Last updated: 10 October 2026
Effective from: 10 October 2026
Applies to: the Dubroll mobile app for Android.
You can object. Against any processing that rests on a legitimate interest — which processing that is, is stated in section "Legal bases by purpose" — you can object at any time by writing to contact@dubroll.app with the subject "Objection".
4. What goes to Google Gemini and why
5. Our servers for the voice and for alignment
7. Usage statistics and error reports — only with your consent
9. Identifiers, advertising and tracking
12. Subscriptions, purchases and the rights
14. Our role and Google's role
16. Transfers of data to third countries
17. Retention periods and deletion
19. Objection and withdrawal of consent
22. Security and personal data breaches
The controller of the personal data under Regulation (EU) 2016/679 ("the Regulation") is Torvyx Labs Ltd. („Торвикс Лабс“ ЕООД).
You film or pick a video; Dubroll sends it with the sound to Google Gemini, which writes a commentary in the style of the commentator you have chosen; a synthetic voice voices it and your phone assembles the clip. Every clip carries an AI marking: metadata in the file and a visible notice that the voice is generated by artificial intelligence.
The commentators are invented characters and all of them are available to everyone; which ones there are at the moment you can see in the app. None of them is a real person, and their voices are Google's synthetic voices.
Other users see nothing of yours through Dubroll; you publish, outside the app. To make a clip, you sign in with your Google account — section "Your account".
Sign-in with Google only. To make a clip, you sign in with your Google account; browsing the app is free without signing in. By continuing from the sign-in screen you accept the Terms of Use and confirm that you have read this Policy and that you are 18 or older.
What Google keeps for the sign-in. The record of your account in Dubroll is kept by Firebase Authentication — a Google service in our project, for which Google is our processor under the Firebase Data Processing and Security Terms. The record carries the identifier of your Google account, the email, the display name and the picture, the sign-in provider and the times of creation and of last sign-in; on sign-in Google also logs your IP address and device data, which it keeps for a few weeks against abuse. The app shows your email in the menu; it does not go to our servers.
What our server keeps. From the sign-in, only a pseudonym of your Google account reaches us — an irreversible key derived with a secret that stays only with us; not the email, name or picture. Under it the server keeps the daily counters of your clips and of your unsuccessful attempts at a cinematic clip (30 days from the last record), the random numbers of your attempts at a clip and the numbers of your clips for the voice (up to 4 days), whether the account has used the cinematic welcome clip (24 months), the weekly flame (12 months from the last record) and your purchases — on the account that made them (section "Subscriptions, purchases and the rights"). If we stop the voice through our server for an account because of abuse of it, a mark of that sits with its counters — until we let it through again or until the record with the counters expires.
The weekly flame. A week "lights up" when you make a clip on a set number of different days in it; without PRO, a lit week brings a free cinematic clip. The days are counted by our server — by its own clock, in your account's time zone, which the app sends and the server locks against frequent changes. The record holds the time zone, the days with a clip in the current week, how many weeks have lit up and the gift — not the content of your clips. "Delete account" deletes it; otherwise it expires 12 months after the last record.
Every account is a separate world. The counters, the cinematic welcome clip, the weekly flame and the purchases belong to the account, not to the phone: another account on the same phone does not use them, and your account on another phone carries them. The clips, however, stay on the phone on which they were made and are not transferred between devices. The "My clips" library shows the clips of the signed-in account; signing out hides them without deleting them; on a shared phone the files of all accounts sit in one and the same app.
The request to Gemini does not carry your account. The video, the sound and the text go to Google from a separate technical profile of the app in which nobody is signed in; the text to be voiced may also pass through our voice server — again without your account. The reports of AI content and — with consent — the usage statistics and error reports do not carry your account either.
Deleting your account — section "Retention periods and deletion" says how the account is deleted and what remains afterwards.
The commentary is written by a Google Gemini model in Google Cloud.
The video — with the sound. A copy of the recording or of the part picked from the gallery goes to the model, without the metadata of the file; the sound carries the voices of everyone in the frame and behind the camera, the music and the ambient noise. Sometimes separate frames from the video go instead of the video. One and the same video may go to Google more than once for one clip.
The text of the commentary — which describes the scene and the people in it — goes to Google separately from the video as well: to refine it, to translate it and to voice it with a synthetic voice. For the voicing it goes to Google straight from your phone or through our voice server — section "Our servers for the voice and for alignment".
Google's automated safety classifiers review the requests to Gemini — for Google's purpose, not ours. A request that is not flagged is not kept as content; its technical record stays with Google. A flagged request may be recorded for up to 90 days — solely to check for abuse — and reviewed by authorised Google staff. Google does not use your content to train its models.
The video, the sound and the requests to refine or translate the text go from your phone straight to Google and do not pass through us; we receive no copy of the video. The text of the commentary passes through our servers only in transit — for alignment and, when the voice is requested through our server, for the voicing — and is not recorded with us.
The voice server. The synthetic voice is requested from Google's model straight from your phone or through a server of ours. Through the server, the app sends the text of the commentary with the direction for the voice, and the server passes them on to the model and returns the sound to your phone. The server is our own service in the European Union, and Google is our processor for the infrastructure.
The voice server — what it receives. The text of the commentary with the direction for the voice, the chosen voice and the number of the clip — a random number that our rights server gives the clip together with its permission. It does not receive your account.
The voice server — what it keeps. Nothing of the content — neither the text nor the sound. Against the number of the clip it keeps the kind of the clip, whether it is a paid one, its state and its times, and counts of the requests, of the sound used and of the answers stopped by the safety filter — against abuse, for up to 4 days. Its logs carry no content and no IP address and are kept for 30 days.
The alignment server. The captions are fitted to the voice by the timings of the individual words.
Those timings are found by our alignment server, and the voice, too, is fitted to the length of the clip by them. The server is our own service in the European Union, and Google is our processor for the infrastructure.
What it receives. The synthetic voice, the text of the commentary and the language of the clip. For some languages the server forwards the sound of the synthetic voice to a Google speech recognition service — a processor, in the European Union, without logging the data.
What it keeps. Nothing of the content. Its logs carry no content and no IP address and are kept for 30 days.
The settings file (it travels in the Android backup in your Google account): the records of your acceptance of the Terms, of the version of this Policy shown to you and of your statement about age; the outcome of the age check through Google Play (not the age range itself — see the section on age); the records and the data about the purchases; your choice about usage statistics and error reports; the usage counters and the pause after refused clips; your preferences and which account signed in last.
The files (they do not travel in the backup): the clips with the text of the commentary for each and with a mark of the account that made them; a cinematic clip that is still waiting for confirmation from our server also carries the mark of its hold — the number of the attempt, who pays and, for PRO or a purchased clip, a fingerprint of the purchase — until the server confirms or refuses it; the event log; the queue of the reports; the queue of the statistics and of the error reports; the temporary files of the production; the files of Google's libraries for the integrity check and for your sign-in session.
Usage statistics and error reports may be sent to us only if you have switched them on — they are off by default. Their receiver is ours, in Google Cloud in the European Union; Google is our processor.
A statistics event carries a name, the time, the version and the language of the app, the random number of the installation — not your account — and the event's own fields. An error report carries the time, the type of the error, the part of the app where it was caught and its place in the code, the versions of the app and of Android, the model of the device and the same random number.
Before a request to Google, the app asks Google to confirm that this is a genuine, unmodified copy of Dubroll on a genuine device; the check uses signals about the device and about the app, not content.
For that purpose Google's library keeps on your phone an installation identifier and the token of the check.
We do not sell personal data and we do not share it for targeted advertising.
The purchase tag. On a purchase the app passes to Google Play, with the order, a unique number with a signature derived from your account's pseudonym with a secret that stays only with us. That way the purchase stays with the account that made it. Without the secret the tag says nothing about you.
The model of the phone. The app reads the model, the chipset and the memory of the device in order to choose a capture mode; what is read for that stays on the phone.
The random number of the installation. It is created only when you switch on the statistics or the error reports, and it does not travel in the Android backup. You can see it in "About & Legal"; a request by email concerning the statistics needs it. It is not linked to your account.
Saving to the gallery. A copy of the clip goes into your phone's gallery.
Sharing. The clip goes to the app you have chosen, together with a short text with hashtags, which may contain words from the commentary; the same text is also copied to the clipboard. The shared file may also carry metadata of the recording, such as the time of recording.
The app asks for access to the camera and the microphone in order to record video with sound — when the camera is first opened, after continuing from the sign-in screen, by which you accept the Terms of Use and confirm that you have read this Policy; the app then also shows you, once, the rules for filming people.
Purchases are paid for in Google Play. From Google Play we receive the purchase token, the order number, the product and the plan and the time of the purchase.
The sales reports from Google Play, which go into our accounts, carry the order number, the date and the time of the order, the product and the plan, the device model, the country and — where Google Play provides them — the buyer's region and postcode, the currency and the amounts.
Whether you have PRO and how many purchased clips are left to you is determined by a server of ours, which checks your purchases with Google Play. The app sends it the sign-in token (which account is asking), the tokens of your purchases and the records about them, and the server returns the state of your purchases.
From Google Play the server also receives the time of expiry, the automatic renewal, the state of the purchase and the country of your Google Play profile, as well as notifications on renewal, termination and refund. If Google Play refunds an amount or voids a purchase, we learn the fact, the date and the reason code.
What it keeps. For every purchase: the token, the kind, the product and the plan, the order numbers, the country of the Google Play profile, the price and the currency, the times and the state according to Google Play, the remainder of purchased clips, the daily number of cinematic clips on PRO, the number from the purchase tag and the pseudonym of the account that made it: PRO and the purchased clips apply only to that account, and another account on the same phone does not use them. It also keeps a copy of the record about the purchase: time, language, plan or pack, number of clips, price shown, the included quantities, version of the app and the date of the accepted Terms. The copy shows what is included in your plan and it remains even if you delete the data on your phone.
While a cinematic clip is being made, the server keeps, at the unit that pays for it — the purchase, the gift or the daily number of PRO —, its hold: a random number of the attempt, the state, the time and the day — and the number of the clip for the voice, when the clip has one. A decided hold — confirmed with a delivered clip or released on a failure — we keep for up to 4 days.
In the app every clip can be reported with a reason from a fixed list. The report carries the day, the reason, the commentator and the language of the clip, the AI models, the version of the app, a random identifier of the clip, a fingerprint of the text of the commentary and its length. It does not carry the text of the commentary, the video, an identifier of the installation, or your account.
If it cannot be sent at once, the report waits on your phone.
The receiver. The reports go to a receiver of ours in Google Cloud in the European Union; your IP address is not recorded with us. We cannot link a report to a person, and that is why we cannot delete a report on request (Article 11(2) of the Regulation).
Role by service:
Other recipients. Google — the provider of our contact@dubroll.app mailbox; our professional advisers (a lawyer, an accountant).
| Purpose | Legal basis |
|---|---|
| The service itself — sending your video and sound to Google, writing and voicing the commentary, fitting the captions and the voice to the clip, the files and counters on the phone, the backup of the settings, the statement about age before the contract, checking the purchases and access to PRO and to the purchased clips | The contract with you — Article 6(1)(b) of the Regulation. |
| The sign-in with Google, the record of your account and the account-keyed records with us — the counters, the numbers of the attempts and of the clips for the voice, the cinematic welcome clip, the weekly flame, the purchases tied to the account | The contract with you — Article 6(1)(b) of the Regulation. |
| Keeping the counters and the record of the cinematic welcome clip after the deletion of an account | Legitimate interest — point (f): preventing abuse of the free use. |
| The data of the people in the frame — image, voice, behaviour, setting — in the same sending, including children | Legitimate interest — Article 6(1)(f) (ours and yours: that the clip you have asked for is made); we do not seek special categories of data and do not rely on a condition under Article 9(2). |
| The app integrity check | Legitimate interest — point (f): protection of the service from abuse. |
| The limits against abuse of our voice server — the counts against the number of the clip and stopping the voice through the server for an account — and counting how many accounts receive the free allowance from one copy of the app (only in the memory of our server; the log keeps only the count) | Legitimate interest — point (f): protection of the service and of the free use from abuse. |
| The age check through Google Play for accounts from the United States | Legitimate interest — point (f): to comply with the laws of the states where Dubroll is offered and with the 18+ condition. |
| The record about the purchase and its tag, passed to Google Play with the order | The contract with you — Article 6(1)(b) of the Regulation: what is included in your plan, and that the purchase stays with the account that made it. |
| The record of the acceptance of the Terms and of which version of this Policy was shown to you | Legal obligation — point (c) (Article 147a(4) of the Consumer Protection Act). |
| Keeping the documents on purchases after their end | Legitimate interest — point (f): a defence in a dispute about withdrawal, refund or lack of conformity. |
| The sales reports in the accounts | Legal obligation — point (c) (Article 12 of the Accountancy Act). |
| The reports of AI content | Legitimate interest — point (f): safety of the product and of the people in the frame; the Google Play requirement. |
| Usage statistics and error reports | Consent — point (a). |
| Requests for access, deletion and objection, including the deletion of the account; the record of the requests themselves | Legal obligation — point (c) (Articles 12 and 15–21 of the Regulation). |
| Answering a letter you have sent us yourself | Legal obligation — point (c), where you are exercising a right; otherwise legitimate interest — point (f): answering you. |
| Notifying the supervisory authority and the persons concerned of a personal data breach | Legal obligation — point (c) (Articles 33 and 34 of the Regulation). |
What is compulsory and what is not. The video and the sound are necessary for the contract itself: without them there is no commentary and no clip. The statement that you are 18 or older you make by continuing from the sign-in screen. Without signing in with Google a clip cannot be made — browsing the app is free; without the integrity check a new clip cannot be made. Without the purchase token and the order number, which come from Google Play, the purchase cannot be checked and credited; free use does not depend on them. Reporting a clip and writing to us are your choice, and refusing takes nothing of the service away from you.
Optional too are the statistics and the error reports.
Google LLC (USA) may process your data. The safeguards: the European Commission's adequacy decision of 10 July 2023 (the EU–US Data Privacy Framework), under which Google LLC is certified, and the standard contractual clauses under Article 46(2)(c) of the Regulation in the Cloud Data Processing Addendum — copy: https://cloud.google.com/terms/data-processing-addendum.
For data subject to the UK GDPR, the safeguard is the United Kingdom's regulations of 20 September 2023 on the adequate level of protection in the USA (the UK Extension to the EU–US Data Privacy Framework), in which Google LLC is also certified.
Where your content is processed. Google processes the video, the sound and the text of the commentary in the European Union; the text of the commentary for the voice may also be processed outside it, at Google LLC, under the same safeguards.
The integrity check may also be processed outside the European Economic Area — by Google as our processor, under the same safeguards; the standard contractual clauses for it are in the Firebase Data Processing and Security Terms — copy: https://firebase.google.com/terms/data-processing-terms.
The record of your account (Firebase Authentication) is processed in the United States — Google runs this service only from data centres there, as our processor, under the same safeguards and the same Firebase Data Processing and Security Terms.
| What | Where | Period |
|---|---|---|
| The "My clips" library | your phone | until you delete the clip or the local data, or uninstall the app |
| The temporary files of the production | your phone (cache) | until the end of the production; leftovers — at a later launch of the app; on a failure the recording stays for a new attempt |
| The event log | your phone | at 1 MB the current file is archived, the previous archive is deleted |
| The queue of the reports | your phone | up to 90 days and up to 200 rows |
| The queue of the statistics and of the error reports | your phone | until it is sent or until you delete the local data; when it fills up, the oldest part drops |
| The settings file | your phone and the backup in your Google account | until uninstall; deleting the local data keeps some of the records (below); in the backup — under Android's rules |
| The outcome of the age check through Google Play (not the age range itself) | your phone | until the next check — at most 12 months — or until you delete the local data |
| Your video and sound, the text to the voice | Google (processor) | transient; a request flagged by a classifier — up to 90 days |
| The token of the integrity check and the installation identifier | Google (processor) | under the Firebase terms; we do not record them |
| The record of your account for the sign-in | Firebase Authentication (Google, processor) | until you delete the account; Google then removes it within 180 days; the IP addresses at sign-in — a few weeks |
| The text of the commentary and the synthetic voice — for the voicing and for alignment | our servers for the voice and for alignment | transit — not kept; application logs — 30 days |
| The numbers of the clips for the voice and the counts against them; the random numbers of the attempts at a clip | our servers | up to 4 days |
| Documents on purchases (with the pseudonym of the account that bought) and the records about them | our server | 3 years after the end of the last purchase; the purchase token in clear form — 90 days after the end; the messages from Google Play — 90 days; a record without a purchase — 30 days |
| Sales reports from Google Play | our accounts | 10 years from the first of January of the year following the reporting year (Article 12 of the Accountancy Act) |
| Reports of AI content | our receiver | 12 months |
| Usage statistics and error reports (with consent) | our receiver | 90 days from receipt |
| Rights requests and the record of an account deletion | our server | 12 months |
| The daily counters per account | our server | 30 days from the last record |
| Holds on units for a cinematic clip | our server | while the clip is being made, at most 2 days; decided ones — up to 4 days |
| The record that the account has used the cinematic welcome clip | our server | 24 months |
| The weekly flame per account | our server | 12 months from the last record; deleted with "Delete account" |
| Letters to support | the mailbox | 12 months after the matter is closed |
| Backups of the server databases | Google (processor) | 7 days |
| Register of security incidents | with us | 5 years |
| The request logs of the dubroll.app website (with an IP address) | Google (processor) | a few months |
The clip and the text of its commentary are deleted when you delete the clip in the "My clips" library; the copy in the gallery stays.
"Delete my local data" in "About & Legal" deletes the app's data on the phone and asks for the backup in your Google account to be replaced. What stays is the proof — the acceptance of the Terms and which version of this Policy was shown to you, the answer about age and the data about the purchases — and the records without which the deletion would give a new free day or a second crediting: the counters, the pause after clips blocked by moderation, the record that the gifts — the cinematic welcome clip and the weekly flame's gift — have been used and the purchases already credited. It does not delete the copies in the gallery, the PRO subscription (it is in Google Play) or the files of Google's library for the integrity check. Nor does it delete the usage statistics and error reports already with us — for those, switch the two switches off first or use "Delete account". It does not sign you out of the account and does not delete it — that is what "Delete account" is for.
Uninstalling deletes the app's data on the phone, but not the copies in the gallery or the backup of the settings in your Google account — Android brings it back on a reinstall — and it does not delete your account.
"Delete account" in "About & Legal" (it requires a recent sign-in with Google) does five things: it deletes the usage statistics and error reports kept with us under this installation's random number; it deletes your account's weekly flame with us; it records your request with us — under a pseudonym, for 12 months; it deletes the record of your account in Firebase Authentication; and it deletes the app's data on this phone, including the clips in the "My clips" library — download them before that. The copies in the gallery stay.
What remains after the deletion, and why. The daily counters per account and the mark that goes with them — for up to 30 days from the last record, so that they are not reset by deleting and signing in again; the numbers that go with them — for up to 4 days; the record that the account has used the cinematic welcome clip — for up to 24 months, for the same reason; your purchases and subscriptions — as financial and legal records (the periods are in the table above) and so that they come back to you on a new sign-in with the same account; the copies of the records about the purchases — as proof (Article 17(3)(e) of the Regulation). All of this sits under the pseudonym of the account, without email and without name. The basis for the counters and the cinematic welcome clip is a legitimate interest — preventing abuse of the free use; for the purchases — section "Legal bases by purpose".
A new sign-in with the same Google account brings your purchases back; the cinematic welcome clip is not given again; the daily counters continue; the weekly flame starts from zero; the clips from the deleted phone are lost.
The PRO subscription is in Google Play and is not stopped by deleting the account — you stop it in Google Play.
"Sign out" hides the clips from the "My clips" library and deletes nothing — neither on the phone nor with us.
If you have uninstalled the app, you delete the account through https://dubroll.app/delete-account — the page says how — or write to us at contact@dubroll.app from the Google account you signed in with.
By email — at contact@dubroll.app, from the Google account you sign in with, or with the order number from Google Play (it starts with "GPA.") and the date of the purchase. The documents on purchases are not deleted before the end of their period — they are only restricted.
You have the rights under Articles 15–21 of the Regulation: access, rectification, erasure, restriction, portability and objection.
The limit. We do not hold the content sent to Google and cannot identify you in it — so for it we cannot carry out access, rectification, erasure or portability (Article 11(2) of the Regulation).
By account. The records with us under your account (section "Your account") we can find — write to us at contact@dubroll.app from the Google account you sign in with. That is the route to access them and to deletion without the app.
How and within what period. By a letter to contact@dubroll.app; we answer within one month of receipt, and where the matter is complex — within the extended period under Article 12(3) of the Regulation.
United Kingdom. If you are in the United Kingdom, your processing is also subject to the UK GDPR and the Data Protection Act 2018. You have the same rights under Articles 15–18, 20 and 21 of the UK GDPR and the right to make a complaint to the Information Commissioner's Office (ICO) under section 165 of the Data Protection Act 2018.
A complaint to us. You may also complain directly to us — at contact@dubroll.app; for the United Kingdom this is the route under section 164A of the Data Protection Act 2018. We acknowledge receipt within 30 days and respond on the substance without undue delay, within the period in this section, telling you what we did.
Objection. You can object at any time, on grounds relating to your particular situation, to the processing that rests on a legitimate interest (section "Legal bases by purpose"). Write to contact@dubroll.app with the subject "Objection".
You can also object to the keeping of the documents on purchases after their end — and to the keeping of the counters and of the record of the cinematic welcome clip after the deletion of an account.
Withdrawal of consent. The only consent we ask of you is for the statistics and the error reports.
You withdraw it at any time in "About & Legal" by switching it off; the withdrawal takes effect for the future and does not affect the lawfulness of the processing before it.
What we do not do. We do not identify anyone — there is no facial recognition and there are no voiceprints.
The information we owe the person in the frame (Article 14 of the Regulation). Controller — Torvyx Labs Ltd., contact@dubroll.app; source of the data — the user who filmed them or picked the video from the gallery of their own phone (where such a video comes from and whether it was publicly available, we do not know); categories — image, voice, behaviour, setting, and the generated commentary that describes them; purpose — writing and voicing a comedy commentary on the video at the user's request; basis — legitimate interest (Article 6(1)(f)): making the clip the user asked for; recipients — Google as our processor; transfers to third countries — section "Transfers of data to third countries"; period — transient, section "Retention periods and deletion"; rights — objection, access and erasure, section "Your rights", and a complaint, section "Contact and complaints". We cannot provide this information to the person in the frame personally: we do not know who they are (Article 14(5)(b)).
A ready text you can show the person you are filming: "I am filming you with an app that sends the video and the sound to Google Gemini so that it can write and voice a comedy commentary. The clip stays on my phone until I publish it. What your rights are is written in the "People in the frame" section of dubroll.app/legal/privacy/en/."
The rights of the person in the frame and how to exercise them. Write to contact@dubroll.app — you need not be a user of ours. The objection under Article 21 is live even without our identifying you — the subject "Objection" is enough.
Dubroll is for persons aged 18 and over (the Terms of Use, section "Who may use Dubroll"). We do not knowingly process the data of a user under the age of 18.
Age check through Google Play. For Google Play accounts from the United States, the laws of some states require apps to use the store's age signal. So on the first launch — and after that at most once a year — the app asks Google Play for the account's age range (under 18 or 18+). If Google Play shows that you are under 18, Dubroll is not available; if it asks for your age to be confirmed, the app sends you to Google Play. On the phone we keep only the outcome of the check and its date — not the age range — and we send them nowhere, including the statistics. The source is Google Play; outside the United States we do not ask.
On the phone, the app's files are protected by Android's isolated storage and by the encryption of your device.
Data travels to our servers over an encrypted connection and, once there, has no public or client access. Requests by account carry a sign-in token issued by Firebase, which the server verifies on every request; deleting the account requires a recent sign-in.
If there is a security breach of which we must notify you, we write to you at the email of the Google account you signed in with.
If you have no account with us or we cannot reach you, we publish a notice at https://dubroll.app/security (Article 34(3)(c) of the Regulation).
A change to this Policy follows its own procedure, independent of the Terms of Use. For a substantial change we alter the "Effective from" date, publish the new version and notify you in the app when it is updated. This Policy is a notice under Article 13 of the Regulation — we do not ask you to "accept" it as a contract; where we process personal data on the basis of your consent (for example usage statistics), that consent is separate, specific and withdrawable at any time.
Which language version prevails is set out in the Language clause of the Terms of Use — and it applies to this document too.
Write to us at contact@dubroll.app.
The telephone. Calls are not recorded; what you tell us on the telephone we use only in order to answer you.
Supervisory authority. The supervisory authority in Bulgaria is the Commission for Personal Data Protection (CPDP). You have the right to lodge a complaint with it or with the supervisory authority in the Member State in which you live or work (Article 77 of the Regulation).