Lantern privacy policy

Who we are

Lantern is made by Wavista Apps, operated by William Tsao, an individual based in California, USA. Contact: support@wavistaapp.com. Lantern's Terms of Use cover subscriptions, credits and the videos Lantern makes.

What stays on your iPhone

Lantern has no account. It saves these only in the app's storage on your iPhone:

• your list of video chats: each chat's ID on our server, its title, its shape (such as vertical), when you started it and a picture from its latest video. The messages themselves are kept on our server (see What our server keeps);
• your videos: when a video is ready and its chat is open, the app saves the MP4 and a picture from it, and it saves earlier versions when you play, save or share them;
• the photos you take or pick for a video, in the app's temporary storage, which iOS may clear at any time;
• the pictures shown in your chats, in the app's picture cache, which iOS may clear at any time;
• your setup answers: the name or brand you typed (if any), which best describes you, what you want to make, where you heard about Lantern and where you post most. The name or brand is never sent anywhere;
• your AI choice and your settings;
• if you start a free trial of Lantern Pro and allow notifications, one reminder scheduled on your iPhone before the trial ends. It is made and shown on your iPhone; nothing about it is sent to us.

Videos you save to Photos or share go only where you put them. If you back up your iPhone to iCloud or a computer, the backup includes this data, as it does for any app.

What leaves your iPhone, and who receives it

Our server and OpenAI (video chats)

Making videos with AI needs your permission. The app asks on a consent screen first, and if you choose Not now, no message or photo is sent to our server, to OpenAI or to ElevenLabs.

• What the app sends: when you send a message in a video chat, the app sends our server what you write (up to 2,000 characters), the shape and length you picked, up to 4 photos or logos you add (up to 8 in one video chat) and, if you allow notifications, a notification token (see Notifications). Before a photo leaves your iPhone, the app shrinks it to at most 1,600 pixels on its longest side and saves it again as a new image, which leaves out its metadata, including any location. Our server removes any metadata left.
• The check: our server first sends what you write, without your photos, to OpenAI to check it is not a kind of video Lantern does not make (see Videos Lantern does not make).
• Making the video: then OpenAI's AI gets your message, your photos, the shape and length, and, for a change, the chat's earlier requests and the current video's plan and code. It plans the scenes and writes the video as an animated web page, with its music and sound effects written as code. For a video that gives facts, another OpenAI request may check them, and it never changes a number, quote or name you gave. To check the video, our renderer makes small preview frames and sheets of still pictures from it, which go back to OpenAI so it can fix problems such as text that is cut off. OpenAI does not get your name or the app's anonymous ID.
• The voice-over: when a video has one and your consent does not cover ElevenLabs (see below), OpenAI's AI writes its spoken lines from your message, and our server sends those lines, with the voice and speaking style picked for them, to OpenAI's text-to-speech service, which turns them into speech. Our server then sends each spoken line once to OpenAI's transcription service, only to check that no words were left out, and has the line spoken again if they were. Neither service gets photos, your name or the app's anonymous ID.

We send every request that plans, checks or writes your video to OpenAI with its storage option turned off (store=false). OpenAI's text-to-speech service does not store the speech it makes, and its transcription service keeps nothing it hears. Lantern asks OpenAI to reuse only its own fixed instructions between requests (prompt caching), never your words or photos. OpenAI does not use API data to train its models. For every other request, OpenAI may keep the data for up to 30 days only to check for misuse, and then deletes it, per OpenAI's API data controls.

ElevenLabs (the voice-over)

When a video has a voice-over and you allowed AI video making on a consent screen that names ElevenLabs, our server sends ElevenLabs only the words of the voice-over, written by OpenAI's AI from your message, with the voice picked for them and how it should sound. ElevenLabs turns them into speech and returns it with the time of each letter, so captions can follow the words. Our server then sends the speech once to OpenAI's transcription service, only to check that no words were left out, and has it spoken again if they were. ElevenLabs does not get your photos, your name or the app's anonymous ID. If you allowed AI video making on an earlier version of the app, whose consent screen named only OpenAI, the voice-over is made by OpenAI as described above until you allow it on the new screen.

ElevenLabs processes these requests for us under its data processing agreement. Our ElevenLabs account is set so that what we send is not used to train its models. Right after each voice-over is made, our server deletes ElevenLabs' record of that request. ElevenLabs may keep copies in its backups, which it clears on its own schedule, and may keep data where the law requires it.

Withdraw your permission at any time: Settings, Privacy, Use AI video making. This stops messages and photos from leaving your iPhone. Videos already on your iPhone still play, save and share.

Our renderer

Our renderer is our own separate service on Fly.io. It gets the video's web page, which holds the words that appear in the video, the photos you added and the voice-over, and turns it into preview frames, still pictures and sound checks, and the final MP4 with its sound and a picture from it. No AI runs there. It never gets the app's anonymous ID, and it deletes everything after each job.

Files. Our server saves each finished video (the MP4 and a picture from it) and a copy of the photos of each message in private storage (Cloudflare R2), filed under a scrambled form of the app's anonymous ID (a salted hash). Your iPhone downloads them through private links that work for 24 hours, and they are deleted from storage after about 2 days. When your iPhone downloads a file, Cloudflare sees your IP address as part of that connection. If a video's files have expired and it is not on your iPhone, Render again makes them again from what our server keeps, with no AI and no credits.

What our server keeps

Every request to our server carries the app's anonymous ID (a random ID created by RevenueCat, see below), so the server can check your subscription and credits. Our server keeps:

• Your video chats: your messages with the shape and length of each, your later requests for changes, the smaller copies of your photos (without metadata), the current video's plan and code and its voice-over clips, so it can be changed or rendered again without AI, the list of its versions with where their files were stored, the title, and how many credits each message used. They are tied to the scrambled ID, not the ID itself. A video chat is deleted 90 days after you started it.
• A record of each AI request: the time, the feature, which AI model answered, how much text and how many pictures it carried (counts only), whether it worked and why not, how long it took and its cost. It is tied to the scrambled ID and never includes what you wrote, your photos or the video. Records are deleted after 90 days.
• Usage counts for your credits and limits, tied to the scrambled ID: the credits you used each week or during a free trial, the messages checked each day and the videos rendered again each day. They are deleted within 90 days after their week or day ends. The count of credits used during a free trial is kept so the trial limit keeps working, even after Delete my data.
• Your subscription status: the anonymous ID with your Lantern Pro product, its expiry date, whether it is a free trial and whether it was a test purchase. RevenueCat sends this to our server when your purchases change, and our server also asks RevenueCat for it when it checks your access. We keep it until you use Delete my data.

A message the check refuses is not kept. Its credits come back.

Our server uses your IP address for a moment, in memory, to limit how many requests one connection can make. It does not save it in its database or its logs. Our server runs on Fly.io, and its database is hosted by Supabase, both in the United States. Every hour we save a backup copy of that database in a separate private storage bucket at Cloudflare R2. Each copy is encrypted before it is uploaded, with a key that only we hold, so Cloudflare cannot read it. We use backups only to recover the database if something goes wrong.

Notifications (Expo and Apple)

If you allow notifications, the app tells you when a video is ready. To do that, the app asks Expo's push service for a notification token for this install of the app. That request sends Expo the notification address Apple gave your iPhone for Lantern, the app's ID, our Expo project's ID and a random install ID that Expo's software creates on your iPhone. The app then sends the token with each message to our server, which keeps it with that video chat only until the video is finished (or fails), then deletes it, and never writes it to its logs. When the video is finished, our server sends Expo the token, the title "Lantern", one line ("Your video is ready", or that it could not be finished) and the video chat's ID, and Expo passes it to Apple, which delivers it to your iPhone. Without notification permission, the app sends no token and none of this happens. See Expo's privacy policy.

RevenueCat (Lantern Pro)

RevenueCat runs the Lantern Pro subscription for us. It receives the app's random anonymous ID, your App Store purchase records (what you bought, when, its price, and trial and renewal status) and technical details such as the iOS and app version. Its software also sends the identifier for vendor, an ID that Apple gives our apps on your iPhone. RevenueCat never gets your name, email or payment card. Your subscription belongs to your Apple Account, so Restore purchases brings it back on a new iPhone or after a reinstall. If you installed the app from an ad on the App Store (Apple Ads), Apple tells RevenueCat which ad campaign, ad group and search keyword led to the install, so we can see whether our ads pay for themselves. This is Apple's own ad attribution: it does not use the advertising identifier and needs no tracking permission. Apple handles payment.

PostHog (usage analytics)

We use PostHog to see how the app is used, so we can find problems and improve it. Analytics are on when you install the app, and you can turn them off at any time in Settings, Privacy, Share usage analytics. When they are off, the app sends nothing to PostHog. When they are on, PostHog receives, tied to the anonymous ID:

• four of your setup answers, all picked from a list: which best describes you, what you want to make, where you heard about Lantern and where you post most. Never the name or brand you typed;
• events such as opening the app, setup steps viewed, finishing setup, your notification and camera permission answers, your AI choice, when the subscription screen was shown, each step of buying Lantern Pro (started, cancelled, failed with RevenueCat's error code, or completed, with the offer shown and the product), trials, restores (with the offer shown), when you sent a message for a new video or a change, when the video was ready (how long it took) or failed (an error code), and when you open the share options for a video;
• details the PostHog software adds, such as the app version, iOS version, device model, language, time zone and screen size.

PostHog never receives what you write, your photos, your videos or their titles. Session recording, touch tracking and location lookup from your IP address are turned off. PostHog does not store your IP address.

Sentry (crash reports)

If the app crashes or hits an error, it sends a report to Sentry so we can fix it: what went wrong and where in the app, the device model, iOS and app version, which app update it is running, a random ID Sentry makes for the install, and a short trail of what the app did just before. For about 1 in 10 sessions it also sends performance timings. Reports do not include the anonymous ID. Before a report is sent, the app cuts a failed database save down to the kind of action and the table name, so a report never includes what you were saving. It also leaves out request details and console logs. Sentry does not store your IP address.

Expo (app updates)

Each time the app starts, it asks Expo's update server (EAS Update) whether an update for the app is waiting, and downloads it if there is one. The request carries the operating system, which version of the app's code is running (its runtime version, update channel and update IDs) and a random install ID that Expo's software creates on your iPhone. If the app stopped with an error while it was starting, the next check also sends the text of that error, so a faulty update can be found and undone. Apart from that text, the request does not include your name, an account, the app's anonymous ID or anything you made. Like any server, Expo sees the IP address the request comes from. The check runs for everyone, including while the age protections under Children are on, because it only keeps the app working. See Expo's privacy policy.

Apple

Apple handles the App Store, payments and subscriptions, the age range check described under Children, the full-screen video player, saving videos to Photos, the share sheet, delivering notifications and iPhone backups under Apple's own privacy policy.

Email to support

If you email us, we receive your email address, your message and the details that Contact support adds (app version, iOS version and the anonymous ID). We use them only to help you. We keep support emails for 2 years after your last message, then delete them. Cloudflare forwards them to our Gmail (Google) inbox.

Videos Lantern does not make

Lantern does not make sexual or nude content; anything sexual or exploitative involving minors; content that attacks or demeans people for who they are; content that targets, mocks or threatens a real private person; graphic gore, or content that celebrates or incites violence; content that encourages suicide, self-harm or eating disorders; help with crimes, or with buying or making weapons, drugs or other illegal goods; fake news reports, fake official notices, scams, or videos that pretend to come from a real company, government or public figure or put words in a real person's mouth; or praise or recruitment for terrorist or violent extremist groups.

The check looks for these in what you write before any video work starts. When it finds one, the message is refused, its credits come back and nothing from it is kept. OpenAI's AI may also decline to make a video; the chat then shows that it could not be made. Lantern keeps no count of refused messages, and a refusal never pauses or closes anything. If you think a message was refused by mistake, email us.

Permissions

• Notifications: to tell you when a video is ready, and for one reminder before a free trial of Lantern Pro ends, if you allow them. The app asks during setup.
• Camera: to take a photo to put in a video.
• Photos: to choose a photo or logo, the app opens Apple's photo picker, which gives it only the photo you pick, so Lantern never asks to read your photo library. To save a video to Photos, it asks only to add to your library.

Lantern does not use your location, contacts, microphone, motion or Apple Health.

How long data is kept

• On your iPhone: until you delete it, use Delete my data or delete the app. Photos taken for a video stay in the app's temporary storage until iOS clears it, or you use Delete my data or delete the app.
• Video chats on our server (messages, smaller copies of your photos, and each video's plan, code and voice-over): 90 days after the chat started, or right away when you delete that video in the app.
• Video files and photo copies in storage: about 2 days.
• Your notification token on our server: until the video it came with is finished.
• At OpenAI: up to 30 days, only for misuse checks.
• At ElevenLabs: each voice-over request's record is deleted right after the voice-over is made; copies in ElevenLabs' backups are cleared on its own schedule.
• Request records and usage counts on our server: 90 days (usage counts once their week or day ends; the count of credits used during a free trial is kept longer, so the trial limit works).
• Encrypted backups of our server's database: hourly copies for 3 days and daily copies for 35 days, then deleted automatically. Anything removed from the database, including by Delete my data, is gone from every backup within 35 days.
• Subscription status on our server: until you use Delete my data.
• RevenueCat: for as long as we offer the app, so your subscription can be restored.
• PostHog: up to 1 year, or until you use Delete my data.
• Sentry: 30 days.
• Expo: only as long as Expo reasonably needs it, as its privacy policy says; it names no fixed period.

Delete my data

Open Settings, tap Privacy, then tap Delete my data. The app deletes everything it saved on your iPhone right away (your list of videos, the videos and photos it saved, the pictures it cached, your answers and your choices) and starts again from the beginning. Analytics are turned off on that iPhone until you turn them on again in Settings, Privacy. Videos you already saved to Photos or shared stay where they are, and so does a scheduled reminder before a free trial ends, because your subscription stays active. Then it asks our server to:

• ask PostHog to delete your analytics profile and its events;
• delete your video chats (with the copies of your photos and each video's plan and code), every file of yours in storage (videos, their pictures and photo copies) and your subscription status record;
• remove the scrambled ID from your request records, so they can no longer be tied to you (they are still deleted at 90 days);
• delete your usage counts that no longer apply. Counts for limits still running (today, this week and a free trial) stay so the limits keep working.

Backups made before the deletion still hold the old records until those copies are deleted, at most 35 days later. Nobody can read a backup without our encryption key, and we use backups only to recover the database after a failure.

If your iPhone is offline or our server cannot be reached, the app tries again by itself. While the deletion is waiting for our server, Settings, Privacy shows it and offers Email support. If you delete the app before then, it can no longer finish this step, so first email us from Contact support in Settings, Help and feedback (it adds the anonymous ID we need) and we will delete the server copy.

Delete my data does not cancel your subscription, and it does not delete RevenueCat's purchase record, so the next time the app checks your access our server gets your subscription status from RevenueCat again. To ask for your RevenueCat record to be deleted too, email us.

Delete my data does not reach Expo either. Its update checks and notification tokens are tied to Expo's own random install ID, which we never see, so we cannot find them for you. Deleting the app removes that ID from your iPhone.

Your requests

You can email support@wavistaapp.com to ask what we hold about you, or to delete it. Send the email from Contact support in the app so it includes the anonymous ID; we cannot find your data without it, because we do not know your name. We reply within 30 days.

What we do not do

We do not sell your personal information or share it for advertising. We do not use face recognition or identify anyone in your photos. The app has no ads and does not track you across other companies' apps or websites.

The app does not track you across other companies' apps or websites, so there is nothing for a Do Not Track signal to turn off, and the app does not respond to one.

Children

Lantern is not directed to children under 13, and we do not knowingly collect data from them. If you think a child has used the app, email us and we will help delete the data.

Where the law requires it, the app asks Apple for your age range. The answer stays on your iPhone, is used only to apply age protections, and is never sent to us or anyone else. If Apple says you are under 13, if you choose not to share your age range where it is required, or if iOS cannot tell the app at launch whether the law requires asking (for example with no Apple Account signed in, or no answer within 3 seconds) and the app has no earlier answer saved, the app turns off usage analytics, Apple Ads attribution (see RevenueCat above), and everything that sends what you make to our server: video chats (which also go on to OpenAI and ElevenLabs) and rendering a video again. Videos already on your iPhone still play, save and share. The app also offers no subscription, because making videos would not be available. Restore purchases still works, and purchases made earlier are not changed. In the last case, these protections last until a launch where iOS can tell. If you chose not to share your age range where the law requires asking, a Share age range button, shown when a feature is not available, lets you ask Apple again.

Security and where data is processed

The app talks to our server and service providers over encrypted connections (HTTPS). Video files and photo copies are stored privately and can be opened only through a private link that expires after 24 hours. Our renderer has no public address, and it answers only requests that carry our secret key. Our server stores the anonymous ID only in scrambled form, except in the subscription status record. Our server, its database, our renderer and our service providers process data in the United States. Video files and photo copies are kept in Cloudflare R2's Eastern North America region. Database backups are encrypted before upload and kept in Cloudflare R2's Eastern North America region.

Changes to this policy

If we change this policy, we will post the new version here with a new effective date. If a change affects how we use data you already gave us, we will tell you in the app first.

Contact

support@wavistaapp.com

Back to top