Privacy Policy

1. Who we are

MockMyApp is published by New Age Devs, the trading name of Md. Imam Hossain, an individual developer based in Bangladesh. We are the data controller for the personal data described in this policy.

• Email: imamagun94@gmail.com
• Post: Bangladesh

2. What this policy covers

This policy covers the MockMyApp apps, the web app at app.mockmyapp.com, the website at mockmyapp.com, and the MockMyApp cloud service behind sign-in, cloud AI and purchases.

MockMyApp is a design tool for app-store screenshots. Most of it runs entirely on your device. A few features are optional and work over the internet: signing in, buying a plan or credits, and cloud AI. This policy is organised the same way: first what happens without an account, then what changes when you use each optional feature.

3. Using MockMyApp without an account

You do not need an account to design, export, or use the AI built into your device. Without one, MockMyApp sends us nothing: no analytics, no crash reports, no usage events and no identifier of ours.

3.1 What stays on your device

MockMyApp stores the following locally, in the app's own storage on your device:

How to remove it. Deleting a project removes that project and its layout. It does not delete the images that project used, because the same image can be used by more than one project. Imported images are removed individually from the app's image library, and added font files from the font picker. Signing out removes the sign-in session. Uninstalling MockMyApp removes everything at once, subject to your platform's own backups (section 3.3).

3.2 Photos, camera and files

• Choosing an existing image. MockMyApp opens your platform's own picker and receives only the files you select in it. It cannot browse your library, and it does not scan, index or catalogue your photos.
• Taking a photo. The camera opens only when you tap that option, and the photo is handed straight to the app. There is no background or continuous camera access.
• Saving. Exported images are saved to your photo library, your Files or Downloads location, or handed to the system share sheet, always because you tapped export or share.

On iOS and macOS this is why the app asks for photo library and camera permission. On Android, saving uses the system MediaStore. You can decline or revoke these permissions in your device settings. MockMyApp keeps working, but importing, capturing or saving images will not.

3.3 Backups

If your platform's backup is on, such as Google One backup on Android, iCloud Backup on iOS or Time Machine on macOS, your device may include MockMyApp's local files in that backup. On Android this is on by default. Those backups belong to your platform account and are governed by Google's or Apple's privacy policy, not by us. You can turn app backup off in your device settings.

4. Services your device contacts without an account

Even without an account, your device talks to two kinds of third-party service. Neither involves us receiving anything.

4.1 Google Fonts and Google's web resources

MockMyApp offers typefaces from the Google Fonts library, both for your captions and for the app's own interface. The first time a typeface is needed, it is downloaded from Google's servers (fonts.googleapis.com and fonts.gstatic.com) and cached on your device. The typefaces the app's own interface and its templates use are built into the app, so nothing is downloaded at launch; a download happens when you pick another typeface for a design, or open the store preview. On the web, the app's graphics engine may also be loaded from www.gstatic.com.

As with any web request, Google receives your IP address and standard request information, such as the file requested and your user-agent. No part of your project, no image and no caption text is sent. Google handles these requests under its own privacy policy at policies.google.com/privacy.

4.2 AI that runs on your device

MockMyApp can suggest captions, translate them, and read the words on a screenshot, all on your device and free, with your device's own software:

• iPhone, iPad and Mac: Apple Intelligence (the Foundation Models framework), Apple Translate and Vision.
• Android: Gemini Nano, through Android's AICore, and Google's ML Kit for translation and text recognition.
• The web: your browser's built-in AI, where it has one.

Your screenshots, captions and projects are processed on the device, and these features send them to no one: not to us, not to Apple, not to Google. Where a device has no on-device model, suggestions come from a list built into the app.

Two things do reach someone else's server:

• Language packs. The first time you translate into a language, your device may download that language's model, from Apple or from Google. Apple Intelligence and Gemini Nano are system components your device downloads and updates itself.
• ML Kit diagnostics, Android only. Google's ML Kit sends Google diagnostic and usage information: device and app information (such as the model, operating system and app version), an installation identifier, performance metrics, the features and languages used, and error codes. It does not include your images or your text. Google describes it at developers.google.com/ml-kit/android-data-disclosure. We receive none of it.

5. Your account

You need an account only for cloud AI and for purchases, so that your plan and credits follow you to every device. MockMyApp asks you to sign in the first time you use one of those, never before.

How you sign in. With Google or with Apple, through Firebase Authentication, a Google service. On Windows and Linux, the app opens your browser to sign in, and the browser hands a one-time code back to the app over a connection that stays on your computer. MockMyApp starts Firebase, and the genuine-app checks described below, only when you first sign in, so none of them runs if you never do.

What we receive and keep:

• your email address, or the private relay address Apple gives us if you choose Hide My Email;
• a user ID that Firebase creates for you, and the account ID of the provider you signed in with;
• when the account was created and last used;
• the country your requests come from, worked out from the connection, which we use for regional pricing, tax and fraud checks.

Firebase may also record the name and profile picture address your Google account shares. We do not copy them into our own records or use them. Google processes your IP address and device or browser information to secure sign-in, under the Firebase terms (firebase.google.com/support/privacy).

Checking the app is genuine. Requests to our cloud service carry a token from Firebase App Check, which asks your platform to confirm that the request comes from a genuine copy of MockMyApp on a genuine device: Play Integrity on Android, App Attest or DeviceCheck on Apple devices, and reCAPTCHA on the web. Apple or Google evaluate signals about your device or browser to issue that token. We receive a pass or fail, not a device identifier. This is what stops free credits from being farmed by scripts.

One free trial per person. To stop the free trial and welcome credits being claimed again by deleting and re-creating an account, we keep a one-way code derived from your sign-in provider's account ID (a keyed hash). It cannot be turned back into your identity or your email address, and it is kept for two years, including after you delete your account.

6. Cloud AI

6.1 Only when you ask, only after you agree

Cloud AI writes store copy and captions, translates, and makes backgrounds, panoramas and icon concepts. It never runs in the background. It runs only when you tap a cloud AI action, and only after you have agreed to it in a consent screen in the app that names the companies involved: Amazon Web Services (Amazon Bedrock), Anthropic and Stability AI. You can turn cloud AI off in the app's settings at any time, and the on-device features keep working.

6.2 What is sent

Each action sends only what that action needs. Depending on the action, that is:

• the text you type or have in the project: your app's name, its description, your brief or instructions, and the captions or store copy to work on;
• the text your device read off your screenshots, on the device, using the features in section 4.2;
• the target store, language and image size, and your design's colours;
• for Remove background, the one image you pick, because that is the job.

Screenshots are not sent unless you turn that on. A separate setting, off by default, lets cloud AI see your screenshots themselves, scaled down, for better analysis and copy. With it off, only the text read on your device goes up.

Never sent: your other projects, your photo library, files you did not pick, your contacts or your location. With each request we also receive your user ID, your app version and platform, the App Check token, and your IP address, which is part of any internet connection.

6.3 Who processes it, and where

Your request goes to our backend on Amazon Web Services (AWS), in its US West (Oregon) region, us-west-2. From there, the model runs in Amazon Bedrock, AWS's AI service:

• writing and translation use models made by Anthropic (Claude) and Amazon (Nova);
• images use models made by Stability AI (Stable Image and Stable Diffusion).

These models run inside AWS. Amazon's Nova models are part of AWS's own service, and according to AWS, Anthropic and Stability AI have no access to your requests or to the results (Amazon Bedrock data protection). We may change which model handles an action, but every model runs through Amazon Bedrock. If we ever add a company not named here, we will update this policy and ask for your consent again before sending it anything.

Some models are reached through Bedrock's cross-region inference, which runs a request in another AWS region when one is busy. We use only the routing that stays in the United States, never global routing, so your requests are processed in AWS regions in the United States. Data we store stays in Oregon.

6.4 Not used to train models

We do not use what you send, or what the AI makes for you, to train AI models, and we do not let anyone else do so. AWS states that Amazon Bedrock does not use prompts and results to train any AWS or third-party models, and does not share them with the model providers (Amazon Bedrock FAQs).

6.5 Safety checks

Requests pass through automated safety systems: AWS's abuse detection for Amazon Bedrock, and the content filters built into the image models. AWS states that Bedrock does not store or log prompts and results, though for some models it may keep request data for a limited time to detect abuse, under its own terms. Content that appears to involve the sexual abuse of children is blocked and may be reported to the authorities. We record that a request was filtered, but not its content, and repeated filtered requests can lower an account's rate limits.

Every AI result in the app has a Report button. A report sends us the reason you choose and any note you add, and we keep a copy of the reported result with it so that we can review it.

6.6 What we keep, and for how long

Our database is backed up, and the backups are overwritten within 35 days, so anything deleted from it is gone from the backups by then too.

AI output can be wrong, can resemble existing work, and is yours to check before you publish it. The Terms of Use cover that in section 7.

7. Purchases, subscriptions and credits

MockMyApp is free to design with. You can buy Pro (a monthly or yearly subscription with clean exports and a monthly cloud AI allowance), Lifetime (a one-time purchase that removes the watermark), and credit packs for cloud AI. Who handles the payment depends on where you buy.

7.1 App Store and Google Play

On iPhone, iPad, Mac and Android, purchases are handled by the Apple App Store or Google Play. You pay them, not us. We never see your card number, your billing address or the identity of your Apple ID or Google account. Their privacy policies apply: apple.com/legal/privacy and policies.google.com/privacy.

The app buys through Apple's and Google's own in-app purchase systems, with no other company's purchase service in between. When you buy while signed in, the app sends the store's record of that purchase (the product, transaction IDs, dates, trial status and the store's country) to our server with your MockMyApp user ID, and our server checks it with Apple or Google before adding the plan or credits to your account. Apple and Google then tell our server when a subscription renews, ends or is refunded.

7.2 The web, Windows and Linux

Purchases on the web, Windows and Linux are sold by Paddle (Paddle.com Market Limited, United Kingdom), our merchant of record. Paddle is the seller of record for those orders: it takes your payment, collects your name, email address, billing country and payment details, handles sales tax and VAT, and sends your receipts. Paddle's privacy policy applies to what it collects: paddle.com/legal/privacy.

We receive from Paddle your customer ID, email address and country, what you bought, the amounts, and your subscription's status, together with your MockMyApp user ID, which our server attaches to the order so the purchase lands on your account. We never receive your card details.

7.3 Your plan and credit records

Our server keeps one record of your plan (which plan, whether it is active, when it renews or ends, whether you are in a trial, and where you bought it), your credit balances, and a ledger of each grant, purchase, spend and refund of credits, with its amount and reason. We need these to give you what you paid for on every device. The plan and balances are kept for as long as you have an account. Each ledger entry is kept for up to 400 days.

A record that a particular store or Paddle transaction has already been credited (its transaction ID and the account it went to) is kept for up to 400 days, including after an account is deleted, so the same purchase can never be credited twice.

A Lifetime unlock bought in a store before you signed in is remembered on your device, as it always was, and can be restored from the store.

8. The website and the web app

mockmyapp.com and app.mockmyapp.com are served by Cloudflare (Cloudflare, Inc., United States), which processes your IP address and standard request information to deliver and protect them, as any host does. The website sets no cookies and runs no analytics.

In the web app, your projects, the images you import and the fonts you upload are saved in your browser's own storage on your computer (IndexedDB), so they are still there when you come back. Nothing about your projects is uploaded. Clearing this site's data in your browser, or browsing in a private window, removes them, so use "Back up project" to keep a copy of anything you care about. If you sign in on the web, Firebase keeps your sign-in session in the same browser storage, and Google's reCAPTCHA runs to check the request comes from a real browser, under Google's privacy policy and terms.

9. When you email us

Mail to imamagun94@gmail.com is forwarded by Cloudflare Email Routing to our mailbox, hosted by Google. We use what you write, your email address and anything you attach only to answer you. We keep the conversation for as long as it takes to resolve, and no longer than two years after our last exchange.

10. Who we share data with

We share personal data only with the service providers below, only as far as each needs to do its job for us, and under their data-processing terms. We do not sell or rent personal data, we do not share it for advertising, and no advertising or tracking code is built into MockMyApp.

Anthropic and Stability AI make some of the AI models, but those models run inside AWS, and Anthropic and Stability AI receive nothing from you. Amazon's own Nova models run inside AWS, the processor listed above (section 6.3). We may also disclose data where the law requires it, or to protect the safety of our users, and we would pass the service to a successor only under this policy.

11. Why we use your data

Where privacy laws such as the GDPR require a legal basis, ours are:

• To provide what you asked for (performance of a contract): your account, your plan and credits, and each cloud AI action you run.
• Your consent: sending your content to cloud AI, and separately sending your screenshots. You can withdraw either at any time in the app's settings, without affecting what was done before.
• Our legitimate interests in keeping the service secure and fair: genuine-app checks, rate limits, fraud and abuse prevention, reviewing results you report, the one-trial-per-person code, and server logs.
• Legal obligations, for example responding to lawful requests.

12. How long we keep it

Anything deleted from our database, including when you delete your account, is gone from its backups once they are overwritten, within 35 days.

Apple, Google and Paddle keep their own records of your purchases under their policies and the tax laws that apply to them. We cannot delete those.

13. Deleting your account

You can delete your account in the app, on any platform: Settings → Account → Delete account. Or email imamagun94@gmail.com from your account's email address, and we will delete it within 30 days. The full steps are at mockmyapp.com/delete-account.

Deleting your account removes your account record, your plan and credit records, any AI jobs and results still on our servers, and your Firebase Authentication user, and revokes MockMyApp's access to your Apple ID if you signed in with Apple. Unused credits are lost. The only things that remain are the one-trial-per-person code, the transaction records and any results you reported (section 12), server logs until they expire, and our backups until they are overwritten, within 35 days.

Subscriptions. Deleting your account, in the app or by email, cancels a subscription you bought on the web, Windows or Linux through Paddle immediately, so you are not charged again. It cannot cancel a subscription bought in the App Store or Google Play, because the store bills it. Cancel that one yourself first: on iPhone or iPad in Settings → your name → Subscriptions, on a Mac in the App Store under your name → Account Settings → Subscriptions, and on Android in the Play Store app under your profile picture → Payments and subscriptions → Subscriptions. mockmyapp.com/account has direct links. Your projects are on your device, so deleting your account does not touch them.

14. Your rights

Depending on where you live, laws such as the GDPR (EU and UK) and the CCPA/CPRA (California) give you the right to access the personal data we hold about you, to get a copy of it, to correct it, to delete it, to object to or restrict its use, and to withdraw consent. To use any of these rights, email imamagun94@gmail.com from your account's email address. We answer within 30 days, and we may ask you to confirm the request from the app so that no one else can make it for you.

We do not sell or share personal information, as California law defines those words, and we do not use sensitive personal information. For purchase data held by Apple, Google or Paddle, your rights run against them, through your account with them.

You also have the right to complain to your local data protection authority.

15. Security

Everything between the app and our service travels over encrypted connections (TLS). Our data is encrypted at rest by AWS. Each part of our backend has only the permissions it needs, the app holds no keys to our cloud accounts, and AI results are handed out through links that expire within minutes. On your device, your data is protected by your device's own security: screen lock, disk encryption, and the app sandbox. No system is perfectly secure; if a breach affecting your personal data happens, we will tell you and the authorities as the law requires.

16. International transfers

We are based in Bangladesh, and our service providers process data in the United States, the United Kingdom and elsewhere, as listed in section 10. Where your data moves out of the EU, the UK or another country with transfer rules, we rely on our providers' standard contractual clauses or other lawful transfer mechanisms.

17. Children

MockMyApp is a professional design tool and is not directed at children. You must be at least 13, or the minimum age to consent to online services where you live if that is higher, to create an account. We do not knowingly collect personal data from children below that age. If you believe a child has created an account, email us and we will delete it.

18. Changes to this policy

If MockMyApp changes in a way that affects this policy, we will update this page and its "Last updated" date before that version ships, and note material changes in the app's release notes. If a change affects what cloud AI sends or who receives it, the app will ask for your consent again before sending anything. Earlier versions are available on request.

19. Contact

New Age Devs (Md. Imam Hossain)
Bangladesh
Email: imamagun94@gmail.com

See also the Terms of Use, the Refund Policy and how AI in MockMyApp works.