Momentum / Publika · 22 October 2026

Publika privacy notice.

This notice explains the community data added when you use Publika. Read it with the cinemaOS Privacy Notice, which covers your Momentum account, billing and the cinemaOS application. Publika does not automatically receive projects, footage, audio, frames, transcripts, prompts or bundled AI output from your Mac. When you choose to share from cinemaOS, the app sends only the stills, clip, caption and the context chips you see in the composer, and, for a problem report, the diagnostics you agreed to in the app; context chips you remove before publishing are not published.

1. Who is responsible

Julien Kerknawi, trading as Momentum Studios, is the controller. Registered establishment: Jules Van Biesbroeckstraat 156, 9050 Gent, Belgium. Enterprise number 0648.946.826; VAT BE0648946826. For privacy requests, email privacy@mntm-studios.com.

2. Data we use

We link your Momentum account identifier and verified account state to your Publika Frame. If you choose to participate, we process your username, Frame details, posts and revisions, stills and clips with their dimensions and duration, captions, credits you give and receive, replies, hearts, reshares, votes, follows, saved items, notification preferences, Club follows and memberships, Discover selections, reports, appeals and moderation decisions. New Publika profiles follow @julien and @publika and follow the Momentum Club by default; you can remove these at any time. Following a Club is a feed preference, not membership. We process direct-message content, shared photos, GIFs, videos, voice notes and delivery state to deliver messages. Chat photos are prepared on your device and location and descriptive metadata are removed before storage. Video compression is offered when your browser supports it; choosing an original video may retain its file metadata. For live calls, we process participant names, call times and connection information; audio and video you choose to enable pass through Cloudflare RealtimeKit and Publika does not record calls. We record necessary session, security and abuse-prevention events, including a trust level that shapes how widely a new account's posts are distributed. We receive files or diagnostics only when you choose to attach them. Uploaded stills are prepared for display; location and descriptive metadata are removed before storage, while colour profiles may remain.

Your shots. Photos and clips you take with Publika's camera (not the ones you pick from your library) wait in Your shots for 30 days, even when you do not post them, so you can come back to them. Only you see them: they have no public address and never appear in Stream, on a Frame, in Clubs or in search. After 30 days a draft is deleted with its picture or clip. After your adult account admission, Publika asks you once whether to keep your shots, with two equal answers: Keep my shots stops your drafts from expiring; Not now leaves them to expire and asks again no sooner than 30 days later. An account without a qualifying date of birth cannot use social features. Existing expiry settings are preserved until the account is eligible or erased. You can change your answer at any time in Settings, Privacy, Keep my shots; turning it off deletes the kept drafts within 30 days. In Your shots you can open, post, save to your phone or delete any shot, or delete them all. We keep the picture or clip, where in the app it was taken, when, when it goes, and your answer. We process them to provide the feature (contract); keeping them longer is only ever your own choice. They are in your data export and deleted when your account is erased.

Your days. When a Same Time photo’s 24 hours end, we keep it for you alone. We keep the picture in three sizes; its day and minute; the prompt; your line; the place if you added one; whether it came from your camera or your library; the names of the people who loved it; and that you took part that day. We keep it so you can come back to your days. That is the feature you use (contract). We do not use your days to suggest people, to rank anything, to recognise faces or for advertising. It stays until you delete it or your account is erased. Turning off Keep my days stops new days being kept. If you say yes to “Your people can look back at your days”, people who saw your photo that day can see it again in their days, until you delete it or say no. We keep that you saw a friend’s day, never a copy of their photo. Your days are stored by Cloudflare in the European Union. Download my days gives you every photo as a file and every day as a list; the download is kept for 7 days. Your days are erased with your account.

Doors. When you open a Door we keep when it was opened, seen and used, the first name you wrote on it (if any, shown only to you), and who came in through it. When you come in, we keep how (a Door and the member who opened it, cinemaOS, a member who has you among the contacts they chose to sync, or a founding member before 15 October 2026); your Frame may show who brought you in. If you wait at the door, we keep the first name you give and the member you name, for 30 days, and tell that member. Daily counts of Door activity carry no account.

Invites. When a member invites you, we keep the first name they typed, the photo of you they chose, a keyed hash of that photo, a keyed hash of the link, when the link was first opened and, once someone taps Come in, a keyed hash of that device. Who sees the photo: the member who invited you, and anyone the link is opened by until someone taps Come in on it; from then on only the member who invited you and the friend on that device. So the member should send the link only to you. The invite and its photo are deleted after 7 days if nobody claims it, at once if you say “Not me” or the member takes it back, and at the claim if the date of birth given is under the minimum age. After “Not me” we keep a keyed hash of that device with the member who invited you, so they cannot invite you again there, and a keyed hash of the photo for 30 days, so the same photo cannot be sent again. If you said Not me, we also keep a keyed hash of the link with the member who invited you for 7 days, so a report you make about that invite still reaches our moderators; then it is deleted. If you come in, the photo becomes your profile picture and you can change it; until you do, we leave you out of public lists of people. When you invite someone, we keep the same about the invites you make. You need no account to say Not me or to report an invite.

Age. Publika is for people 13 and over, or the higher minimum age of the country they join from; a member under 18 has a more limited Publika. When you make a Frame, or provide a missing birthday for an existing account, we keep your declared date of birth, age band and two-letter country of the request. They are not shown on your profile. We use them to enforce the minimum age and prevent a stored underage account from continuing to social features. Older age-band records are preserved accurately; we do not relabel an underage account as adult. Contact support to correct an inaccurate date. Restricted members keep access to data requests, account deletion and appeals. We also retain the versions, time and source of explicit policy acceptance until erasure. For a visitor, the web stores only a 13+ declaration cookie for one day; the native app stores a declaration on the device. These declarations are not identity verification.

What others make of you. When someone names you in a photo, writes a line about you, sends you a post that reminds them of you, puts a word on something of you, suggests you are in a photo, asks whether you and they were together on a Same Time, or writes your line on a Circle's anniversary, we keep who did it, when, what they wrote, and your choice (kept, shown, or "Not really me"), plus any note you add when you keep it. Today may show you one face of someone you already wrote about; we keep which face and on which day, so it does not repeat. Nothing of this is shown in your name before you choose, and either side can take it down.

Circles. In a Circle we keep plans (their title and place are encrypted at rest like messages), each member's answer and who said they were there. They follow the Circle and are erased with your account.

Downloads. We keep your choice whether other members may download your photos and videos (on unless you turn it off for an eligible adult account). A downloaded file is made on the downloader's device and carries a Publika watermark with your @username; we do not keep a record of who downloaded what.

How you use Publika. From the pages you open while signed in, we estimate how long you spend on Publika each day and in which parts (Stream, Today, your Frame, Clubs, Messages and so on), count page views and sessions, and note the platform (web or app), the kind of device (phone, tablet or computer) and the two-letter country of your last visit. Nothing is read from your device for this beyond the session it already needs, and no message content is involved. We also keep a short log of account events (when you made your Frame, changed a privacy choice or asked for your data) with the same coarse context. We use this to understand and improve Publika, keep it safe and show you your own time (legitimate interests). You can object at any time with “Measure how I use Publika” in Privacy and messages: measurement stops and what was measured is deleted. Daily rows are kept 25 months (older underage records retain their shorter 90-day limit) and account events 12 months. Platform-wide daily counts, such as how many messages were sent, carry no account.

Who you message, for suggestions. Only if you turn on “Use who I message to suggest people” (off unless you choose it), and only with members who turned it on too, we keep that the two of you exchanged messages, how many in the last 90 days and when, never what you wrote. We use it only to suggest people your conversation partners follow, with a reason that names nobody (your consent). Turning it off deletes it, and a pair is deleted 90 days after its last message.

For an illegal-content notice we process the exact location, explanation, good-faith confirmation and, except where the child-sexual-abuse reporting exception applies, your name and email. Name, contact and the private receipt capability are encrypted at rest; only its hash is used to authorize receipt access. Your identity is not disclosed to the person whose content you report. The private receipt records acknowledgement, human outcomes and any review. Completed receipts remain available for at least six months from the decision; undecided notices and pending reviews remain available until handled. Delivery records contain an opaque provider acceptance reference, which does not prove inbox delivery. You can also reach a human by email without forwarding private content.

Text checks and human moderation. Publika applies local server-side text rules to selected patterns of sexual exploitation, targeted hate and direct threats before publication or delivery. Ordinary text is not copied to a moderation archive. A blocked attempt creates a moderation notice and a restricted, encrypted copy of the flagged text for human review. The text is removed after 7 days unless an appeal is pending; appeal evidence and the screening record expire after at most 186 days. The separate moderation decision follows the normal moderation ledger retention period. A member can ask for human review through Moderation and appeals. We do not send text or media to a separate AI moderation provider. To prevent repeat uploads, Publika also blocks exact file matches to media a human moderator has confirmed as sexual exploitation, explicit sexual content, graphic violence or targeted hate. A SHA-256 file fingerprint, category and decision reference remain with the moderation action for its normal 24-month retention period, subject to open-case requirements. Account erasure removes the identity link; reversal of the decision releases the block. No extra copy of the file is kept for this check. New images, videos and audio are not automatically classified for objectionable content. In-app reports and the compliance officer’s review process cover those concerns. Calls are not recorded by Publika.

3. Visibility

Your Frame is public, including who brought you in when it shows. What others made of you appears on it only once you chose to show it; what you keep is visible to you alone. World posts can appear on your Frame and in discovery. Club contributions do not appear on a Frame; public Club posts may appear in discovery. Followers posts are available only to their author and currently approved followers who have a confirmed profile; pending follow requests grant no access. Private-account follow requests require your approval. Restricted Club material never appears on a Frame, including to the author or a fellow member. Hiding an eligible post from your Frame does not delete the original. The number of hearts and reshares on a post is shown only to its author; other people see the names of up to two people who hearted it. Public Clubs can have a public wall and an optional members-only wall. A private Club has one members-only wall. Only currently admitted Club members can read restricted posts and replies; their media and link previews are restricted too. Restricted history stays restricted if the Club becomes public. Following a public Club grants no access to its members-only wall. Direct messages and their shared files are shown to their participants through authenticated access; they are not listed in public media or search. The service holds the encryption keys for messages stored at rest, so these messages are not end-to-end encrypted. Staff access is limited to a justified support, safety, security or legal need.

While Chat is open in the foreground, we keep one latest activity time. With “Show when I’m active in Chat” enabled, mutual follows and people you have both exchanged replies with can see a recent Chat activity indicator or a rounded last-active time. It does not show your other browsing or Club affiliations. Turning it off in Privacy and messages clears that saved time and hides activity indicators for you and your contacts. No activity history is kept.

Places. Adding a place to a post is optional and off by default. A place can be a city (for example “Lisbon, Portugal”) or a venue, event, outdoor place or area that you choose. A selected venue can reveal a specific location. The selected place identifier and displayed label are stored with the post; they are distinct from the device coordinates used for a nearby lookup. It is part of the post: only people who can see the post see its place, you can change or remove it when you edit the post, it is included in your data export and it is deleted with the post or your account. When you tap “Share my location”, your browser or app asks for permission once; your position is rounded to about a kilometre on your device, used once to find the nearest city and then discarded, never stored or logged. Only that city is remembered, in a first-party cookie on your device (__Host-pk_city, 30 days), so the composer can suggest it and search can show places near you; the lookup cookie is not linked to your account. A place you deliberately attach to a post, a place suggestion you answer, and an optional city on your profile are stored as described here. “Stop sharing” in the city picker, in search or in Settings deletes it at once. If a photo you choose carries a location in its file, Publika reads it on your device before that location is removed from the upload and may suggest the nearest city, looked up the same rounded way; nothing is added unless you tap it. Venues, parks and other places inside a city that members have not added yet come from an open catalogue (see Data credits); they describe places, never people, and looking them up near you sends only rounded coordinates that are compared and discarded, never stored or logged. Where your browser or app already lets Publika use your location, Discover shows the places near you without asking again; otherwise it shows your own city and asks only when you tap “Near me”. When Publika suggests where a photo was taken and you answer yes or no, your answer is kept with your account (it is in your data export and deleted with your account) and only ever counted, never shown; Publika also counts how often each place is picked, per hour of the day, without keeping who.

Contacts. Inviting friends works on your phone alone: Publika never sends invitations for you and never receives the people you pick. Separately, you can choose to sync the contacts you pick, by ticking the consent line at that moment (your consent; you can withdraw it any time). Only their email addresses are sent, over an encrypted connection, and, where Publika offers phone verification and the consent line names numbers, their phone numbers; names always stay on your phone. Each address or number is normalised and immediately turned into a keyed code (HMAC-SHA256 with a secret only Publika holds); the address or number itself is never stored or logged. When you sign in or verify your email, the same kind of code is kept for your own address. Where Publika offers it, you can also add your own mobile number (optional: in Privacy and messages, in a step right after you join that you can skip, or under Bring your people): Twilio, our processor for this, texts you a 6-digit code and checks it; Publika never sees the code. Once the code is confirmed, your number is kept only as the same kind of keyed code, together with its country calling code, its last two digits (for example “+31 •••• 12”, shown only to you) and the time it was verified; while a code is waiting (at most 10 minutes) only the keyed code of the number it went to is kept. Your number is never shown on your profile or to anyone else. If another account later confirms the same number, it moves to that account. Remove it any time in Privacy and messages; that deletes its code and every match it made. Codes are used only to find people you know who are already on Publika and to order the people we suggest. We never email, text or contact the people in your contacts, never build profiles of people who are not members, never show anyone whose contacts they are in, and no code is shown or exported. A code that matches nobody is deleted after 12 months. In Privacy and messages you can see how many contacts you synced and remove them all at once, and turn off “Let people who have my email or number find me” (on unless you turn it off; our legitimate interest in helping people find each other), after which nobody is suggested you through their contacts, by email or by number. Erasing your account deletes everything you synced, your own codes and your number’s hint. Your data export includes how many contacts you synced, your consent, the members found and, if you added a number, its hint and when it was verified, but no codes.

cinemaOS places. In the cinemaOS camera you can choose to let Publika remember where and when you shoot. It is off until you say yes, in words the app shows you, and you can say no again at any time (your consent; you can withdraw it whenever you like). When you say yes, for each photo, clip or outing the app sends Publika a small note: the local date and time, the weekday and hour, the kind of place (a nightclub, a café, a park), the place you chose if you chose one, the city and country, the camera look, and an area of about 1 kilometre by half a kilometre, as a short code. It never sends your exact position, a street or a photo, and Publika keeps nothing finer than that area even if the app sent more. From the notes Publika keeps a small profile of counts (which kinds of places, which hours and days, which areas and cities you shoot in most), to show you your own patterns in cinemaOS and partner offers in cinemaOS that fit the places you like. We also count notes together, only for groups of at least ten different adults, by area or city, kind of place, day and hour, to understand when and where people shoot; these counts are not shared outside Momentum, and a count never names a person. When the app asks which place you are standing in, it sends your position once, Publika compares it with the catalogue of places and answers, and does not store or log it. Notes are kept for 13 months and then deleted. Saying no, or turning off “Smarter about places” in cinemaOS, deletes every note and your profile at once; erasing your account does too. We keep a record of each answer you give (yes or no, the words you were shown, and when) for as long as your account exists, so we can show what you agreed to. Your data export includes your answers, your profile and every note.

4. Why we process it

We use account, Frame, post, Club and message data to provide the community you request (contract). We use security limits, distribution limits for new accounts, search of public material and the ordering of Stream to keep Publika usable and safe (legitimate interests). We process reports and moderation records to meet applicable legal duties and enforce the Community Guidelines (legal obligation and legitimate interests, as appropriate). Optional diagnostics you provide for a problem are used to investigate that problem; you may ask us to remove them. Publika participation does not switch on cinemaOS product-usage telemetry or marketing email.

We use invites and how you came in to let your friends in, to keep the photo of someone not on Publika only as long as the invite lasts, and to stop abuse (legitimate interests). We use your declared date of birth, age band and country to enforce adult admission and applicable minimum-age rules (contract, legitimate interests and legal obligations where applicable). We process what others make of you to provide the feature you and they use (contract), and show it only with your choice. We process your download choice to honour it (contract).

When first-party launch measurement is enabled, Publika records limited page-session, public-post exposure and action events to check whether people find useful conversations. These records contain keyed identifiers, time and event categories, not post or message text, search queries, contact details, media, invitation tokens or private Club references. They remain personal data, stay for at most 14 days, and are included in your data export and removed on account erasure. When this measurement is enabled, an invitation link may also set a first-party, HTTP-only invitation-session cookie for up to 14 days. It connects limited observations of opening the invitation, completing a Publika profile, redeeming that invitation, contributing publicly in its Club, returning to the foreground and attempting to share an invitation. It does not store the invitation token or a history of private activity. Signing out clears this cookie. These observations do not establish why someone participated or prove that a shared invitation was delivered.

5. Service providers and where data is kept

Cloudflare hosts the community, its databases, image storage, private chat-file and voice-note storage and live call infrastructure. EU jurisdiction is configured for stored community data (posts, stills, profiles and messages); network and security processing may occur elsewhere. Public post clips you upload are sent directly from your device to Cloudflare Stream, which processes, stores and delivers them for Publika as our processor. Stream does not offer EU-only storage, so clips may be processed and stored outside the EU under Cloudflare's data processing terms and the EU Standard Contractual Clauses. RealtimeKit processes live call signaling, media, device identifiers, crash data and service diagnostics under Cloudflare's service terms. On Android, Firebase Cloud Messaging and its supporting installation and transport components process installation/device identifiers, notification-delivery and diagnostic data for push delivery and operational analytics. The iOS app uses direct Apple push delivery. These service diagnostics are separate from Publika’s optional first-party usage measurement and are not used for advertising or cross-app tracking. Resend sends account and Publika notification email. Where phone verification is offered, Twilio Ireland Limited receives the mobile number you enter, only to text and check the 6-digit code (Twilio may process it outside the EU under its data processing terms and the EU Standard Contractual Clauses). Invitations you send are delivered once to the address you enter, from your name via Publika; Publika keeps only a keyed hash of that address (to limit repeat invitations and to honour "Don't email me again"), never the address itself, and never sends reminders. Its Ireland sending region is configured, while account, message metadata, logs and API records may be stored in the United States. The cinemaOS notice explains the processors and international transfer safeguards. Publika notification choices are in Settings. If you turn on “Use how I read Publika mail to tune my emails” (off unless you choose it), the logo in a Publika email is loaded from our own domain with a short signed code, and links in it carry the same kind of code; we record only that this mail was seen or a link was followed, with the time, for 90 days, to write less to people who do not read it. We never write more because you did, we use no cookie or tracking service, and no email provider tracking is switched on. Turning it off stops the recording and deletes what was gathered. Separately, if several mails in a row get no response (no followed link and no activity in Publika), we write less often and finally ask whether you still want them. Essential account, security and moderation messages still arrive when optional notifications are off. Direct-message text, shared files and voice notes are not included in reminder emails.

6. How long data stays

Profile and community content remain while your account is active, unless you remove them sooner. If you sign up with your email and never confirm it, your account stays. Only a sign-up that was never used, an address typed in and nothing after, is deleted after 60 days. Clips you never post are deleted after 48 hours, except the ones you take with Publika's camera, which wait in Your shots: drafts are deleted 30 days after they were taken unless you keep your shots, kept drafts and your days stay until you delete them or erase your account, and turning Keep my shots off deletes kept drafts within 30 days. A Same Time photo a moderator hid or took down is kept sealed for six months after the decision, so a complaint can still be decided, then deleted, unless the law requires it to be kept longer. Your days are never deleted because you are away: after five years without signing in we write to you twice, a month apart, with a way to download everything, and a month after the second letter your account is erased. Posted clips are deleted from Stream when you remove them or erase your account. Ordinary direct messages, shared chat files and voice notes have no automatic expiry and remain until deleted or the account is erased. Whispers are an exception: unopened content expires after 24 hours, and each recipient has one viewing session of at most 60 seconds. Closing the viewer ends that session. The encrypted content key is removed when all recipients have finished or the item expires, and file removal is retried if storage is temporarily unavailable. Item and delivery metadata are pruned after 30 days from creation. A whisper report may preserve a separate encrypted copy, only if the reporter explicitly chooses to include it while it is still available; that restricted evidence and its capture receipt expire after 365 days and are independent of ordinary message or account deletion. If the content is already gone, only available metadata and the report explanation are kept. Screenshots and copies made by recipients are outside Publika’s control. When a human moderator removes a whisper, remaining access ends without reopening the item or extending its original lifetime; consented report evidence remains separately reviewable. When a human moderator removes an ordinary private message, access stops immediately. Its encrypted original and associated private files are scheduled for purge after a 186-day review window. A review requested before expiry pauses that purge, and a human review outcome starts a fresh window. A reversal can restore only the retained original: a sender withdrawal, account erasure, expired payload or later restriction can make restoration unavailable. This does not change the separate retention of a sealed report snapshot described below. Unfinished chat uploads expire after 24 hours. When a conversation is reported, a sealed copy of up to 20 messages and their available shared files may be kept for 12 months for review, independently of the conversation; deleting a message or account does not recall that evidence. Call invitations and their status remain with the conversation until it is deleted or the account is erased. Cloudflare may retain limited call diagnostics under its own service retention periods. When your Momentum account deletion is processed, your Frame, your Doors, your invites and how you came in, your date of birth, what you made of others and what they made of you, your Circle plans and answers, public and private contributions, follows, credits, hearts, reshares, votes, saved items, messages, shared chat files, voice notes, clips and private diagnostics are removed, subject to records needed for law, security, moderation or a dispute. The account deletion process explains its progress and any retention exceptions. When you change your username, your old one stays reserved for you for 5 days, then anyone can take it. When your account is erased, your usernames are released straight away and no reservation or account identifier is kept for them. Security and moderation records are kept only for their necessary purpose and then pruned or redacted. Billing and tax records follow the separate cinemaOS notice and legal retention duties.

7. Your choices and rights

You can edit your Frame, your download choice and notification choices in Publika and request an account data export or deletion through your Momentum account. The export includes your time on Publika, your account events and chat signals, your Frame, your date of birth and age band, how you came in and the Doors you opened and the invites you sent, what others made of you and your choices on it, the lines and words you wrote about others, your Circle plans and answers, Your shots and Your days (each day, its prompt, your lines and places, who loved a photo and whose days you saw), your posts, credits, reshares, hearts, follows, messages, voice-note metadata, chat-file metadata and public clip metadata. It also includes your cinemaOS place answers, profile and notes. Download my days, in Settings, gives you every photo of your days as a file. Subject to GDPR conditions, you may ask for access, correction, erasure, restriction and portability, object to processing based on legitimate interests, or withdraw consent where consent is the basis. Email privacy@mntm-studios.com. We may verify your identity and normally respond within one month. You may complain to the Belgian Data Protection Authority or the authority where you live or work.

Data credits

City and town names come from GeoNames, licensed under CC BY 4.0. Venues and other places inside a city come from Overture Maps Foundation (Overture Maps Places, with data from Meta, Microsoft and other contributors), licensed under the Community Data License Agreement, Permissive 2.0. Publika keeps only records whose every source carries that licence, and changes the data by choosing which places to show, shortening names and grouping categories. Country names in other languages come from the Unicode CLDR (Unicode License).