Email: henri.irmscher@gmail.com
A data protection officer is not legally required and has not been appointed.
Mr. Viral has no sign-up. On first launch the app signs in anonymously with our backend (Supabase, anonymous sign-in). This creates a random ID that is stored on your device. That ID serves one purpose only: linking your analyses to your device so that nobody else can reach them.
We never learn your name, your email address or your phone number. The ID is not linked to any other service. There is no login and no password recovery.
Important: because there is no account, everything hangs on that ID. If you delete the app, sign out inside the app or switch to a new device, the old ID is gone — and with it your access to your history. The data itself is still with us, but nobody can retrieve it any more. If you want it erased there too, write to us beforehand (see Delete data).
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Anonymous device ID | Links analyses to your device and blocks access by others | Art. 6(1)(b) GDPR (performance of a contract) | Until erased at your request |
| The video you submit for analysis | Basis of the analysis | Art. 6(1)(b) GDPR | Deleted from our storage and at Google immediately after the analysis. If an analysis is aborted, the app clears the uploaded file itself |
| Preview image (a single frame from your video) | Keeps the analysis recognisable in your history after the video has been deleted | Art. 6(1)(b) GDPR | Until erasure |
| Hook and script text you type in | Basis of the analysis | Art. 6(1)(b) GDPR | Until erasure |
| Analysis result (score, category breakdown, the AI's text) | Shows you the result and your history | Art. 6(1)(b) GDPR | Until erasure. If you hide an entry in the app, the row stays as a counter for your allowance — see below |
| Optional profile details (display name, bio, TikTok handle) | Shows your profile in the app. Purely cosmetic, we do not verify any of it | Art. 6(1)(b) GDPR | Until erasure or until you clear the field |
| Usage counters (number of analyses per day and month) | Meters your allowance and prevents abuse of our AI budget | Art. 6(1)(b) and (f) GDPR | Until erasure |
| Subscription status and purchase data (product, store, term, RevenueCat ID) | Unlocks the paid features | Art. 6(1)(b) GDPR | Until erasure. Messages from the subscription service are removed after 90 days |
| Usage statistics (anonymous ID, device model, operating system, app version, language, screens opened, actions taken such as “analysis started” or “paywall opened”, score band, error and crash reports) | Understanding which features are used and where the app stalls or crashes; comparing design variants (A/B tests). Never the content of your videos, hooks or scripts, no file names | Art. 6(1)(a) GDPR, § 25(1) TTDSG — consent via the consent form, can be switched off in the profile at any time | 12 months, then deleted automatically. The IP address is discarded on receipt |
| Advertising data (the device's advertising ID, IP address, approximate location, delivery details) | Serving the short ad videos that unlock an analysis in the free version. Personalised only with your consent, otherwise non-personalised | Art. 6(1)(a) GDPR (consent via the consent form); non-personalised ads on the basis of Art. 6(1)(f) GDPR | By Google under its own privacy policy; we store none of it |
| Ad credit (anonymous ID, identifier of the ad watched) | Google confirms to our server that an ad video was watched to the end; that confirmation becomes your credit for one analysis | Art. 6(1)(b) GDPR | Until deletion |
| Technical server logs (IP address, timestamp, error code) | Operation, troubleshooting, abuse prevention | Art. 6(1)(f) GDPR (legitimate interest) | Short-term, then deleted automatically by the provider |
None of this becomes a profile of you. Usage statistics are only evaluated in aggregate — which variant works better, how many analyses are started — never to judge you as a person.
When you swipe an analysis away in your history, it disappears from the app but the row stays on the server. The reason: your monthly allowance is metered by counting your analyses. If swiping deleted the row, the allowance would be unlimited. The app points this out when you confirm. Permanent erasure happens on request — the Delete data page explains how.
So you can follow the path your material takes:
Videos may be at most 90 seconds long and 50 MB in size. If an analysis fails before it ever reaches the server, the app clears the uploaded file itself.
The actual scoring is done by an AI model from Google (Gemini API). What goes there:
No ID, no name and no other identifier of yours goes with it. Google only receives the content and does not know who it came from.
Google runs this interface on its own infrastructure, including outside the EU. An uploaded video file is deleted at Google by us right after the analysis. For paid use of the Gemini API, Google undertakes not to use the submitted content to train its models. Mr. Viral uses the interface on a paid basis.
Please do not upload or type in anything you would not show to an external AI service. Details on what Google does with the data are in Google's own terms for the Gemini API.
To pick a video, Mr. Viral opens your operating system's file picker. The app gets no access to your whole gallery, only to the file you tap yourself. We do not scan your gallery and upload nothing you did not select.
If you share a video straight from TikTok, your operating system hands exactly that one file to Mr. Viral. We have no access to your TikTok account, no connection to TikTok, and see neither your followers nor your statistics.
Without a subscription you unlock an analysis by watching a short ad video. The ads are served by Google AdMob. Before the first ad loads, the app shows Google's consent form (User Messaging Platform, following the IAB's TCF standard) in the EU, the EEA and the United Kingdom. There you decide whether ads may be personalised and whether information may be stored on your device. If you decline, you get non-personalised ads — the app works exactly the same. On iOS the system's App Tracking Transparency prompt follows; if you declined in the form, it is not shown at all. You can change your choice at any time under Profile → Ad settings. With Mr. Viral Pro there are no ads.
To see which features are used and where the app stalls or crashes, we use PostHog (PostHog Inc., run on servers in Frankfurt, EU). Transmitted are your anonymous ID, device model, operating system, app version, language, which screens you open and which actions you take — for example “analysis started”, the score band of a result, or whether the paywall was opened — plus error and crash reports. Never transmitted are the content of your videos, hooks or scripts, and no file names. The IP address is discarded on receipt. We use the same data to compare design variants of the app (A/B tests); your anonymous ID is assigned to a variant for that.
The statistics run only if you agreed in the consent form to information being stored on your device (legal basis Art. 6(1)(a) GDPR, § 25(1) TTDSG); outside the scope of the GDPR, where no form appears, they run without one. You can switch them off at any time under Profile → Legal → “Anonymous usage statistics”. Retention: 12 months. There is no profiling, no automated decision-making within the meaning of Art. 22 GDPR and no selling of data.
The app's typeface ships inside the app and is not fetched over the internet.
We use the following service providers, who process data on our behalf:
| Service | Role |
|---|---|
| Supabase | Anonymous sign-in, database, private storage and the server function that triggers the analysis. Database and storage are located in the Ireland region (EU). |
| Google (Gemini API) | Performs the actual analysis. Receives your video or text, but no ID and no details about you. |
| RevenueCat | Manages your subscription. Processes your anonymous ID, the purchase receipt from your app store, product and term, plus technical details about your device. RevenueCat never sees your videos or texts. |
| Google (AdMob, User Messaging Platform) | Serves the ad videos of the free version and provides the consent form. Processes the advertising ID, IP address and delivery details; confirms to our server that an ad was watched to the end, under your anonymous ID. |
| PostHog | Anonymous usage statistics and error reports (see section 7), servers in Frankfurt (EU). Receives your anonymous ID and technical details, never videos or texts. |
| Apple App Store / Google Play | Distribution of the app and payment processing. These platforms collect their own data under their own privacy policies. We receive no payment details from them, only confirmation that a subscription exists. |
| GitHub (GitHub Pages) | Serves this website, meaning the home page and the legal texts. Your IP address appears in the access logs as a result. |
Supabase, Google, RevenueCat, PostHog, Apple and GitHub are US companies; PostHog processes our data on servers in Frankfurt. Even though our database and storage are technically located in Ireland, access from the United States cannot be ruled out. For the Gemini analysis, processing takes place on Google's global infrastructure in any case. The legal basis for this is the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR, unless the provider in question relies on an adequacy decision under Art. 45 GDPR (EU-US Data Privacy Framework). You can request a copy of the clauses at henri.irmscher@gmail.com.
Under the GDPR you have the right to:
You exercise these rights by email to henri.irmscher@gmail.com. We respond within one month.
Important: because Mr. Viral does not know who you are, we can only handle an email request if you include your anonymous ID. Where to find it is explained on the Delete data page. Without that ID we cannot locate your data and, for security reasons, cannot hand anything over (Art. 11(2) GDPR).
You may also lodge a complaint with a supervisory authority. Ours is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany.
Mr. Viral is not directed at children under 16. We do not knowingly collect data from children under 16.
When the app changes, we update this policy. The date at the top shows the current version. We point out material changes inside the app.