Neron App Studio

1. Introduction

NERON ("we", "our", or "us") operates the Persona AI mobile application (the "App"). Persona AI lets you create an AI character from a photo and turn a script into a talking-head video. This Privacy Policy explains what information the App collects, how we use it, who receives it and how long it stays. Persona AI does not ask you to register an account or give your name or email address.

Versions. This policy describes Persona AI version 1.0.2 and later. Android version 1.0.0, the first release, works differently in the places marked "Version 1.0.0"; a sentence with no version mark applies to both.

2. Information We Collect and Where It Goes

2.1 Your photo

You pick one photo for each character, from the camera or your photo library.
In version 1.0.2 and later, before you can pick a photo, the app asks you to tick two boxes: "I took this photo or have permission from the person in it. I will not upload a photo of a celebrity, public figure, minor or anyone who has not agreed." and "I am 13 or older." The time you ticked the first box is stored with the character on your device. The app does not check whose face is in the photo or whether your answers are true; it relies on them. Version 1.0.0 does not ask these questions and stores no such time. Our Terms of Service (sections 6 and 7) also forbid content that impersonates real people without their consent and uploads you have no right to use.
The photo is kept on your device as part of the character.
Each time you generate a video, the photo is uploaded to our AI provider, fal.ai, and used there as a reference image (with the model nano-banana-2/edit) to generate your character's image.
Persona AI does not run face detection, face recognition or face tracking on the photo, and does not create or store a face template or embedding from it. To the app it is an ordinary image.
We do not use your photo to train any model of our own, and the app does not send it to any model-training job.
Where the photo is kept and for how long is described in 2.2 and section 5; how to delete it, in section 7.

2.2 Your script and your videos

The script text you write is sent to AI providers to produce speech and the talking-head video. We run these models on fal.ai: minimax/speech-02-hd (text to speech), nano-banana-2/edit (the character image, made from your photo) and veed/fabric-1.0 (the talking-head video).
The app sends the generated character image and the generated audio to the video model to make the video.
In version 1.0.2 and later, when it needs access to fal.ai (for example to start a generation), the app asks our own server (a Google Cloud function) for it. Like any server, it sees your device's IP address. Our code uses a scrambled (hashed) form of the IP address, and of the anonymous id in 2.8, to limit how many requests one network or one app install can make per day, and does not store the address itself. Separately, Google Cloud's standard request log for these functions records each request with its IP address and the app's user-agent text, and keeps it for 30 days.
In version 1.0.2 and later, our server's own log lines for a generation request record: hashed forms of the IP address and of the anonymous id, the AI model asked for, the result code, your plan tier, fal.ai's request number with an estimated cost, for a talking-head video its billable seconds and its audio seconds, and, when fal.ai rejects a request, only the kind of error and the name of the field. They do not record your photo or your script text, and of file links only the host name. They are kept for 30 days. The seconds are written for every talking-head video request that goes through our server, whatever the app version; version 1.0.0 does not send its generation requests through our server, so none of these fields appear for it.
Version 1.0.0 works differently here. The app asks our server only for an access key for fal.ai (it sends a code built into the app, not an account or an id), and then sends your photo, your script and the generated files straight from your device to fal.ai with that key. Our server does not receive them. Like any server, it sees your device's IP address. Our code keeps, for each day, a count of how many keys one network and all networks together received, using a scrambled (hashed) form of the IP address and not the address itself. Our server's log line for each key records the day, those counts, the hashed IP address and an id of the key; it records no photo or script text. These lines and Google Cloud's request log (IP address and the app's user-agent text) are kept for 30 days.
Your finished video is not saved on your device. The app keeps a link to the video file hosted by fal.ai and plays it from that link. If you use Share, the link to the video is what gets shared.
fal.ai's own documentation states that generated files stay on its servers for at least 7 days by default and that the links are public: anyone who has the link can open the file until it expires (https://fal.ai/docs/model-apis/faq). Persona AI does not set this period. Videos are therefore kept online for a limited time and may become unavailable afterwards.
Photos you upload are stored by fal.ai under the same retention controls as generated files (https://fal.ai/docs/model-apis/data-retention).

2.3 Analytics and crash reporting

Persona AI uses Firebase Analytics and Firebase Crashlytics (Google).
Events we record: screens you open; creating and changing scenes, mood, camera angle, environment, format and resolution; choosing a template; creating an outfit or a collection (we send the length of the description or name, not its text); applying filters; switching view; looping or sharing a video; starting, finishing or failing a video generation (with your plan tier and the failure reason); starting a trial or making a purchase (package and product id, platform); and which version of a test you were shown.
We also attach these details: your plan tier, credit balance, streak, number of videos generated and number of characters, plus the app version and device information (device model, operating system version).
The events are linked to a random identifier that the app creates on your device. It is not your name or email.
Firebase may derive your approximate location (country and region) from your IP address when it receives these events.
Crash reports contain the error, where it happened, the state of the device at the time and the details above.
The app has no setting to turn analytics or crash reporting off.
Persona AI checks for app updates through Expo Updates (expo.dev). When it does, your device's IP address and the app version are sent to Expo.

2.4 Measuring our own ads (Google Ads)

Persona AI shows no ads, but we advertise Persona AI elsewhere. To measure those campaigns, the app's analytics are linked to our Google Ads account.
What is used for that measurement: app events (installs, trial starts, purchases) and the device identifiers and the Android advertising ID that go with them. The app includes the Android advertising ID permission for this.
Not exported: your name, email, photos, scripts or videos.

2.5 Notifications

The app can show a notification on your device when a video is ready. It is created on your device, after you allow notifications, and does not need our servers.
The app also includes Firebase Cloud Messaging, which may create a messaging token for your device. Our app does not send that token to our servers and does not send push messages.

2.6 Reporting a video

In the app you can report a video from the video player: pick one of four reasons and, if you want, add a note.
In version 1.0.2 and later, the report contains: the video's address (the link to the file, cut off at any "?" or "#"), the reason, and your optional note of up to 300 characters. The app sends nothing else in the report: no photo, face, device or account data. The app signs the request with its anonymous Firebase id (2.8) so our server can check that it comes from the app; the stored report holds neither that id nor your IP address. The request that carries it appears in the 30-day request log described in 2.2, which includes the IP address.
Version 1.0.0 sends the id the app uses for the video (in some cases the link to the video file, without any cut-off), the reason and your optional note. Its request also carries the app version and the platform, which our server ignores and does not store. It signs the request with a code built into the app instead of an anonymous Firebase id. The stored report holds the id or link, the reason and your note, but not the app version, the platform or your IP address; the 30-day request log (2.2) includes the IP address.
Reports are kept for 180 days and then deleted automatically (Firestore time-to-live; the deletion itself can lag by about a day).
To limit abuse, the server accepts at most 10 reports per day from one IP address and counts them. It keeps only a hashed (scrambled) form of the IP address and the count, never the address itself. That counter is set to expire 24 to 48 hours after it is written, and Firestore can take up to about a day more to delete it.
You can also report a video by email to [email protected]; then we receive the address you write from.

2.7 Payment data

Subscriptions and purchases go through Apple (App Store) or Google (Google Play). We do not collect, process or store payment information such as card numbers or billing addresses.
We use RevenueCat to check what you have bought and unlock it. RevenueCat identifies you with an anonymous id, not an account. We receive purchase confirmation data such as subscription status.

2.8 No account

There is no account. The "Continue" screen creates the random identifier on your device, and nothing is sent to us for it. In version 1.0.2 and later, the first time you use AI generation, the app also signs in anonymously with Firebase Authentication (Google), which creates a second random id with no name or email. The app sends it with each generation request so our server can count your allowance. Version 1.0.0 does not sign in and creates no second id.
We do not collect your name or email address in Persona AI. If you write to support, we receive the address you write from.
Persona AI does not show ads and does not use your microphone.

2.9 Face data

What is collected: the one photo you pick for each character. It shows a face (yours, or whoever is in the photo you choose). That is the only face data the app handles.
What the app does not do: Persona AI does not run face detection, face recognition or face tracking on the photo, and does not create or store a face template, faceprint or embedding from it. To the app it is an ordinary image.
Use: only to make your character's images and videos. Each time you generate a video, the photo is uploaded to our AI provider, fal.ai, and used there as a reference image (model nano-banana-2/edit); the image made from it goes to the video model (veed/fabric-1.0). We do not use the photo for advertising or analytics, and we do not use it to train any model of our own: the app sends it to no model-training job.
Sharing (version 1.0.2 and later): the photo goes from your device straight to fal.ai's storage. Our server does not receive the contents of the photo. It sees only the request to start the upload (file type and name) and the later requests that start a generation, which carry the link to the uploaded photo and your script text; it passes them on with our own fal.ai key and stores neither, apart from the counts and technical details in 2.2 and section 5. The app sends the photo to no other third party.
Sharing, version 1.0.0: the photo goes from your device straight to fal.ai's storage, with the access key described in 2.2. Our server is not involved in the upload and never sees the photo or its link. The app sends the photo to no other third party.
Where it is stored: on your device as part of the character, and at fal.ai as an uploaded file. Our servers store no photo, no generated image and no face data. Section 5 lists the usage counters our server does keep; they contain no image and no face data.
How long: on your device until you delete the character or remove the app. At fal.ai: the app sets no expiry of its own for the uploaded photo, so it is kept under fal.ai's default retention controls (https://fal.ai/docs/model-apis/data-retention). When we last read that page (October 16, 2026), it gave no fixed default duration for uploaded files and said request inputs and outputs are stored for 90 days by default. We do not control these periods.
Deleting it: delete the character in the app to remove its photo from the app's data on your device (a cached copy may stay until you clear the app's storage or remove the app). We hold no photo on our servers, so there is nothing for us to delete. The app has no tool to delete the copy at fal.ai; fal.ai's privacy policy (https://fal.ai/privacy) points to its Privacy Center (privacy.fal.ai) and to [email protected] for privacy requests; you can also write to us at [email protected].
Permission: in version 1.0.2 and later, before you can pick a photo you must tick that you took it or have permission from the person in it (see 2.1). The app does not verify who is in the photo. Version 1.0.0 does not ask for this.

3. How We Use Your Information

To provide and maintain the App's functionality
To generate your character images, speech and videos with our AI provider
To manage subscription status and credit balances
To improve the App through analytics and crash reporting
To count each install's allowance (version 1.0.2 and later) and limit abuse (server counters, see section 5)
To measure our own advertising campaigns (see 2.4)
To diagnose technical issues and improve stability

4. Third-Party Services

We use the following third-party services to operate the App:

fal.ai: AI image generation, speech synthesis and video generation, with the models named in 2.2. Files and requests are kept by fal.ai as described in section 5. fal.ai Privacy Policy: https://fal.ai/privacy
Firebase Analytics (Google): usage analytics and the Google Ads measurement described in 2.4. Firebase Privacy Policy
Firebase Crashlytics (Google): crash reporting. Firebase Privacy Policy
Firebase Cloud Messaging (Google): notification token (see 2.5). Firebase Privacy Policy
Firebase Authentication (Google): the anonymous sign-in described in 2.8 (version 1.0.2 and later). Firebase Privacy Policy
Google Cloud (Cloud Functions, Firestore, Logging): our server, described in 2.2, 2.6 and section 5. Google Cloud Privacy Notice
Google Ads: measurement of our own campaigns (see 2.4).
RevenueCat: subscription and in-app purchase management. RevenueCat Privacy Policy
Expo Updates (expo.dev): checks for app updates (see 2.3).
Apple App Store and Google Play: purchases.

5. Data Storage and Retention

On your device: your characters, their photo references, your scripts and the links to your videos are stored on your device. Deleting a character or a video in the app removes it from the app's data on your device; a cached copy of a photo you picked may stay until you clear the app's storage or remove the app.
At fal.ai: uploaded and generated files expire on fal.ai's schedule (generated files for at least 7 days by default, see 2.2), and request inputs and outputs (the text and file links sent with a generation, and what comes back) are stored for 90 days by default (https://fal.ai/docs/model-apis/data-retention, read October 16, 2026).
On our server (Google Cloud Functions in europe-west1, with Firestore): no photo, generated image, script text or video is stored. For version 1.0.2 and later, the server keeps records under the anonymous id that Firebase Authentication (Google) creates when the app first uses AI generation: how many images and how many seconds of video that id has used (lifetime counters for the free and trial allowance, and rolling one-week entries), the request numbers and charges of recent image and speech requests (entries older than 24 hours are removed the next time that id makes a request), the link and length of recently generated speech audio (30 minutes, removed the same way), and the last 20 script lengths with the measured audio length (numbers only, not text). These per-id records have no automatic deletion date. The server also keeps daily request counters under hashed forms of the IP address and of that id; Firestore deletes them about two to three days after the day they count. Video reports are kept 180 days and the hashed-IP report counters expire 24 to 48 hours after they are written (details in 2.6). None of these records holds a name, email, photo or script text.
Version 1.0.0 leaves no records under any id: our server only keeps the daily key counters under a hashed form of the IP address and the daily total (see 2.2), which Firestore deletes about two to three days after the day they count.
Logs: Google Cloud's request log (IP address, user-agent text) and our own log lines (2.2) are kept for 30 days.
At Google (Firebase) and RevenueCat: data is kept under those providers' own policies.
The app has no button to delete data held by fal.ai, Google Firebase or RevenueCat.

6. Data Transfers

When you use AI generation features, your photo, script and generated files are sent to fal.ai for processing. Firebase, RevenueCat and fal.ai may process data outside of the European Economic Area (EEA).

7. Your Choices

You can delete the characters and videos stored on your device in the app, or remove the app. To ask us to delete what we hold on our servers (we hold no photo; usage counters under an anonymous id, see section 5, which the app does not show you, so we cannot match them to a request; and video reports, see 2.6), use https://neron.app/products/persona-ai/delete-data. For anything else, including questions about your data, write to [email protected]. We do not have a self-service tool for data held by fal.ai, Google or RevenueCat. fal.ai's privacy policy (https://fal.ai/privacy) points to its Privacy Center (privacy.fal.ai) and to [email protected] for privacy requests. If you think your rights have been violated, you can complain to your local data protection authority.

8. Children

Persona AI is not meant for children under 13. In version 1.0.2 and later the app asks you to tick "I am 13 or older" before you can add a photo; it does not verify your age. Version 1.0.0 does not ask. If you believe a child has sent us information, write to [email protected].

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically.

10. Contact Us

If you have questions about this Privacy Policy or about your data, contact us at: [email protected]