THEME Privacy Policy

This Privacy Policy explains how Potential Synergy Inc. ("Potential Synergy," "THEME," "we," "us," or "our") collects, uses, shares, and protects information when you use the THEME website at https://www.thistheme.com and the THEME applications (together, the "Service").

We built THEME to be a creative tool, not a data-harvesting machine. We do not use third-party advertising SDKs, we do not show ads, we do not sell your personal information, we do not track you across other apps or websites, we do not use an advertising identifier, and we do not collect your location. The sections below explain exactly what we do collect and why.

If you have questions, contact us at potentialsynergyvr@gmail.com.

1. Who we are

THEME is a multimodal creative app operated by Potential Synergy Inc. You build "Themes" (projects) out of notes, images, audio, video, and files. Our AI can generate images, audio, video, 3D, and text; power a voice-and-camera assistant called "Sprout"; and produce multi-voice podcast episodes ("Cast") with per-Theme RSS feeds. THEME also includes a public feed and community features where users can share Themes and content.

The data controller responsible for your information is Potential Synergy Inc., [MAILING ADDRESS].

2. Information we collect and why

We only collect what we need to run the Service.

2.1 Account information

• Email address and name, collected when you sign in. We use third-party sign-in (currently Google OAuth), so you authenticate through your provider rather than us holding your password. We use this to create and secure your account, contact you about the Service, and send transactional email.

2.2 Content you create and upload ("User Content")

• Themes, notes, prompts, and uploaded files — including images, audio, video, text, and other files you add to a Theme.
• AI-generated Outputs — the images, audio, video, 3D, text, and Cast episodes the Service produces from your prompts and content.

We process this content to provide core features: storing your work, generating Outputs you request, producing Cast episodes and RSS feeds, running community features you use, and — only where you choose to publish — displaying content in the public feed and public Cast pages/feeds.

2.3 Camera and microphone input (Sprout)

• When you use the Sprout voice-and-camera assistant, we process microphone audio and camera input so Sprout can see and hear what you are working with and respond in real time. We access the camera and microphone only while you are actively using Sprout, and only with the system permissions you grant.

2.4 Bring Your Own Key (BYOK) credentials

• If you connect your own AI provider API key, we store it in encrypted form along with limited metadata (such as the provider name, a label you choose, the last few characters to help you identify it, and validity status). We use it only to perform the generations you request. You can remove it at any time in your settings. We do not display the full key back to you after it is saved.

2.5 Identifiers and device data

• User ID — an internal identifier for your account.
• Push notification device token — if you enable notifications, so we can deliver them.
• Basic device/technical data — such as IP address, browser or app version, and similar information needed to deliver and secure the Service.

These are used to operate your account, secure the Service, and deliver notifications. They are not advertising identifiers and are not used for cross-app or cross-site tracking.

2.6 Purchases

• Purchase history — records of token packs and subscriptions you buy, so we can provision what you paid for and provide support. Payment-card details are handled by Apple or Stripe, not by us (see Section 5).

2.7 Cookies and similar technologies (website)

• On our website we use strictly necessary cookies and similar technologies to sign you in, keep your session secure, remember essential preferences, and operate the site (for example, authentication/session cookies from our sign-in provider). We do not use advertising cookies or third-party tracking cookies. Depending on your region, we will present a cookie notice or controls as required by law.

2.8 Product-interaction usage data

• Server-side product usage data — information about how you interact with features (for example, which features you use and basic operational logs). We use this to operate, debug, secure, and improve the Service. This stays on our own servers; we do not send it to third-party advertising companies.

2.9 What we do NOT collect

• No precise or coarse location.
• No advertising identifier (IDFA) and no App Tracking Transparency (ATT) tracking.
• No cross-app or cross-site tracking.
• No third-party advertising SDKs.

3. Data-collection summary

This table mirrors the App Privacy categories we declare on the App Store.

We do not collect location or advertising data, and we do not track you.

4. How we use your information

We use the information above to:

• create, secure, and operate your account;
• store your Themes and content and let you work with them across devices;
• generate the AI Outputs you request and produce Cast episodes and RSS feeds;
• run the Sprout assistant when you choose to use it;
• run BYOK generations against a key you connect;
• publish content to the public feed and community features only when you choose to share it;
• process purchases and provide customer support;
• send transactional and service-related messages;
• detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms and Acceptable Use Policy; and
• maintain, debug, and improve the Service.

We do not use your content to serve you ads, and we do not sell your personal information.

5. How we share information

We share information only as described here.

5.1 Third-party AI processing (please read)

To generate Outputs and run AI features, the Service sends your prompts and Theme content (which may include text, images, audio, and video you provide, plus Sprout camera/microphone input during a session) to third-party AI service providers — the model and voice providers that perform the generation. These providers act as our processors: they process the data on our instructions to perform the generation and are contractually bound to protect it and not use it for their own unrelated purposes. If you use BYOK, the applicable generation is sent to the provider whose key you connected, under your account with that provider. Avoid putting information into prompts that you do not want processed by these providers.

5.2 Other service providers (sub-processors)

We rely on a small set of infrastructure and service providers to run THEME — such as hosting, object storage, database, payment, push-notification, email, sign-in, and AI providers. They process information only to provide their service to us, under confidentiality and data-protection obligations. We share only what each provider needs.

5.3 Payments

• Apple In-App Purchase handles token packs and subscriptions on iOS. Apple processes your payment; we receive transaction confirmations, not full payment details.
• Stripe handles web checkout. Stripe processes your card data; we do not store full card numbers.

5.4 Public feed and sharing

Content you choose to publish or share is visible to others and, depending on settings, may be publicly accessible (including via public Cast pages and RSS feeds, and may be indexed by search engines and podcast directories). Do not publish anything you want to keep private.

5.5 Legal and safety

We may disclose information if required by law, legal process, or government request, or where we believe disclosure is necessary to protect the rights, safety, or property of users, the public, or Potential Synergy — including to enforce our Terms and Acceptable Use Policy and respond to objectionable content. Certain unlawful content (such as CSAM) is reported to authorities as required by law.

5.6 Business transfers

If Potential Synergy is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

We do not sell your personal information and do not share it for cross-context behavioral advertising.

6. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data under these GDPR Article 6 bases:

• Performance of a contract — to provide the Service (accounts, storage, generation, purchases).
• Legitimate interests — to secure and improve the Service, prevent abuse and fraud, and operate the public feed and moderation, balanced against your rights.
• Consent — for optional features that rely on device permissions, such as camera, microphone, and push notifications, and for any non-essential cookies. You can withdraw consent at any time.
• Legal obligation — to keep records (for example, financial/tax records) and respond to lawful requests.

Withdrawing consent does not affect processing already carried out.

7. International data transfers

We and our service providers may process and store information in countries other than where you live, including the United States. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism. Contact us at potentialsynergyvr@gmail.com for more information.

8. Data retention

We keep personal data only as long as needed for the purposes in this Policy:

• Account data and User Content — while your account is active.
• Purchase and financial records — as long as required for legal, tax, and accounting obligations, even after account deletion.
• BYOK credentials — until you remove the key or delete your account.
• Security and operational logs — for a limited period needed to operate and secure the Service.

When you delete your account (Section 10), we delete or anonymize your personal data and User Content, except for limited records we are legally or financially required to retain. Camera and microphone input used by Sprout is processed in real time and is not retained beyond what is needed to provide the session and any Output you save.

9. Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit, encryption at rest for sensitive items such as BYOK credentials, access controls, and limiting data access to those who need it. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data and respond promptly to incidents.

10. Your rights and choices

Depending on where you live (including under GDPR/UK GDPR and U.S. state privacy laws such as the CCPA/CPRA), you may have the right to: access the personal data we hold; export/port it; correct inaccurate data; delete your account and personal data; object to or restrict certain processing; withdraw consent for camera, microphone, notifications, or cookies; and be free from discrimination for exercising these rights.

10.1 Deleting your account in-app or on the web

You can delete your account directly: in the app, go to the Me tab → Delete Account; on the web, use your account settings. This deletes your account and associated personal data and User Content, except records we must keep for legal or financial reasons (Section 8). Deletion is permanent.

10.2 Other requests

To exercise any other right, email potentialsynergyvr@gmail.com. We will respond within the time required by applicable law and may need to verify your identity first. If you are in the EEA or UK, you also have the right to complain to your local data protection authority. For U.S. state-law requests, you may also have the right to appeal a denied request.

11. Children's privacy

THEME is not directed to children under 13, nor to anyone under the digital age of consent in their region, and is intended for users 17 and older. We do not knowingly collect personal data from children under these ages. If you believe a child has provided us personal data, contact potentialsynergyvr@gmail.com and we will delete it.

12. Changes to this Policy

We may update this Policy from time to time. For material changes, we will update the effective date and, where appropriate, notify you in the app, on the website, or by email. Your continued use after an update means you accept the revised Policy.

13. Contact us

Questions, requests, or concerns about privacy:

Potential Synergy Inc. [MAILING ADDRESS] Email: potentialsynergyvr@gmail.com