Legal
Privacy Policy.
This Privacy Policy explains how FirstTakes (“FirstTakes”, “we”, “us”) collects, uses, and protects your personal data when you use our mobile app and related services (the “Service”). It also explains your rights under the EU General Data Protection Regulation (GDPR) and other applicable laws.
1. Who we are (data controller)
The data controller responsible for your personal data is:
- Briek Keters
- Blekersstraat 2, 8500 Kortrijk
- Privacy contact: privacy@firsttakes.app
If you are in the EU/EEA, our lead supervisory authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), unless your local authority is competent for your complaint.
2. Who can use FirstTakes (age requirement)
FirstTakes is for users aged 13 and over. We do not knowingly allow anyone under 13 to create an account, and we collect a date of birth at sign-up to enforce this. In countries where the age of digital consent is higher (up to 16 in parts of the EU), users below that local age may need a parent or guardian’s consent for any consent-based processing; we rely on contract and legitimate interests for the core service so it works without such consent, and gate optional processing accordingly.
If you believe a child under 13 has given us personal data, contact privacy@firsttakes.app and we will delete it.
3. What data we collect
| Data | Why we have it | Source |
|---|---|---|
| Email and password (password is hashed by our auth provider) | Create and secure your account | You |
| Display name and handle | Your public profile; how friends find you | You |
| Profile picture (avatar), if you add one | Your public profile | You |
| Date of birth / age band | Age-gating and minor protections | You |
| Your 5-second videos and their thumbnails (which may show faces, voices, and surroundings) | The core feature — sharing your daily take with friends | You |
| Captions | Optional text on a take | You |
| Friend graph (requests, friendships, blocks) | The social features | You |
| Reports you file | Safety and moderation | You |
| Device push token / topic subscription | Sending the daily-challenge drop and interaction notifications (comments and 👍/👎 on your takes) | Your device |
| Technical and diagnostic data (e.g. app version, crash data, coarse usage) | Keeping the app working and secure | Automatic |
We do not perform facial recognition or other biometric identification on your videos.
4. How we use your data and our legal bases (GDPR Art. 6)
- To provide the Service — create your account, post and deliver takes to your friends, run the post-to-unlock feed, maintain streaks and the friend graph. Legal basis: performance of a contract.
- Safety and moderation — operate reporting, blocking, and content removal; prevent abuse, fraud, and illegal content. Legal basis: legitimate interests and legal obligation.
- Security — protect accounts and infrastructure (e.g. App Check, abuse prevention). Legal basis: legitimate interests.
- Notifications — send the daily-challenge push if you allow notifications. Legal basis: consent (device permission); you can turn it off any time.
- Communications — respond to your requests and send essential service messages. Legal basis: contract / legitimate interests.
- Legal compliance — respond to lawful requests and meet our obligations. Legal basis: legal obligation.
We do not sell your personal data, and we do not use it for third-party advertising.
5. Who we share data with
- Other users. Your display name, handle, avatar, and the takes you post are shown to the friends you are connected with (takes are visible to an accepted friend only after they have posted their own take that day). Your handle is discoverable so people can add you.
- Service providers (processors) acting on our instructions:
- Google (Firebase) — authentication, database (Cloud Firestore), file storage (Cloud Storage), serverless functions (Cloud Functions), and push messaging (FCM). Google acts as our processor under a Data Processing Agreement. EU data is hosted in the europe-west1 (Belgium) region where configured.
- Apple / Google — if you sign in with Apple or Google, that provider processes your sign-in.
- Legal and safety. We may disclose data where required by law, to enforce our Terms, or to protect users’ safety.
We do not otherwise share your personal data with third parties.
6. International transfers
Our infrastructure is configured for EU hosting. Where a provider processes data outside the EU/EEA, transfers are covered by appropriate safeguards (e.g. the European Commission’s Standard Contractual Clauses and/or an adequacy decision). Contact us for details.
7. How long we keep data
- Takes are ephemeral by design. Videos, thumbnails, and their records are automatically deleted after 14 days by a scheduled clean-up job.
- Account data (profile, handle, friend graph) is kept while your account is active.
- Data exports you generate are stored briefly and delivered via a link that expires within about one hour.
- When you delete your account, we erase your data across our database, file storage, and authentication system, and from backups within the normal backup-rotation window.
- We keep limited records longer only where necessary for legal, security, or accounting reasons.
8. Your rights
Subject to applicable law, you have the right to:
- Access a copy of your data — available in-app via Settings → Export my data.
- Rectify inaccurate data — edit your display name and avatar in Edit profile.
- Erase your data — Settings → Delete account permanently deletes your account and content. This cannot be undone.
- Restrict or object to certain processing.
- Data portability — your export is provided in a structured, machine-readable (JSON) format.
- Withdraw consent — e.g. turn off notification permissions in your device settings at any time, without affecting prior processing.
- Complain to a supervisory authority (for EU users, the Belgian Data Protection Authority or your local authority).
To exercise any right not covered by an in-app control, contact privacy@firsttakes.app. We respond within the timeframes required by law (generally within one month under GDPR).
9. Security
We protect your data with encryption in transit and at rest, strict access rules that limit who can read takes (videos are delivered only through short-lived, access-checked links), app attestation to block non-genuine clients, and least-privilege access for our backend. No system is perfectly secure, but we work to protect your information and will notify you and regulators of a qualifying personal-data breach as required by law.
10. Notifications
If you allow notifications, we send a push when the daily challenge drops. You can disable notifications at any time in your device’s system settings.
11. Changes to this policy
We may update this policy. If we make material changes, we will notify you in the app or by other reasonable means and update the “Last updated” date above.
12. Contact
Questions or requests: privacy@firsttakes.app
Postal: Briek Keters, Blekersstraat 2, 8500 Kortrijk