CAPTD is operated by Marco Obinu, a sole trader based in Ireland, at 9 Old Court Mill, Tallaght, Dublin, Ireland. We are the data controller for personal data collected through this platform. For any privacy-related questions contact us at captionflow.app@gmail.com.
2. What Data We Collect
CAPTD does not require signup, login, or an email address to use the Free plan. When you first use something that needs it — opening a workspace, uploading or generating, trying a sample, one of the AI photo tools, or starting a checkout — an anonymous session is created in your browser to let the service work; simply reading our pages does not create one. No personal identity is attached to it unless you contact us, make a purchase, or create an account. We collect the following:
An anonymous session identifier (no email or password required)
Images and videos you upload for content generation
Text descriptions and voice transcripts you provide
Photo EXIF metadata (camera make/model, lens, focal length, aperture, ISO, shutter speed and date taken, if present in the file) is read directly in your browser when you upload a photo, and is never stored. It stays in your browser session unless you choose Engage → Behind the shot in the Snapshot workspace: then the camera details you leave in its card (you can edit or remove each one first) are sent to Gemini with that one generation request — never GPS or location. The free EXIF Viewer tool reads the same technical fields but never reads GPS coordinates, and the photo never leaves your browser.
Place suggestions. A suggested place can come from the photo's location data (GPS) or from what is visible in the photo. If a photo contains location data, CAPTD reads it in your browser and turns it into a nearby place name using an offline city list. The coordinates never leave your device and are never stored. The place is only used if you tap Use; you can turn suggestions off with the "Suggest places from my photos" setting. If you accept it, the place name goes into your place field or notes and into the content generated from them, and it is kept like other generated text. You can also type a place yourself in the optional "Where was this taken?" field.
Places recognised from the photo. When the first photo of a post (or one frame of a video) has no location data and place suggestions are on, CAPTD sends a small copy of it — its metadata removed — to Gemini after the upload, only to ask whether it shows a well-known landmark or city. Videos are first checked for location data in your browser, the same way as photos. The answer is a guess, shown to you as a suggestion labelled "Recognised from the photo"; it is not stored, and the place is only used if you tap Use. We don't identify people and we don't use facial recognition. Turning off "Suggest places from my photos" stops this. So the same photo is never sent twice, your browser remembers each answer on your device (in its IndexedDB storage, at most 500 answers, keyed by a fingerprint of the small copy, never the photo itself); nothing about it is stored on our side.
Metadata removal. All photo and video metadata — including GPS location — is removed before any photo or video is uploaded to our storage or sent to Gemini.
Business details for Get clients. Business details you save for Get clients, a mode of the Spotlight workspace (what you shoot, where you're based, how people book you and anything you ask to always mention) are stored with your account or in your browser, sent to Gemini only with a generation request, and you can edit or clear them at any time.
If you use the Spotlight workspace, the business details you enter in the marketing profile fields (target audience, product or service, campaign goal, key message, call to action, offer, and brand tone) — used only to shape the wording of that generation
If you upload an episode recording in the Spotlight workspace's Episode mode: the audio file and its transcript. The audio is stored in a private part of our file storage (Supabase) only while it is handed to our AI provider (Google Gemini) for transcription: it is deleted from our storage as soon as Gemini has it, and from Gemini as soon as the transcription succeeds or fails. The transcript (what was said, with speaker labels and timestamps, and any names or corrections you make) is sent back to your browser and, when you generate a pack from it, saved with that pack in your history. We also keep a technical record of each upload — its size, length, format, status, the packs charged and the AI usage it took — with no audio or transcript in it, for billing and to make sure the clean-up happened. A recording usually contains other people's voices and words too: you may only upload one you have the rights to and the consent of everyone who can be heard in it (see our Terms, section 9)
Other ways to give Episode mode an episode, each ending in the same transcript: a recording you make in the browser with “Record audio” (handled exactly like an uploaded file, above); a video (MP4, MOV), whose audio is taken out in your browser — only that audio is uploaded, handled exactly like an uploaded file, and the video itself never leaves your device; a subtitle file (SRT, VTT or TXT), which is read in your browser and never uploaded — only the transcript text is sent when you generate; or an episode imported from the public RSS feed of a podcast you own or are authorised to use. For an import, our server fetches the feed address you paste and the chosen episode's public audio file, then handles that audio exactly like an upload (stored briefly, transcribed, deleted). The podcast host sees a request from our server, not from you. With the upload record we keep the episode audio's web address and host, so the import can resume and we can measure how imports work; no feed content is kept
Clips, audiograms and quote cards: made entirely in your browser from your episode's file and its pack — the video, the audio and the finished files are never sent to us or to any AI service. If you accept analytics, we only record that one was made, with its format, length and whether captions and clean audio were on
Spotlight templates you save (your own instructions for how each output should be written) — kept with your account until you edit or delete them
Chat with your episode: the questions you ask about an episode pack and the answers, which are written by our AI provider from that pack's transcript only. They are saved with the pack in your history, and you can clear the conversation or delete the pack at any time. Translations of a pack you ask for are saved with it in the same way
If you use the AI Photography Assistant's Composition Analysis, Scene Recognition or Editing Suggestions tools, the photo you upload for that analysis — deleted from our storage as soon as the result is generated, and never kept in your generation history — plus a record that you gave consent before that photo was processed (your account identifier, which of the three tools, and a timestamp; not the photo itself, and never updated or deleted, so it stands as proof consent was given). Every other photo tool on the site — the Assistant's browser-only analysers and settings recommender, the Metadata Stripper in Photographer Utilities and the Batch Photo Watermark in Photography Business Tools — runs entirely in your browser: the photo is decoded and analysed on your device, is never sent to us or to any AI service, is not stored, and no consent record is created. Each of those tool pages says so on the page itself. The EXIF Viewer and Metadata Stripper never read a photo's GPS coordinates at all. The business templates (model release, contract, quote, questionnaires) are filled in and turned into PDFs in your browser too; the business name, email and address you type there are kept in your browser's local storage so they're filled in next time, and are never sent to us. The free audio tools (the loudness meter, the track and episode ready checkers, Audio Polish and the others) decode, measure and process audio files in your browser the same way: the audio is never sent to us or stored. So do the music release tools: the Spotify Canvas and lyric video makers read your video, song and images and encode the new video on your device, and the checklist and EPK you fill in are kept in your browser's local storage only. The social media tools work the same way: captions, comments pasted into the giveaway picker and links you build are processed on the page and never sent to us, and the content calendar you plan is kept in your browser's local storage only. The image tools (sizes, grid, collage, before-and-after, thumbnail checker) open, crop and combine your photos and encode the video on your device; the photos are never uploaded. The selling tools and the photography checklists work the same way: the batch resizer resizes photos on your device, and the product descriptions, vendor credits, wedding timeline and the items you add to a checklist are kept in your browser's local storage only.
Voiceover recordings you make to preview a generated caption, used to help tailor future caption suggestions to your natural speaking style — recordings made in the Spotlight workspace are excluded from this and are not used to build that profile
Generation history and usage statistics, tied to your anonymous session
Reviews you choose to leave: the rating, your text, the date and whether you ticked "I received free access to CAPTD" are shown on our reviews page, never your name or email. That page explains how reviews are collected and checked.
Name and email address if you submit our contact form (see Third Party Services below)
Your answer to the optional question after your first export, and your email if you choose to leave one (see "Feedback after your first export" below)
If we gift you access (a promo grant): the email address it is for, the access it gives (a plan or a number of credits) and when it expires — so the access is applied when you sign in with that email
Payment information when you buy a plan, pack or add-on, processed by Lemon Squeezy as our merchant of record (see Third Party Services below) — we never see or store your card details
Device and browser information for security and analytics
IP address for fraud prevention and service delivery
Feedback after your first export (optional). The first time you copy or export a Content Pack, we may ask one optional question: "What were you trying to post?". If you answer, we store your answer (up to 200 characters), the workspace and platform you were using, the date, and your anonymous session identifier in our own database. This is something you choose to send us, so it is stored whatever you chose on the cookie banner; our analytics only record whether you answered and whether you left an email, never the answer or the email itself. Leaving your email is optional: we use it only to ask you one follow-up question about your answer, and we never share it or add it to a mailing list. The legal basis is your consent. Answers are deleted automatically after 12 months, and we delete the email once we have asked our follow-up question, or after 90 days at the latest. To have your answer or email deleted sooner, use "Delete my data" (see Your Rights Under GDPR below) or email captionflow.app@gmail.com.
Anonymous export count. Each time a Content Pack is copied or exported, we add one row to a simple tally in our own database: the workspace, the platform and the date — nothing else. It contains no account or session identifier, no IP address, no cookie and no device or browser information, and it cannot be linked back to you, so it is recorded whatever you chose on the cookie banner and sets no cookie. We use the totals only to see how many Content Packs are used each day and week.
3. Content Pack History (Optional)
CAPTD offers an optional History feature that lets you save and revisit your previously generated Content Packs across devices. This feature requires creating an account — email and password, or signing in with Google — it is entirely optional and is not required to use CAPTD's core generation features. When you sign in with Google, Google shares your name, email address and a unique account identifier with us so we can create and recognize your CAPTD account — we never see or store your Google password.
If you choose to sign up, any Content Packs you generate — including any generated before you signed up, using your anonymous session — become linked to your account and are saved to your History.
What we store: the Content Pack itself (caption, description, hashtags, and other generated fields), the workspace and platform it was generated for, and the date of generation. We do not store additional data beyond what's needed for this feature to work.
How long we keep it: your History is retained until you delete individual entries yourself, or until you delete your account, whichever comes first. We do not set an automatic expiry on History data beyond that.
Your control: you can delete any individual History entry at any time. Deleting your account removes your entire History along with it. This is in addition to the data rights already described in Section 9 (Your Rights Under GDPR) of this policy, including your right to access, export, or request erasure of your data at any time.
Access: your History is private to your account — only you can view it. We apply technical access controls (row-level security) to ensure no other user, including other CAPTD users, can access your History data.
4. How We Use Your Data
To provide and improve the CAPTD service
To respond to messages sent through our contact form
To track usage and enforce plan limits fairly
To detect and prevent fraud or abuse
To analyse how the app is used and improve features, including by watching anonymised session recordings of the interface (only if you accept analytics and session-recording cookies — see Cookies and Session Recordings below)
To credit the creator whose link brought you here if you buy (affiliate referral tracking — only if you arrived through a referral link and accept cookies; see Cookies below)
We do not sell your personal data to third parties. We do not use your uploaded content to train AI models.
5. Legal Basis for Processing
We process your data under the following legal bases as defined by the EU General Data Protection Regulation (GDPR):
Contract: processing necessary to provide the service you use — including place suggestions (Art. 6(1)(b) GDPR): the location-data lookup runs on your device, a place recognised in the photo is asked of our AI provider, and you control both with the "Suggest places from my photos" setting — and transcribing an episode recording you upload, record in the browser or import from your podcast's feed in Episode mode, which you start yourself after confirming you have the consent of everyone in it; and keeping your Spotlight templates and episode chats so you can use them again
Legitimate interests: fraud prevention, security, and service improvement; and gifting promotional access (promo grants), for which we keep the recipient's email address, the access given and its expiry
Legal obligation: compliance with Irish and EU law including tax obligations
Consent: for optional analytics, affiliate referral tracking and marketing communications
6. Data Retention
Uploaded photos and videos are automatically deleted no more than 90 days after upload — this runs automatically in the background and does not require you to do anything. Photos you open in the browser-only tools — every photo tool except the three AI-vision ones — are never uploaded, so there is nothing for us to retain or delete. Generated text (captions, descriptions, hashtags and the rest of your generation history) is kept for as long as your anonymous session or account is active, since it has no comparable storage-size or sensitivity concern and you may want to refer back to it. Composition Analysis, Scene Recognition and Editing Suggestions in the AI Photography Assistant go further still: those photos are deleted immediately once the analysis result is generated, not kept for 90 days like other uploads.
Chat conversations, translations and the transcript are kept with their episode pack until you delete that entry from your history (a cleared conversation keeps no words, only the count of questions already asked); templates until you delete them; all of it is deleted with your account.
A promo grant (its email address, access and expiry) is deleted when the grant expires, or sooner if you ask us to.
Episode recordings are not kept at all once transcribed: the audio is deleted from our storage as soon as it has been passed to Google Gemini, and the copy in Gemini is deleted as soon as the transcription succeeds or fails. If a transcription is interrupted (for example, the page is closed mid-way), a daily automatic check deletes anything left over that is more than 24 hours old — so in the worst case a recording is held for up to about 48 hours. The transcript is kept with the pack it was used for, like other generated text, until you delete that entry from your history or delete your account.
Coordinates from a photo's location data never leave your device and are never stored. A place you accept, or type in the "Where was this taken?" field, is sent with that generation; the field itself isn't saved, but the content generated with it is kept like other generated text — see What Data We Collect above.
Anonymous visit counts (see "Anonymous visit counts" under Cookies) are kept for up to 12 months.
Anonymous sessions that never generated anything are deleted automatically, together with everything linked to them (including any uploaded file), once they have had no activity for 30 days. A session with generations, a review or a purchase, or one linked to an email address, is never deleted this way.
Answers to the optional question after your first export are deleted automatically after 12 months; an email left with one is deleted once we have asked our follow-up question, or after 90 days at the latest.
You can delete all of your data immediately and permanently at any time yourself — see "Erasure" under Your Rights Under GDPR below — rather than waiting on a manual request. If you'd still prefer to reach us directly, contact us at captionflow.app@gmail.com and we will remove it within 30 days, except where retention is required by law such as for tax records.
7. Third Party Services
We use the following third party services to operate CAPTD:
Supabase: database, authentication, and file storage — including, briefly, episode recordings uploaded for transcription (see Data Retention)
Vercel: website hosting and delivery — processes IP addresses and request data to serve the site
Google Gemini: AI content generation, landmark place suggestions, and — only if you choose to use Composition Analysis, Scene Recognition or Editing Suggestions in the AI Photography Assistant — photo analysis for those three tools specifically, and, in Episode mode, the transcription of episode recordings (through Gemini's Files API; the file is deleted there once the transcription ends), answers in “chat with your episode”, translations of a pack and suggested speaker names. We use Google's paid Gemini API. Under Google's terms, prompts, images and responses are not used to improve Google's products or to train its models; Google keeps them for a limited period only, to detect abuse and to meet legal requirements. Processing is covered by Google's Cloud Data Processing Addendum, which includes Standard Contractual Clauses for transfers outside the EEA.
Resend: delivers messages submitted through our contact form to our support inbox, and sends the automatic confirmation reply back to you — your name, email address, and message are sent to this provider for that sole purpose
Lemon Squeezy (payments): Purchases are processed by Lemon Squeezy, which acts as our merchant of record and handles checkout, payment, invoicing and sales tax. When you buy, Lemon Squeezy receives your name, email, billing address and payment details; CAPTD never sees or stores your card details. We receive your email, order details and an anonymous account ID so we can add your credits. See Lemon Squeezy's privacy policy for how they handle your data. Lemon Squeezy also runs our affiliate program: if you arrive through a creator's referral link and accept cookies, see "Affiliate referral tracking" under Cookies below.
PostHog: product analytics (page views and feature usage) and session recordings (see Session Recordings below), hosted on PostHog's EU Cloud in Frankfurt, Germany. PostHog only runs in your browser — with its cookies, the identifier that recognises your browser across visits, and session recordings — if you agree to analytics; without that, our server sends PostHog only anonymous totals of page loads and caption generations — see "Anonymous visit counts" under Cookies below
Google Sign-In: only if you choose to sign in with Google to use the optional History feature (see Content Pack History above) — distinct from Google Gemini above, which is unrelated to sign-in
Google Forms (optional survey): We run an optional photographer survey using Google Forms. Answers are anonymous unless you choose to leave your email, which is used only to send you a thank-you code and is deleted within 30 days. Google provides the form service under its own terms and privacy policy.
Supabase, Vercel, Resend, PostHog and Google (Gemini API, paid tier) process data on our behalf under data processing agreements. Lemon Squeezy, as merchant of record, and Google Forms handle data under their own privacy policies.
Fonts, images and scripts on our pages are served from our own servers (hosted by Vercel). Before you make a cookie choice nothing is loaded from any other company, except Supabase — our database, sign-in and file storage provider — when you use a feature that needs it. PostHog and Lemon Squeezy's affiliate script load only after you agree to them; Google Sign-In, the Lemon Squeezy checkout and Google Forms only when you choose to use them.
8. International Transfers
Our hosting functions run in the European Union (Dublin, Ireland). Where another provider processes data outside the European Economic Area, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the European Commission.
Analytics and session-recording data processed by PostHog is stored in the European Union (PostHog EU Cloud, Frankfurt, Germany) and is not transferred outside the EEA.
Place names from GeoNames (geonames.org), licensed under CC BY 4.0. The list is shipped with the site and used on your device; it is not a service your data is sent to.
Access: request a copy of all personal data we hold about you
Rectification: ask us to correct inaccurate data
Erasure: delete your personal data immediately yourself, right now, with the button below — or request deletion by contacting us instead, if you'd rather
Portability: receive your data in a machine-readable format
Objection: object to processing based on legitimate interests
Restriction: ask us to limit how we use your data
To exercise any of the other rights above contact us at captionflow.app@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission of Ireland at dataprotection.ie.
10. Cookies
CAPTD uses three categories of storage technology (cookies and similar browser storage such as localStorage):
Essential: required to keep your anonymous session working once you use a feature that needs one, to remember your cookie choice and when you made it, and to keep settings you choose yourself (such as the content language, the theme, or dismissing the "Add to Home Screen" prompt). These cannot be switched off and do not require consent under applicable law. Nothing is stored just because you visited a page.
Anonymous visit counts (no cookies): if you decline or don't choose, nothing analytics-related runs in your browser. Our server counts page loads and caption generations as anonymous totals. For a page load it records only the page and the campaign tags in the link (for example utm_source=instagram) — not the website you came from, your device or your browser. For a caption generation it records only which workspace, content language and platform were used, whether a photo was included, and whether it started from the homepage. No IP address, identifier or cookie is used or stored for these counts, and nothing links one page load to another or to you. PostHog (EU Cloud, Frankfurt, Germany) receives only those totals. They are kept for up to 12 months.
Analytics and session recordings (PostHog): off by default. When you agree — Accept on the banner, or the analytics switch in "Cookie preferences" — PostHog sets its own cookies and/or local storage to recognise your browser across visits, measures page views and feature usage, and records how you use the interface (mouse movement, clicks and pages visited — see Session Recordings below for exactly what is and is not captured). You can change your choice at any time with the button below or the "Cookie preferences" link in the footer — just as easily as you gave it; switching analytics off clears it immediately and stops any recording. We ask again every 6 months; until you answer, your earlier choice stays in force.
Affiliate referral tracking (Lemon Squeezy): only if you arrived through a creator's referral link (an address ending in ?aff= followed by a code), and only after you agree to it — Accept on the banner, or the affiliate switch in "Cookie preferences"; you can agree to analytics without it, or to it without analytics. Lemon Squeezy's affiliate script then sends Lemon Squeezy the referral code, the page address, the page you came from and a fingerprint of your browser (a code worked out from your browser's settings and features), and stores a cookie called ls_aff_ref on this site for 30 days holding an ID for that visit. If you buy within those 30 days, the checkout link carries that ID so the creator who referred you is credited with the sale. It is used to attribute the sale and pay the creator's commission, not to show you ads. Until you choose, the referral code is held only in your browser's memory for that page. If you decline, nothing is loaded or stored and the referral is not credited. Withdrawing your choice deletes the cookie.
If you accept analytics, we also record which link brought you to the site, using the campaign tags in the address (for example utm_source=instagram), so we can see which channels work. Before you accept, those tags are held only in your browser's memory for that page and are discarded if you close or reload the tab; they only reach our analytics as part of the anonymous totals described above.
Home-screen app. We count installs of the CAPTD home-screen app with the device type only (for example "Android phone"). If you agreed to analytics, a random install ID is made on your device and kept there so the same install is never counted twice; if not, nothing is made or stored on your device and the install is counted without any ID. Nothing is written to your device for the "Add to Home Screen" prompt until you use it; your answer (for example "Not now") is then kept in your browser's local storage and never sent to us.
Interrupted uploads. While you are choosing or uploading a photo, CAPTD keeps a short note in your browser's local storage saying which step you were on, which page you were on and when. It holds nothing else (no photo, file name or personal data). It is deleted as soon as the step finishes or you leave the page normally, and it expires after 10 minutes: an expired note is ignored and removed the next time you open CAPTD. It exists only so that, if your phone reloads the page in the middle of an upload (which happens most often inside the Instagram, TikTok and Facebook apps), we can tell you what happened instead of showing an empty page. It is essential to that feature and does not depend on your cookie choice. The note itself never leaves your device; if you have accepted analytics, we also record that an upload was interrupted, and at which step and page, so we can find and fix what causes it.
Theme. If you pick Light or Dark, that choice is kept in your browser's local storage on this device so the site opens in the same theme next time (System, the default, stores nothing); it is never sent to us.
We do not use advertising cookies, and no third party tracks you on this site for advertising. The only third-party tracking is Lemon Squeezy's affiliate referral tracking described above, and it runs only if you came through a referral link and accepted.
11. Session Recordings
If you accept cookies on the banner, we use PostHog's session replay to record how the CAPTD interface is used. A recording is a reconstruction of the page built from the structure of the interface — not a video or screen capture — and shows mouse movement, clicks, scrolling, the pages visited and how the layout changed. We watch these to find where the app is confusing or broken.
What is not captured. Masking runs inside your browser, before anything is sent, so the following never reach PostHog:
Anything you type into any field, including caption edits, the context box, sign-in email and password, and the contact form (every input is masked)
Your content in the workspaces: generated captions, hashtags, alt text, scripts, hooks, previews and your generation History are masked as text
Uploaded photos and videos, thumbnails, slides and any other image, video, canvas or embedded frame — these are blocked and appear as empty boxes
Names of the files you upload, the email address shown in your account menu, and the contents of dialogs, menus and notifications
Browser console output and the details of network requests
Consent. Recording requires your consent under the GDPR (Article 6(1)(a)) and the Irish ePrivacy Regulations (S.I. No. 336 of 2011, Regulation 5(3)). Nothing is recorded until you press Accept on the cookie banner. Declining, or never choosing, means no recording: PostHog is then not loaded in your browser at all (page loads are only counted as anonymous totals on our server — see "Anonymous visit counts" above).
Retention. Recordings are deleted automatically 30 days after they are made.
Processor. PostHog, Inc. processes recordings on our behalf under a data processing agreement. Recordings are stored in the European Union (PostHog EU Cloud, Frankfurt, Germany) and are not transferred outside the EEA.
Withdrawing consent. Use the button in the Cookies section above or the "Cookie preferences" link in the footer of every page. Withdrawing stops recording immediately, removes the PostHog cookies and local storage from your browser and shows the banner again; recordings already made are deleted at the end of the 30-day retention period. To have them deleted sooner, contact us at captionflow.app@gmail.com.
12. Data Breach Notification
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission of Ireland without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly, without undue delay, by email or via an in-app notice, describing the nature of the breach and the steps we're taking in response.
13. Children
CAPTD is not intended for users under the age of 18. We do not knowingly collect personal data from children. If you believe a child has used CAPTD please contact us immediately at captionflow.app@gmail.com and we will delete their data promptly.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via an in-app notice (and by email where we have your email address) at least 14 days before the changes take effect. Continued use of the service after that date constitutes acceptance of the updated policy.
15. Contact
For any privacy-related questions or to exercise your rights please contact us at captionflow.app@gmail.com