IP address your device connects from, along with the request it makes, the app version, and the operating system. Our hosting and video delivery keep these records for a short period so we can find faults, block abuse, and tell where a security problem came from. We do not use them to build a profile of you, and we do not look up your location from them.

Device and delivery

If you allow notifications, we store a push token for your device so we can send them. We also record view counts and watch time on performances, which is what ranks the feed and what a creator sees on their own posts.

What creators see about their viewers

When you watch someone's performance, we add you to a count. Creators with a Pro subscription can see those counts as a breakdown of their audience: age ranges (13–17, 18–24, 25–34, 35–44, 45+), genders, the region your device is set to, and where the view came from — the feed, a profile, a shared link, a notification, or a challenge page.

Creators never see who you are. They see totals and percentages across everyone who watched, never a list of viewers, never an individual, and never your exact age — only which range you fall into. Nothing identifies you to the person whose take you watched.

Nothing is shown until at least 20 people have watched. Below that a breakdown would describe individuals rather than an audience, so no chart appears at all.

We do not look up where you are. The app asks for no location permission and receives no location from your phone. The region above is the one your phone is configured for in iOS Settings, which you can change there. The one exception is advertising: Google's ad service sees the IP address an ad request comes from, and may estimate a general area, such as a city or region, from it.

Advertising

The app shows ads through Google AdMob, including an optional rewarded video you can watch to restore a lost streak. Google may collect device and usage information to select and measure ads, and the app registers Apple's SKAdNetwork identifiers so advertisers can measure installs without identifying you.

Meta. So that Meta can measure whether an ad led to an install, the app includes Meta's SDK. It runs only for adult accounts, and only after the tracking question above has been asked. It is never started for an account under 18. It reports that the app was opened, and shares Apple's advertising identifier only if you allowed tracking.

TikTok. For the same purpose, the app includes TikTok's SDK, under the same rules: adult accounts only, only after the tracking question has been asked, and never for an account under 18. It reports that the app was installed and opened, and shares Apple's advertising identifier only if you allowed tracking. It is not told about purchases.

Under-18 accounts never get personalised ads. Your date of birth decides this, not a setting: an account under 18 is flagged to Google as below the age of consent, every ad request for it is marked non-personalised, and the ads it can be shown are limited to Google's most restrictive content rating. It is not offered the consent choice below, because a “yes” from a 13-year-old is not consent worth having.

Where the law requires consent — the EEA, the UK, and applicable US state privacy laws — that choice is presented to adults through Google's consent form before personalised ads are requested. You can change it at any time from the privacy options in the app. On iOS you will also be asked separately whether the app may track you across other companies' apps and websites; declining does not stop you using anything in Act It Up.

Device permissions

Each is requested when the feature that needs it is first used, and each can be refused or withdrawn in iOS Settings.

• Camera and microphone — to record performances. Nothing is captured outside a recording you started.
• Photo library — to save a performance you have recorded, if you choose to, and to add a photo or video you pick yourself, such as a profile photo, a headshot, an intro video or a coach's tip. We receive only what you pick. We do not read your library.
• Speech recognition — for the teleprompter to follow along while you perform. This runs entirely on your phone. The app requires on-device recognition, and where a device cannot do it — a language with no downloaded model, or a first run before it arrives — the prompter scrolls on a timer instead. Your voice is never sent to us or to Apple for this.
• Notifications — for reactions, comments, follows, and gifts. Each type can be turned off individually in the app.
• Tracking — asked only for advertising, as described above.

Purchases and creator payouts

Coins are bought through Apple's in-app purchase. Apple processes the payment and we never see your card or billing details — we receive only a signed receipt confirming a purchase happened.

Coins can also be bought on actitup.app. There, Stripe sells them as the merchant of record: you give your payment details, email address and billing address to Stripe directly, on Stripe's checkout page, and we never see your card. Stripe tells us which pack was bought, by which Act It Up account, the amount, and whether the purchase is later refunded or disputed. We keep that record to credit your coins and to handle refunds. Stripe's own privacy policy covers what you give it.

Act It Up Pro is an auto-renewing subscription, also bought through Apple. We record that your account has Pro, which plan, when it renews, and Apple's identifier for the subscription — which is how a refund from Apple can be matched back to it, and how a subscription stays with the one account that bought it. Subscription records are also processed by Adapty, which handles the receipts and tells us when Apple reports a renewal or a refund.

Creators who reach the payout minimum are paid through Stripe Connect. Stripe collects the identity and bank details required by law directly from the creator, on Stripe's own pages. That information never passes through our servers. We store only the resulting Stripe account identifier, whether Stripe has approved it for payouts, and a record of each payout.

People under 18

Act It Up is not for children under 13, and we do not knowingly collect information from them. If we learn that an account belongs to someone under 13 we delete it.

For creators aged 13 to 17, the date of birth you give us drives protections that apply automatically: limits on how long the app can be used in a day, blocked overnight hours, and restrictions on parts of the app. We record that these protections were applied so we can tell they are working.

A creator under 18 cannot be paid directly. Stripe requires a parent or legal guardian to complete identity verification and to own the account the money is paid into. The guardian's information is collected by Stripe, not by us.

Classes and coaches

An acting coach can run a class on Act It Up, and students join it in the app with a code the coach gives them. Classes are for people 18 and over.

What a coach sees about a student: the same public profile anyone sees (display name, username, photo, bio, links, current streak and public takes), the takes the student posts to that class, and when they joined. A coach never sees a student's email address, date of birth, gender or messages. When someone under 18 tries to join, the coach sees only how many were turned away, never who.

Takes posted to a class are visible only to that class and its coach, unless you also post them publicly. If you leave a class, your takes leave its feed. Feedback a coach leaves on a take is private between the coach and the student who posted it. It is kept as a record, even if it is taken back, so a report about it can be reviewed, and it is deleted with the take.

Act It Up staff can also see a class's takes, its assignments and the feedback on its takes when that is needed for safety, moderation or support, and we keep a record of each time they do. Staff can only look; they cannot post, reply or change anything in a class.

Coaches. To run classes, a coach sends us their class or studio name, roughly how many students they teach, a short description, and optionally a link and a teaching email address, which a person at Act It Up reads to decide. A coach can also fill in a profile on the coach website: studio, website, bio, city, how and what they teach, and languages. We plan a public directory of coaches; a coach appears in it only if they turn that on, and it is off until they do. A coach can ask our AI model (Amazon Bedrock, in our AWS account) to write practice scenes in their teaching style. What they describe is used only to write their scenes, and none of it is used to train a model.

Coaches pay for their plans on the coach website through Stripe, which collects their card details directly; we never see them. We keep a record of each class's membership changes and of decisions about each coach, for three years, so that anything that happened in a class can be looked into later.

How we check what is posted

Every video is screened automatically before it is published. Still frames are sampled from it and analysed by Amazon Rekognition, an AWS service, for nudity, sexual content, violence and hate symbols. If it is flagged, the video is not published — it is held for a person to look at instead.

Only images are analysed. Audio is never transcribed and never analysed, so nothing you say is processed by that system.

Comments and direct messages are not scanned. Nobody reads your messages, automatically or otherwise, unless somebody reports one. A report sends us the reported message and a copy of the messages immediately before it — the part the person reporting could already see — and nothing else from the conversation.

We may also access messages where the law requires it, or where we have a specific reason to believe someone is at risk of serious harm.

A report can be in a language the reviewer does not read. They can then have the reported text, and the messages sent with it, translated into English by an AI model that runs in our AWS account (Amazon Bedrock). Only what the report contains is translated, the translation is not stored, and none of it is used to train a model.

Automated screening is not perfect, in either direction. Reports are read by a person, which is how something it missed gets removed and something it flagged wrongly gets published. Content that is removed is kept on our side so a decision can be reviewed; it is no longer visible in the app.

What is and is not allowed is set out in the Community Guidelines.

Who else receives your information

We do not sell your personal information. We share it only with the services that make the app work:

We may also disclose information where the law requires it, or where it is necessary to investigate a safety report or protect someone.

Sponsored scenes

On a small number of days the scene is paid for by a company, as described in the terms. This changes nothing about what we collect or who receives it.

Sponsors receive no personal information. They are not given your name, your username, your account details or your performance, and they have no access to the app's data. Any reporting we provide to a sponsor is aggregate, such as how many people performed that day.

A sponsored scene carries no advertising trackers. The label is drawn by the app from the challenge itself, not served by an advertising network, so seeing one involves no request to a third party and no identifier being shared.

Public and private

Your username, display name, bio, profile photo, links, published performances, captions, comments and reaction counts are visible to everyone, in the app and to anyone a performance is shared with. When you share your profile, the link shows only your username to someone without the app; your profile itself opens only in the app.

Your email address, date of birth, and payout details are never shown to other users. Your gender is not shown either, unless you are 18 or over and turn on showing it on your profile, which you can turn off again at any time. Your date of birth and gender do contribute to the anonymous, aggregated audience counts described above, where they appear only as a range and a percentage across at least twenty people.

How long we keep it

Account information and content are kept while your account exists. When you delete your account, your content stops being served immediately and the underlying records are then permanently removed, including your bio, links and, for a coach, their coach profile and request to coach. Some records are kept longer where we are required to — payout and transaction records in particular, which financial regulations oblige us and Stripe to retain — or where they are a safety record: the class membership and coach decision history described above is kept for three years. Analytics events already recorded are retained in aggregate. If you tell us why you are leaving when you delete your account, we keep the answer without anything that links it to you or your account.

Two things we cannot reach into. Phones keep video and images they have already downloaded, so a copy may remain in another person's app storage until their device clears it, and anything saved or re-shared by someone who saw it is beyond our control. Content removed for breaking the rules is hidden from the app immediately and then kept, so the decision can be reviewed and so a repeated pattern can be seen. It goes when the account does: deleting your account removes it with everything else.

Your choices

• Delete your account — from Settings, in the app. A real deletion, not a deactivation. See the account deletion page.
• Change ad consent — through the privacy options in the app, at any time.
• Notifications — turn each type off in Settings, or all of them in iOS Settings.
• Reminder email — in Settings → Notifications → Email, or with the unsubscribe link in it.
• Permissions — camera, microphone, photos, speech and tracking can all be withdrawn in iOS Settings.
• Block and report — any account or performance, from the app.

Depending on where you live you may also have the right to access, correct, export, or delete your personal information, to object to some processing, and to appeal a refusal. Write to privacy@actitup.app and we will respond within the time the applicable law allows. We will not treat you differently for exercising any of these rights.

If you live in California

We do not sell your personal information, and we never have. If you are an adult and you consent to personalised advertising, the device and usage information Google collects for that purpose counts as “sharing” for cross-context behavioural advertising under California law.

You can stop it at any time: open Settings → Privacy options in the app and withdraw consent, which is our “Do Not Sell or Share My Personal Information” mechanism. Nothing else in the app changes when you do. We never share the personal information of anyone under 18 for advertising, whatever they choose.

You may also ask us to tell you what we hold, to correct it, to give you a copy, or to delete it, and to appeal if we refuse. Write to privacy@actitup.app. We will not treat you differently for asking.

If you live in Brazil

The Brazilian General Data Protection Law (LGPD) applies to how we handle your information, and EveeShare LLC is the controller.

Our data protection officer (encarregado) can be reached at privacy@actitup.app. Write there to exercise any of the rights below, or with any question about your data.

We process your information on these legal bases:

• To perform our contract with you — your account, the performances you post, purchases, Pro and creator payouts.
• To meet legal and regulatory obligations — tax, accounting and payout records in particular.
• Our legitimate interests, weighed against yours — keeping the service secure, preventing fraud and abuse, moderating content, and understanding how the app is used.
• Your consent — personalised advertising, tracking across other companies' apps, and notifications. You can withdraw it at any time, and doing so does not affect what was done before.

For anyone under 18, we process data in their best interest, which is what the protections described above are for.

You may ask us to confirm whether we process your data; to access it; to correct data that is incomplete, inaccurate or out of date; to anonymise, block or delete data that is unnecessary, excessive or processed unlawfully; to receive it in a portable form; to delete data processed with your consent; to know who we share it with; to know what happens if you do not consent; and to withdraw consent. You may also object to processing, and you have the right to complain to the National Data Protection Authority (ANPD).

Your information is transferred to the United States, where we and our providers store it, because that is where the service runs. The transfer is made so we can provide the service you ask for, and our providers are bound by contract to protect the data they handle for us.

If you live in Mexico

Under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, the party responsible for your personal data is EveeShare LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. We use it for the purposes described in this policy. Running your account, publishing your performances, processing purchases and payouts, and keeping the service safe are necessary to provide it. Personalised advertising is not, and you can refuse it at any time from the privacy options in the app.

You have the right to access your personal data, to rectify it, to cancel it and to oppose its use (your ARCO rights), and to revoke your consent. To exercise any of them, write to privacy@actitup.app with your name, the email address on your account, and what you are asking for. We may ask for information to confirm it is you, and we will respond within the time the law allows. Deleting your account from the app is also always available.

Security

Data is encrypted in transit and at rest. Video is served behind signed, expiring credentials issued to the app, so it cannot be played or linked to from outside it. Access to production systems is restricted and audited. No system is perfectly secure, and we will tell you if a breach affects you and the law requires it.

International transfers

We operate from the United States and our providers store data there. If you use the app from outside the US, your information is transferred to and processed in the US.

Changes

If we change this policy in a way that materially affects you, we will say so in the app before the change takes effect. The date at the top always reflects the current version.