Privacy notice

Who handles your data

The data controller is Alessandro Sinico, who runs Wrap It All (wrapitall.app). For any question or to exercise your rights write to [email protected].

In short

The files you upload (chats, listening and viewing histories) stay on your device: your browser reads and analyses them, and they are never uploaded to our servers.

You need an account to use the service, and we keep only its email. The text of your chats leaves your device only if you choose AI mode and give your consent, and even then it is not saved.

Which data we handle, why and on what basis

We handle only the data needed to give you the service you ask for.

• Account email and password. They let you sign in with email and password or with Google (Google tells us your email, nothing else) and recognise you when you come back. The password is kept by the sign-in service (Supabase) only in encrypted form: we cannot read it and we write it nowhere. Basis: performance of the service you asked for (art. 6.1.b GDPR).
• Saved Wraps. Only if you press “Save to history” (or, in AI mode, if you do not turn saving off): we save the finished Wrap, that is its pages, title, language, the apps used and the period. We never save chats, files, the package sent to the AI or its raw reply. They are kept for up to 90 days, up to 10 Wraps. The pages may contain names or phrases taken from your chats: that is data of yours and of the people who write with you (see “Other people's data”). Basis: performance of the service you asked for (art. 6.1.b).
• Chat text for AI mode. Only after you tick the consent box, every time: the text, already filtered (see below), is sent to the AI provider to write the Wrap. Basis: your consent (art. 6.1.a), which you can withdraw by not using AI mode.
• Consent log. When you give your consent for the AI we record the date, the version of the text, the provider and the language, with no content at all, so that we can show the consent was given (art. 7.1).
• Usage counters. How many AI generations and page regenerations you made today, and the total spend of the month on the service (not tied to a person). They keep the daily limits and the spending cap and protect the service from abuse. Basis: legitimate interest in keeping the service sustainable and safe (art. 6.1.f).
• Technical network data. Like any site, the hosting provider and the database provider record the IP address and technical details of requests for as long as needed for security and operation. We do not use them to profile you. Basis: legitimate interest in security (art. 6.1.f).
• Feedback message, if you send one. The form is external (Google Forms) and optional; write only what you want.

What we do not do

• We do not upload your files and we do not save your chats.
• We do not advertise, we do not sell data and we do not profile people.
• We do not use your content to train models and we do not let the AI provider do so (we use a paid service with this condition).
• We do not take automated decisions that have legal effects on you.

AI mode: what is sent, to whom and for how long

In AI mode the Wrap is written by a Google model (Gemini). Before every generation we show a screen with what is about to leave your device, the provider and its role, and a box to tick: nothing is sent without it.

What is sent: the text of the messages of the chosen chats, in compact form, after your device has already: replaced phone numbers, IBANs, cards, emails, IP addresses and locations; applied your choice on links; removed the people you excluded and the words you hid; applied your choice on names. Also sent are the statistics worked out on the device, the language, the tone, the title, the period and any instructions you write. Original files, images, attachments and system messages are not sent.

How long it stays: our server function keeps the package in memory only for the length of the request and does not write it to the database or to the logs. The provider handles it as a processor under its agreement for paid services, without using it to train its models. It may keep it for a limited period, set by its agreement, only to prevent abuse.

Anonymous statistics

We measure how the service is used with PostHog Cloud (EU region), with no cookies, no identifier that stays on the device, no person profiles and no geolocation. Each page load makes a random code that lives only in memory. The events do not carry your identity and do not link your account to your Wraps. We never send texts, names, file names, track or video titles or exact numbers: only ranges (for example “1 to 10 MB” or “11-30 pages”), error codes and fixed choices.

If your browser says “Do Not Track” or “Global Privacy Control” we send no event at all. If the statistics service does not answer, the error is ignored.

The events that can be sent are exactly these:

• app_opened — you opened the app (whether it is the first time or not, and the interface language).
• source_selected — you picked an app (WhatsApp, Spotify…).
• file_imported — you loaded a file: of which app, whether it worked or the error code, and the size range.
• wrap_generated — a Wrap was made: the apps, how many, the range of the page count, preset, tone, language and mode (Local or AI).
• wrap_exported — you downloaded the pictures: the format and the range of the page count.
• share_opened — you opened sharing.
• demo_used — you tried the sample data.
• feedback_opened — you opened the feedback form.
• signed_in — you signed in: with email and password or with Google, and whether the account is new.
• ai_result — an AI generation ended: the result or the error code, whether in one pass or in blocks, and the ranges of size, duration and pages kept.
• fallback_used — you chose Local mode after a problem with the AI: the code of the problem.
• history_saved — you saved a Wrap to the history: the mode.
• history_opened — you opened a saved Wrap.
• history_deleted — you deleted one or all of the Wraps, or the account.

Cookies and data on your device

We use no cookies, neither ours nor third parties’, so we show no banner. On the device we keep, in the browser storage, only technical data the service needs: your session token (so you do not sign in at every visit), the language and the theme (light or dark) you chose, and a note that the app was opened before. A temporary note with the apps you picked lasts only for the open tab, when signing in with Google takes you off the page. No content of your chats or files is ever written to the device; closing or reloading the page deletes the data you are working on.

Who receives the data (processors)

We rely on these providers, with whom we have data processing agreements:

• Cloudflare — hosts the site and records its technical access logs.
• Supabase — account, sign-in, the database of saved Wraps and the service functions; data in the EU region (Frankfurt).
• Google — Gemini, the model that writes the Wraps in AI mode (only if you choose it), and Google Forms for the optional feedback.
• Resend — sends the emails that confirm your address and that let you choose a new password.
• PostHog (EU) — the anonymous statistics described above.

Transfers outside the European Union

When a provider handles data outside the European Economic Area (in particular the US providers) it does so on the basis of an adequacy decision of the European Commission or of the standard contractual clauses, with the safeguards of its data processing agreement.

How long we keep the data

• Files and chats: never, they stay on your device.
• The package sent to the AI, the prompt and the raw reply: not kept by our server; the AI provider may keep them for a limited period, set by its agreement, only to prevent abuse.
• Saved Wraps: up to 90 days, at most 10; the oldest is replaced when you save one more and the expired ones delete themselves. You can delete them earlier, one by one or all.
• Account, consent log and counters: until you delete the account; when you do they disappear at once and for good.
• Technical logs of the hosting and database providers: for the short time their services provide.

Your rights

You can ask for access to your data, rectification, erasure, restriction, portability, and object to the processing; you can withdraw your consent to the AI at any time (just do not use it) without affecting the past. For access to and deletion of your Wraps and your account you can do it yourself: “My Wraps” and “Account → Delete my account”. For everything else write to [email protected]: we answer within one month.

If you think the processing breaks the rules you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country.

Other people’s data

Chats contain messages from other people. By uploading a chat you state that you have the right to use it to make your Wrap and that you will share the result only with people who are in that chat. In the Wrap you can exclude people, replace names with pseudonyms or initials and hide words. If data of a person who does not want to be shared appears, hide that page or delete the Wrap.

Minimum age

The service is for people aged 14 or over. When you sign in you state that you are.

Changes

If this notice changes we update the date at the top. If it changes in a way that matters for AI mode we will ask for your consent again.