Privacy Policy

Xheki: Video Editor & Recorder (iOS app) · Effective 4 October 2026 · Version 1.4

1. Who is responsible

The controller for the personal data described here is:

MIK Group GmbH
Leutschenbachstrasse 95
8050 Zürich, Switzerland
Commercial register of the Canton of Zurich: CH-440.4.024.833-4 · UID CHE-188.366.328
Email: [email protected]

This policy covers the Xheki iPhone app as distributed on the App Store and the server it talks to. "We" means MIK Group GmbH.

2. What stays on your iPhone

These are stored only on your device, and we never receive them (what follows your account to your other devices is listed in section 3):

• your recordings, imported clips, projects and edits;
• finished videos (saved to your Photos library when you export, or shared by you with the share sheet);
• the plain thumbnail and the choice of the best frame. The app uses Apple's on-device Vision framework to judge how clear a face is in a few frames. This is not face recognition: nobody is identified and nothing leaves the device;
• pause detection and the offline spelling rules;
• if you choose "On this iPhone" for the spelling pass, Apple's on-device language model processes the caption text on the device.

If you turn on iCloud sync in Settings, your projects are also kept in your own iCloud account, run by Apple under Apple's privacy policy; we have no access to it.

Your sign-in session is kept in the iOS Keychain. Uninstalling the app removes local projects; back up anything you want to keep by exporting it to Photos.

3. Account, credits, purchases and feedback

You can record, edit and export without an account. The app asks you to Sign in with Apple when you use captions, AI features, purchases, Account, Publish or synced features, because credits, purchases and your ideas belong to your account and credits and purchases are kept on our server. Your account holds your credits (the free ones, Premium's monthly credits and credit packs) and your Premium status, and is needed for the AI features and the picture search. The app also checks your subscription with Apple on your iPhone (StoreKit).

What follows your account to your other devices

So that another iPhone you sign in to with the same account has your creator setup, whatever iCloud it uses, the app keeps a copy of these on our server, linked to your account:

• Notes you create (Ideas): their text, the AI's refined version, the voice-note transcript, done state, the projects and workspace they belong to, and their photos, videos and voice notes (up to 2 GB per account);
• Brand kits, outros, edit formats and logos you create, with their pictures and clips;
• Your settings and preferences: setup answers (language, spelling, AI permission and when you gave it), caption and spelling settings, word lists, the teleprompter script and its settings, the description of your writing style ("Make captions sound like you"), your caption-fix decisions, recording and editing preferences, sound favourites, the Publer workspace, groups, mentions and the accounts you mark as yours or as collabs in Analytics, today's AI video ideas and how many you asked for, and your Publer API key (encrypted, handed back only to your signed-in devices).

They are stored by our hosting provider Cloudflare (database and file storage, encrypted at rest) and used only to sync your devices. Something you delete in the app is deleted on the server too, and its last record is purged after 30 days; files no note, kit or outro uses any more are deleted after a day. Deleting your account deletes all of it. Your projects and videos are not uploaded: they stay on your device, and in your own iCloud if you turn on iCloud sync. Legal basis: Art. 6(1)(b) GDPR — syncing your devices is part of the service you use.

Feedback you send

Shaking your iPhone, or Settings → Send feedback, opens a form. When you tap send, the app sends us what you typed, the type (bug, idea, other), the app version and build, device model, iOS version, language and screen size. If you are signed in, it also sends a screenshot of the screen you were on (it can show your video, captions or post text — you see it before sending) and the end of the app's log (technical events such as which step failed; no videos or audio), linked to your account. Without an account, only up to 2,000 characters of text are accepted, and the screenshot and log are not sent. We use feedback only to answer you and fix the app. Legal basis: Art. 6(1)(b) and (f) GDPR — you ask us for help, and our legitimate interest in an app that works.

Payments are handled entirely by Apple. We never see your card or bank details. Apple processes purchase data as its own controller under Apple's privacy policy.

4. AI features and who processes your content

These features send content off your iPhone. Each runs only when you start it, and the app asks for your explicit permission before it first sends anything to these providers — on a consent page during setup and again before the first AI use. You can withdraw it in Settings at any time; everything else in the app keeps working without them.

Your content passes through our server, which forwards it to the provider with our own API key and returns the result to your iPhone. Our server does not store your audio, text or images. The providers act as our processors: they may use the content only to provide the service to us, not to train their models.

Captions — speech recognition or OpenAI

When you tap Captions, the app takes the audio track of your edit, converts it to a sound file and sends it for transcription. The video picture is not sent. Which service receives the audio depends on the language:

• Albanian goes to a speech-recognition service built for Albanian, based in Kosovo. Its terms set no fixed period for keeping the audio and transcript; write to us and we ask it to delete a job.
• Other languages go to OpenAI's speech-to-text model.
• If you choose Auto-detect, three 10-second samples of the audio, taken from across the video, go to OpenAI first, only to recognise the language. The audio is then transcribed by the Albanian speech-recognition service or OpenAI as above.

Either service returns the transcript with timings, which the app turns into captions on your iPhone.

Spelling pass and post text — OpenAI

To rewrite captions in your spelling and tone, and to write the post text and headline for your video, the app sends text to OpenAI: the caption text or transcript, your spelling settings, and the style description, writing samples and notes you keep in the app. No audio or video is sent for this. These features are free but rate limited.

Make captions sound like you. This feature gives you a prompt to copy into your own ChatGPT. What you do in ChatGPT happens in your ChatGPT account, under OpenAI's terms and privacy policy for ChatGPT; we receive nothing from it. Only the description you paste back into Xheki is stored on your iPhone and sent along with caption text as described above. Do not paste anything you would not want sent with your captions.

AI thumbnail (Premium) — OpenAI

When you ask for an AI thumbnail, the app sends one still frame from your video to OpenAI's image model, which returns an edited version. The headline is drawn on your iPhone, not by the model. The frame may show you or other people in the video — only use it with frames you have the right to share.

Publish, Analytics, AI coach and daily ideas — Publer and OpenAI

Publishing is optional; you can always save to Photos or use the share sheet instead. If you connect your own Publer account (a social media scheduling service) in Settings and tap Publish, your iPhone uploads the finished video, its post text and your chosen accounts and times directly to Publer, which posts it for you. With Premium Analytics, the app reads your posts' text and statistics (views, reach, likes, comments, shares, saves, followers) from Publer with your Publer API key, directly from your iPhone. The key is kept in your iPhone's Keychain. For the AI coach and the 5 daily video ideas, the text and statistics of up to 40 of your posts, with your style notes, go through our server to OpenAI, which returns the review and ideas; they are kept on your iPhone. Publer's own privacy policy applies to your Publer account.

Trends for the daily ideas. To suggest ideas about what is trending, the app sends our server your country code (from your device region, e.g. "XK"), your language, a few topics taken from your posts and, only if you turn on Use my city for trends in Ideas (or type a city), your city name. With that switch on the app asks iOS for your approximate location (reduced accuracy) and turns it into a city name on your iPhone; your coordinates are never sent. Our server asks OpenAI (with its web search) what is trending there and in your topics, and also reads Google Trends' public daily list for your country (no data about you is sent to Google). The answer is cached on our server for up to 6 hours, without your account, so others asking about the same place and topics get the same list; it is deleted within a day. The ideas you dismiss, and why, are kept with today's ideas on your devices and in your account.

Under OpenAI's API terms, content sent through the API is not used to train OpenAI's models and may be kept for up to 30 days to detect abuse, then deleted, unless the law requires longer.

Legal basis: Art. 6(1)(b) GDPR — you ask for the feature and we need the provider to deliver it. We do not use your voice or face to identify you.

5. Picture search (Pexels), sound effects and music (Openverse)

Premium includes a search for free stock photos from Pexels. The app has no web browser. The words you type go to our server, which forwards them to Pexels with our API key and returns the results. We do not store your search words, and we send Pexels no account or device details with them. Your iPhone then loads the thumbnails and the picture you pick directly from Pexels' image servers, which see your IP address as any website does. The links "Photos provided by Pexels" and the photographer's name open the Pexels website in Safari, where Pexels' own privacy policy applies. Pexels is run by Canva Germany GmbH, Pappelallee 78/79, 10437 Berlin, Germany. Pictures you add stay in your project on the device.

Sound effects and music. When you search for a sound effect or music track, your iPhone sends the words you type directly to Openverse, an open catalogue of openly licensed media run by the WordPress Foundation, and then plays and downloads the sound you pick from the site that hosts it (for example Freesound). They see your IP address as any website does; we send them no account or device details. Openverse's own privacy policy applies. The pictures the AI editor adds by itself come only from Pexels, through our server.

Legal basis: Art. 6(1)(b) GDPR — you ask for the search.

6. Camera, microphone, Photos and location

• Camera and microphone: to record your videos. Recordings stay on your iPhone; only the audio is sent, and only when you ask for captions (see section 4).
• Photos (read): to import the videos, screen recordings and pictures you pick. This happens on your iPhone; nothing about your library is sent anywhere.
• Photos (add): to save your finished video and thumbnail.
• Location (optional, approximate): only if you turn on Use my city for trends in Ideas, to find which city you are in for trending video ideas. The app asks for reduced accuracy, turns it into a city name on your iPhone and sends only the city and country (see section 4). Without it, the country comes from your device's region.

You can change these permissions at any time in iOS Settings → Xheki.

7. Service providers

We share data with authorities only when the law requires it. We do not sell or rent personal data.

8. Transfers outside the EU

Some providers process data outside the European Economic Area. Where there is no EU adequacy decision for the country, the transfer is based on the EU Standard Contractual Clauses or, for US companies certified under it, the EU–US Data Privacy Framework. The Albanian speech-recognition service is in Kosovo: sending it the audio is necessary to give you the transcription you ask for (Art. 49(1)(b) GDPR, Art. 17 FADP). You can ask us for a copy of the safeguards.

9. How long we keep data

10. Deleting your account

In the app, tap the credits badge at the top of the camera screen to open Account, then Delete account. This immediately deletes your account, email, credits, Premium status and credit history from our server, together with the notes, brand kits, outros, their photos, videos and voice notes, and the settings synced to your account, and ends the link between your Apple ID and Xheki. Backups roll off within 30 days. What we must keep by law (purchase records) and the free-credit marker are kept as described in section 9.

Deleting the account does not cancel an Apple subscription. Cancel Premium in iOS Settings → your name → Subscriptions, or it will keep renewing. Unused credits are lost when the account is deleted.

You can also ask us by email to delete your account (section 16).

11. No tracking, no ads; usage statistics and crash reports

Xheki shows no ads, contains no advertising SDKs, does not track you across apps or websites, and does not share data with data brokers. It does not use Apple's advertising identifier or the device's vendor identifier, and it never asks for tracking permission.

Crash reports (Firebase Crashlytics). When the app crashes, or an export, caption run or publish fails, it sends Google a report: the stack trace or error code, device model, iOS/macOS and app version, build type, and our account ID if you are signed in. Never your videos, captions, texts or file names. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in an app that works.

Usage statistics (Google Analytics for Firebase). Only once you have finished setup and while Settings → Share anonymous usage data is on (you can turn it off at any time; it takes effect immediately). The app then sends events such as "a screen was opened", "captions were made" (with the video's length and language), "an export finished" (length, frame rate, a size range), "a publish started / went live / failed" (number of networks, an error category) and which features were used, together with an app-instance ID, our account ID if you are signed in, device model, OS and app version, and a country/region Google derives from your IP address. Never your videos, captions, post texts, API keys, email address or file names. We use it to see which features are used and where the app fails, not for advertising: ad personalisation signals and Google's advertising features are off. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in improving the app; you can object at any time with the switch, and nothing more is sent from then on.

Settings from our server (Firebase Remote Config). At launch and when you return to the app, it asks Google's Firebase for a few switches we set, for example to pause a feature during an outage or to show a maintenance notice. The request carries an app-instance ID, app version, device language and country, and nothing about you or your content. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in an app that keeps working.

12. Children

Xheki is not directed at children. You must be at least 16 to create an account, or have your parent's or guardian's consent where the law of your country allows a younger age. If you believe a child has given us personal data without that consent, contact us and we will delete it.

13. Your rights

Under the GDPR, and for Switzerland the Federal Act on Data Protection (FADP), you have the right to:

• get a copy of your personal data (Art. 15) and receive it in a portable format (Art. 20);
• have wrong data corrected (Art. 16) and data deleted (Art. 17);
• restrict processing (Art. 18);
• object to processing based on legitimate interest (Art. 21);
• withdraw a permission at any time, for the future (Art. 7(3)) — for AI features, switch the AI permission off in Settings or stop using them;
• complain to a data protection supervisory authority, in particular in the EU country where you live or work. Ours is the Swiss Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.

Write to the email in section 1. We answer within one month. To protect your account, we may ask you to confirm the request from inside the app or from the email address linked to it.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Automatic rate limits only pause requests for a few minutes.

14. Security

All traffic uses HTTPS. The AI providers' API keys live only on our server, never in the app. Your session is stored in the iOS Keychain. Purchases are verified against Apple's signatures before credits or Premium are granted. Access to the database is limited to the people who run the service.

15. Changes

If we change this policy, we will update the date at the top. If a change materially affects how we use your data, we will tell you in the app before it takes effect.

16. Contact

MIK Group GmbH · Leutschenbachstrasse 95, 8050 Zürich, Switzerland
Privacy and support: [email protected]

Terms of Use: /terms