Privacy Policy
What we collect, why we collect it, and how to get rid of it.
Last updated 15 August 2026
BDRM is operated by Shroozy Ltd. This policy covers the BDRM mobile app, the web app at create.bdrm.app, and this site.
The short version: we collect the account details you give us, the files you upload while you are making something, and basic usage analytics. We do not sell your data, we do not use your artwork to train AI models, and you can delete your account and everything in it from inside the app.
What we collect
Account information
When you create an account we store your email address, your display or artist name, your profile photo URL if your sign-in provider supplies one, your account identifier, and the date you signed up. If you sign in with Google or Apple, we receive these from that provider — we never see your password for those services.
Content you upload and create
When you make cover art, animate a cover, split stems or upscale an image, we receive the image or audio file you submit along with any text you type describing what you want. We store the files and the results so they appear in your library.
Subscription and payment information
Subscriptions bought in the app are handled by Apple or Google and managed through RevenueCat. Payments made on the web are handled by Stripe. We never receive or store your card number. We only see whether your subscription is active and how many credits you have left.
Usage analytics
We use Firebase Analytics to record which features are opened and how often, tied to your account identifier. This tells us which tools people actually use. It does not read your files.
Why we collect it
- To run the app — generating artwork requires sending your prompt and image to the AI services listed below.
- To keep your work — so your library survives closing the app or switching devices.
- To manage your subscription — checking whether you have an active plan and enough credits.
- To fix and improve things — analytics and error reports tell us what is broken or unused.
Where the law requires a legal basis, ours is performance of our contract with you for the first three, and legitimate interest for the fourth.
Who we share it with
We share data only with the services that make the product work. Each one receives the minimum needed for its job.
| Service | What it receives | What it does |
|---|---|---|
| Google Firebase | Account details, uploaded files, usage events | Sign-in, database, file storage, analytics |
| Pruna AI | Your prompt and uploaded image | Generates and edits cover art and video |
| Replicate | Your prompt and uploaded image | Runs the Ideogram and Luma image models |
| LALAL.AI | The audio file you upload | Separates vocals, drums, bass and instrumental |
| OpenRouter | The text you type | Improves prompts and powers in-app chat |
| RevenueCat | Account identifier, subscription status | Manages subscriptions and credits |
| Stripe | Payment details you enter on the web | Processes web payments |
| Railway | Requests passing through our backend | Hosts our server |
We do not sell your personal information, and we do not share it with advertisers.
Your artwork and AI training
We do not use your uploads or your finished artwork to train AI models, and we do not licence them to anyone else for that purpose. Your files are sent to the AI services above only to produce the result you asked for.
Those services operate under their own terms. If that matters to you, read the privacy policies of Pruna AI, Replicate, LALAL.AI and OpenRouter.
How long we keep it
- Account details — until you delete your account.
- Uploads and generated files — until you delete them, or until your account is deleted.
- Analytics — retained by Firebase Analytics on Google's default schedule.
- Payment records — kept by Apple, Google or Stripe for as long as their own tax and accounting rules require.
Your rights
You can see and change your account details in the app under Profile. You can delete your account and all of its data from Edit Profile — that removes your sign-in, your profile and your stored files.
Depending on where you live you may also have the right to request a copy of your data, correct it, restrict how we use it, object to that use, or complain to your local data protection authority. Email support@bdrm.app and we will respond within 30 days.
Children
BDRM is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has given us data, email us and we will remove it.
International transfers
Our providers operate servers in the United States and the European Union, so your data may be processed outside the country you live in. Where the UK GDPR or EU GDPR applies, transfers rely on the providers' Standard Contractual Clauses or an adequacy decision.
Security
Traffic is encrypted in transit. Access to our database and storage is restricted by Firebase Security Rules, and our server requires a valid sign-in token before it will touch your account. No system is perfectly secure, but we will tell you promptly if a breach affects your data.
Changes to this policy
If we change this policy we will update the date at the top of this page, and we will tell you in the app before any material change takes effect.
Contact
Questions about this policy, or about your data: support@bdrm.app.