Privacy Policy

Version 1.0.0 · Last updated September 26, 2026

Midfame is a social app for video and photo posts, operated by Vestra AI ehf. (Iceland), which is the controller of this processing. This policy describes the kinds of information we process and why.

What we collect

To provide the service we process information including the following:

• Account data, such as your email address through our sign-in provider (Clerk), and your name and profile picture if you sign in with Google or Apple and allow it; the name, handle and profile photo you choose; your member number; the interests you pick; the member number of whoever invited you, if you tell us; and your time zone, so notifications arrive at a sensible hour.
• Your birthday, to check that you are 13 or older. We keep it only for accounts that pass the check. If you are younger, we keep only the fact that the account is blocked.
• Content, such as the videos and photos you post, their captions, and your comments.
• Activity, such as which posts you watch and for how long, whether you watch them through, what you like, save and comment on, the accounts you mute or block and the posts you hide, and the follows Midfame creates for you from this activity.
• Consent records: which version of these documents you accepted, when, and in which app version.
• Device data, such as a push notification token if you allow notifications.

We do not collect your precise location, and we do not use your device's advertising identifier.

How we use it

We use this information for purposes including:

• Running Midfame: your account, posts, profile, comments and feed, among other things (performance of a contract with you, GDPR 6(1)(b)).
• Automatic follows. Midfame has no follow button. When you keep engaging with a creator's posts (watching them, watching them through, liking, commenting and saving), Midfame follows them for you, and the follow ends again as that engagement fades over time (performance of a contract, GDPR 6(1)(b)).
• Ranking your feed, using how recent a post is, how people who see it respond to it, whether you follow its creator, and how much you engage with that creator (performance of a contract, GDPR 6(1)(b)).
• Sending notifications if you allow them: a daily count of new followers, comments on your posts, when your video is live, view milestones, and new likes. You can turn them off in your device settings (consent, GDPR 6(1)(a)).
• Checking your age with your birthday (legal obligation and legitimate interest in protecting children, GDPR 6(1)(c) and 6(1)(f)).
• Moderation and safety: reviewing reports, enforcing our terms, and preventing spam and abuse, including limits on how many actions an account can take in a period (legitimate interest in a safe service, GDPR 6(1)(f)).
• Meeting our legal obligations.

What other people can see

Your profile (name, handle, photo, member number and follower count), your posts and their captions, and your comments can be seen by other people on Midfame, along with counts of likes, comments and saves on your posts.

Midfame does not show anyone who follows whom, and it does not show you how many accounts you follow. Your birthday, email address, interests, watch activity, and the accounts you mute or block are not shown to other people.

Automated processing

Follows and feed ranking are automated, as described above. They affect what you see and who follows whom inside Midfame, and nothing outside it: we make no automated decisions about you with legal or similarly significant effects in the sense of GDPR Article 22. You can shape them at any time by muting or blocking an account or hiding a post. Moderation decisions such as removing content or suspending an account are made by people, and you can ask us to review one.

Sharing

We share personal data with service providers who process it on our behalf, including: Clerk (sign-in), Convex (database and backend), Cloudflare (storing photos, and processing and delivering videos), Expo, Google Firebase Cloud Messaging and Apple Push Notification service (delivering notifications), and Vercel (hosting this website). If you sign in with Google or Apple, they tell us your email address and, if you allow it, your name and picture. We may also disclose information where the law requires it. We do not sell personal data.

Some of these providers process data outside the European Economic Area. Where they do, the transfer relies on safeguards such as the European Commission's standard contractual clauses or an adequacy decision.

Deletion and retention

We keep your data while you have an account. You can delete any of your posts in the app, which removes the post and deletes its video or photos.

You can also delete your whole account in the app, from the menu on your profile. Your profile, posts and comments disappear at once, and everything is permanently erased after 30 days, a window we keep so you can change your mind: signing back in before then lets you restore the account. The erasure includes, among other things, your profile, posts, videos, photos, comments, likes, saves, watch activity, follows and sign-in identity.

A few categories follow their own rules:

• Consent records are kept as proof of what was agreed, even after an account is deleted.
• Moderation reports are kept for safety and evidence purposes and are not part of ordinary account deletion.

Children

Midfame is for people 13 and older, or older where local law sets a higher minimum. See our Child Safety Standards.

Your rights

Under the GDPR and Icelandic data protection law you can request access to, correction of, or erasure of your personal data, ask for a copy of it, object to or restrict processing, and lodge a complaint with your supervisory authority (in Iceland: Persónuvernd). Email us for any of these.

Changes

If we change this policy in a way that matters, we will update the version and ask you to accept it again in the app.

Contact

Vestra AI ehf. · vestra@vestra.is