Legendary

The policies do not address ownership of any user-submitted data, prompts, or files — consistent with apps that are stated to collect little or no personal data and often work offline. Because there is no express statement on input ownership, this is a silence finding rather than an unfavorable term.

The documents assert that all content within the apps is the vendor's intellectual property but are silent on ownership of anything a user might generate through the apps. For games and offline utilities this is a conventional IP clause, but the absence of any user-generated-content ownership statement leaves the question unresolved.

The policies make no mention of AI model training, and the privacy policy states only anonymised, aggregated platform analytics are used. There is no stated mechanism by which user data would be used to train models, and the product appears not to be AI-based.

The policy describes minimal collection and states no account or personal data is required for most apps, but it provides no retention schedule, no deletion SLA, and no documented deletion request process beyond a general support contact. The low-collection posture mitigates risk, but the absence of any explicit retention or deletion terms is a gap.

The privacy policy explicitly states the vendor does not sell, rent, or share user data with third parties, and does not use advertising SDKs. Payment processing and app distribution are handled by Apple and Google under their own policies, which is disclosed and integral to app distribution.

The policy provides no explicit opt-out mechanism, but the data model largely obviates the need for one: most apps require no account and collect no personal data, and only anonymised aggregate analytics are used. The absence of a formal opt-out process is a gap, though mitigated by the minimal collection.

No compliance frameworks or certifications are mentioned anywhere in the supplied documents. The vendor is a New Zealand company processing data that may implicate GDPR and other universal-baseline frameworks, yet none are referenced. As a consumer app studio, sector-specific frameworks are not expected, but the complete absence of universal-baseline references warrants a RED under the stated rubric.

The documents contain no reference to AI models, model behavior, or enterprise auditing, consistent with a product that does not appear to be AI-based. There is therefore no transparency or audit capability described, which is a silence finding.

The policies disclose no specific security controls — no encryption, access control, penetration testing, bug bounty, or incident response details — and reference no security page or trust center. No breaches are disclosed. The minimal-data model reduces the attack surface, but the total absence of documented security practices is a gap.

The terms explicitly state apps are for personal, non-commercial use only, and no enterprise or paid-tier data-handling distinctions are described. There is a single consumer posture, so no adverse tier delta exists.

The policy describes no human review of user inputs or outputs, and states personal data is collected only when a user directly contacts support. Given that most apps collect no personal data and work offline, there is no described mechanism for staff to access user content.

The documents make no reference to government data requests, law enforcement cooperation, or litigation. The governing-law clause sets New Zealand jurisdiction for disputes. Silence on data requests is typical for a minimal-collection app but leaves the vendor's practices undocumented.

The privacy policy affirmatively lists categories it does NOT collect — name, email, contact details, location, payment data — and states most apps require no account. Only anonymised, aggregated analytics are used, and no SPI is collected. This is a strong minimal-data posture clearly disclosed.

Both policies are dated 1 May 2026, well within 12 months of the analysis date, which is favorable on recency. However, the product surface is pre-launch ('Our first apps are coming soon') and too thin to establish AI or other capabilities, so coverage cannot be confirmed; per the insufficient-evidence rule the rating is capped at YELLOW. Notably, nothing in the policies or marketing indicates an AI/ML product despite the subject being framed as an AI tool.

Two documents were supplied — a Privacy Policy and Terms of Use — and no contradictions were found between them. Both share the same effective date, the same corporate entity, and consistent statements on in-app purchases, data handling, and governing scope.