scrollecom Privacy Policy

Last updated: 28 September 2026 Effective from: 28 September 2026

Summary (the short version; the full policy follows)

• Who is responsible. MB AGI Studio, a company registered in Lithuania, is the controller of your personal data in scrollecom. Contact: hello@agistudio.lt.
• What we collect. If you sign up: your email or Apple sign-in details, and the nickname and photo you choose. From everyone, including guests: the interests you pick, what you watch, save, tap and share in the app, comments you post, and basic device and technical data. Detailed product analytics, session replays with text and images masked, and error diagnostics: in the EU, EEA, UK and Switzerland only if you agree, elsewhere on by default (you can turn them off).
• Why. To run scrollecom, personalise your For You feed, keep the service safe, moderate comments, and improve the app.
• What we never do. We don’t sell your personal data. We don’t show third-party ads. We don’t track you across other companies’ apps or websites, and we don’t use your advertising identifier (IDFA). We don’t collect your precise location or contacts.
• Where it goes. Our service providers (listed by name in section 10), some of them in the United States under legal safeguards. Supplier websites only receive a random click reference, not who you are.
• Your choices. Turn analytics off at any time under Account → Privacy. Change your interests under Account → Interests. Use the New tab for a feed that isn’t personalised. Delete your account under Account → Delete account.
• Your rights. You can access, correct, delete, restrict, move and object to the use of your data, and complain to the Lithuanian State Data Protection Inspectorate or your local authority.

Contents

1. Who we are and how to reach us
2. What this policy covers
3. The information we collect
4. What we don’t collect and don’t do
5. How we use your information, and our legal bases
6. How your feed is personalised, and other automated processing
7. Analytics, session replay and error diagnostics
8. Storage on your device, SDKs and cookies
9. Notifications and emails
10. Who we share information with
11. International transfers
12. How long we keep information
13. Deleting your account
14. Your rights and how to use them
15. Complaints
16. How we protect your information
17. Children and teenagers
18. Brand, partner and admin portal users
19. If you are in the United States
20. Changes to this policy
21. Contact

1. Who we are and how to reach us

In short: MB AGI Studio in Lithuania is responsible for your data. Email us about anything in this policy.

The controller of your personal data in scrollecom is:

MB AGI Studio Lithuania Email: hello@agistudio.lt

Data Protection Officer. We have not appointed a Data Protection Officer, because the law does not currently require one for a company of our size and activities. Our founders handle privacy matters directly, and you can reach them at hello@agistudio.lt.

2. What this policy covers

In short: the scrollecom app, our websites, the brand portal and our emails. Not suppliers’ or other companies’ websites.

This policy covers personal data we process when you:

• use the scrollecom app, as a guest or with an account;
• visit our websites at trymarbles.com (including media served from media.trymarbles.com);
• use the brand and partner portal (section 18 has details specific to portal users); or
• contact us or receive emails from us.

It does not cover websites and services run by others, even if you reach them from scrollecom, such as suppliers’ websites, affiliate networks, marketplaces, or Apple. They have their own privacy policies.

Words like “we” and “scrollecom” have the meanings given in our Terms of Service. “Personal data” means any information that relates to you as an identifiable person.

3. The information we collect

In short: what you give us, what the app records as you use it, and a little from Apple and Cloudflare.

3.1 Information you give us

3.2 Information collected automatically

3.3 Information from other sources

3.4 What happens if you don’t give us information

• You can use scrollecom as a guest without giving us your email or any other contact details.
• To create an account, we need an email address or Sign in with Apple. Without an account you can’t save more than 3 items, see supplier details, comment, set a profile, or buy Pro.
• A nickname and profile photo are optional.
• Analytics, session replay and error diagnostics are optional. In the EU, EEA, UK and Switzerland they depend on your consent; elsewhere they’re on by default and you can turn them off.
• Push notifications are optional and depend on your device permission.
• Some processing happens automatically because the app can’t work without it (for example, your user ID, activity used to run the feed, and IP addresses in server logs).

4. What we don’t collect and don’t do

In short: no data selling, no ads, no cross-app tracking, no location, no contacts.

• We don’t sell your personal data, and we don’t share it for cross-context behavioural advertising.
• We don’t show third-party ads and we have no advertising SDKs in the app.
• We don’t track you across other companies’ apps and websites, and we don’t access your device’s advertising identifier (IDFA). For this reason the app does not show Apple’s “Allow tracking” prompt.
• We don’t collect your precise location, contacts, calendar, microphone recordings, or photos (apart from a profile photo you choose), and we don’t read your clipboard.
• We don’t fingerprint devices and we don’t collect keystroke patterns or biometric data.
• We don’t ask for sensitive information such as health, religion or political opinions. Please don’t include any in comments or your profile.
• Links to suppliers carry a random click reference, never your name, email or user ID.

5. How we use your information, and our legal bases

In short: to provide the service you asked for, to keep it safe, to meet our legal duties, and, where the law requires it only with your consent, for detailed analytics and notifications.

Under the EU General Data Protection Regulation (GDPR), we need a legal basis for each use of your data. The table below groups our uses by legal basis.

About our legitimate interests. Where we rely on legitimate interests, we have weighed our interests against yours. Our interests are keeping scrollecom and its users safe, keeping the community respectful, making a product people want to use, and getting paid the commissions we earn. We limit this processing to what is needed, use aggregated or de-identified data where we can, don’t use it for advertising, and give you the right to object. You can ask us for more details of this balancing at hello@agistudio.lt.

Why personalisation is “contract”. A personalised For You feed is the core of what scrollecom offers, so we treat it as part of providing the service. If you’d rather not have it, you can use the New tab, which is not personalised, and you can change or clear your interests at any time.

Your right to object

Where we process your data on the basis of legitimate interests, you have the right to object at any time, on grounds relating to your particular situation. If you object, we will stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. To object, email hello@agistudio.lt.

If we ever process your data for direct marketing, you can object at any time, and we will stop without exception. Every marketing message includes a way to opt out.

6. How your feed is personalised, and other automated processing

In short: a recommender ranks your For You feed using your interests and how you use the app. It never makes decisions with legal effects on you.

The For You feed. An automated system chooses and orders videos for you. The main inputs are:

• the interests you pick (Account → Interests);
• how you interact with videos: watch time, quick skips, replays, and whether you open the product, save, share, open comments or tap “Source it”;
• how other viewers respond to each video;
• product signals, such as estimated sales and search momentum, trend stage and estimated margin;
• freshness, and exploration and variety rules (for example, we show some new or less-seen videos, avoid repeating the same product or niche, and don’t re-show a video within 7 days). For a small share of users, videos are shown in random order so that we can check our recommendations are helpful.

From your activity we calculate how much you engage with each product niche. This interest profile is used only to rank your feed. It is not shared, and not used for advertising. Guest activity is used the same way, and carries over if you create an account.

Your controls. Change your interests at any time; use the New tab (newest first, not personalised); and turn analytics off under Account → Privacy (this doesn’t change the feed, which runs on our own records).

Automated moderation. When you post a comment or choose a nickname, automated checks block links, certain offensive words (including disguised spellings), repeated comments and excessive posting. A comment reported by several different users may be hidden automatically until our team reviews it. People review reports and appeals.

No decisions with legal effects. None of this processing produces decisions that have legal effects on you or similarly significantly affect you within the meaning of Article 22 GDPR. If we ever introduce such decisions, we will tell you first and explain your rights.

7. Analytics, session replay and error diagnostics

In short: PostHog helps us see how the app is used and fix bugs. In Europe it only runs if you say yes; elsewhere it’s on unless you turn it off. Text and images are masked in replays. You can change your choice at any time.

We use PostHog (hosted in the EU, in Frankfurt) for product analytics.

• In the EU, EEA, UK and Switzerland (decided from your device’s region and time zone), we only turn it on if you agree when the app asks. Until you answer, and if you say no, PostHog doesn’t collect anything from your device.
• Everywhere else, analytics is on by default, because the law there doesn’t require prior consent for first-party analytics.
• Wherever you are, you can turn it off at any time. Once it’s off, PostHog doesn’t collect anything from your device.

What PostHog collects when it’s on:

• Usage events, such as screens viewed, videos viewed (with watch time and whether they played smoothly), products opened, saves, shares, sign-up steps, paywall views, searches (length and result count only, never the search text) and comment actions (never the comment text). We automatically strip email addresses, names, comment text, search text and tokens from events before they are sent.
• App lifecycle events, such as the app being installed, updated, opened or sent to the background.
• Session replay: a reconstruction of how you move through the app’s screens, so we can find confusing designs and bugs. All text inputs, images and embedded web views are masked, so replays don’t show what you type (such as your email, sign-in codes or comments), photos or video frames. Replays also record network request information such as the addresses the app calls, response times and status codes. Replays may be recorded for only a sample of sessions.
• Error diagnostics: crash reports and technical details of errors (for example the error message and the code location), so that we can fix them.
• Feature flags: which version of a feature you are given when we test improvements.
• Identifiers: PostHog links these events to your scrollecom user ID and a few properties (whether you are a guest, your app version and the interests you picked), so that we can understand usage over time.

Your choice. You can turn this on or off at any time under Account → Privacy → Share usage analytics. Turning it off stops events, replays and error reports from your device. It doesn’t delete what was already collected. To have that deleted, contact us (section 14).

Not the same as the feed’s own records. The activity records described in section 3.2 run the feed (ranking) and basic service statistics on our own servers, and are covered by section 5, not by this consent.

8. Storage on your device, SDKs and cookies

In short: the app stores what it needs to work on your device. In the EU, EEA, UK and Switzerland, analytics storage is only used with consent. The portal uses essential cookies to keep you signed in.

The law requires consent before an app or website stores or reads information on your device, unless it is strictly necessary for a service you asked for.

In the app:

On our websites and portal. The portal uses essential cookies to keep you signed in and secure. We use analytics cookies or similar technologies on our websites only with your consent, given through a cookie banner where Reject is as easy as Accept.

Do Not Track and Global Privacy Control. Because we don’t track you across websites or sell or share personal data for advertising, there is nothing for these signals to switch off. Where the law treats a Global Privacy Control signal as an opt-out request, we honour it.

9. Notifications and emails

In short: service emails are part of having an account. Notifications and marketing are opt-in.

• Sign-in codes and service emails. We email one-time sign-in codes and important account messages (for example security notices and notices of changes to our Terms). Our email provider is Resend.
• Apple relay addresses. If you hid your email with Apple, our emails go through Apple’s private relay service to your real address.
• Push notifications (planned). If we add notifications (for example alerts about products you saved, or a daily or weekly digest), we will only send them if you allow them. We would store a push token, your notification preferences and your time zone (to respect quiet hours), and keep a log of what we sent and whether it was opened, so that we can send fewer, more useful notifications. You can turn them off in the app or in your device settings.
• Marketing. We don’t currently send marketing emails. If we start, we will ask for your consent first (or, where the law allows, rely on you being an existing customer), and every message will let you unsubscribe.

10. Who we share information with

In short: our service providers, who only act on our instructions; Apple, which acts on its own account; other users (for public content); and authorities where the law requires it.

10.1 Service providers (processors)

These companies process personal data on our behalf and under our instructions, under data processing agreements that require them to protect it.

Cloudflare’s use of data for Turnstile is also described in Cloudflare’s Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/).

10.2 Independent controllers

These organisations decide for themselves how they use data they receive, under their own privacy policies:

• Apple, when you use Sign in with Apple, buy through the App Store (Apple is the seller and processes payment), or receive push notifications through Apple’s service.
• Suppliers and affiliate networks, when you open a supplier link. They receive a random click reference and whatever their own website collects when you visit it. We don’t send them your name, email or user ID.

10.3 Other users and the public

Your nickname, profile photo, comments and comment likes are visible to other scrollecom users, including guests. Your saves, notes and activity are not. Comments and profiles appear only inside the app, not on public web pages.

10.4 Authorities, legal claims and safety

We disclose personal data to courts, law enforcement or other authorities where the law requires it, or where we believe in good faith it is needed to protect someone’s life or safety, to prevent fraud or abuse, or to establish, exercise or defend legal claims. The EU Digital Services Act requires us to inform authorities if we become aware of information suggesting a crime that threatens someone’s life or safety.

10.5 If our business changes hands

If we are involved in a merger, acquisition, financing or sale of all or part of our business, personal data may be transferred to the new owner or reviewed by advisers, under confidentiality obligations. We will tell you if that happens and if your data becomes subject to a different privacy policy.

11. International transfers

In short: some of our providers store or access data in the United States. We use the legal safeguards the GDPR requires.

We are based in the EU, but some of our service providers are in the United States, or can access data from there. In particular, our main database (Supabase) is hosted in the US East region today, and Resend sends email from the US.

When we transfer personal data outside the European Economic Area, we make sure it is protected by one of these safeguards:

• an adequacy decision, including the EU–US Data Privacy Framework where the recipient is certified under it; or
• Standard Contractual Clauses approved by the European Commission, together with additional measures where needed, such as encryption in transit and at rest.

You can ask for a copy of the relevant safeguards at hello@agistudio.lt. We may move our database and email hosting to the EU, and we will update this section if we do.

12. How long we keep information

In short: as long as you have an account, and shorter for most activity and technical data.

We may keep information for longer where the law requires it or where it is needed for a legal claim, and only for as long as that need lasts. Aggregated statistics that no longer identify anyone may be kept indefinitely.

13. Deleting your account

In short: Account → Delete account removes your account and personal data. A few records are kept for legal or security reasons.

You can delete your account in the app under Account → Delete account. For security, you’ll need to have signed in recently, and we may send you a new code. When you delete your account:

• deleted straight away: your account and sign-in details, profile, nickname and profile photo, interests, comments, comment likes, reports, blocks, saves, subscription status held by us, in-app activity, feed history and interest profile, and your sign-in audit records;
• Sign in with Apple: we ask Apple to revoke scrollecom’s access to your Apple ID;
• de-identified: supplier click records are kept for commission accounting, but no longer linked to you;
• kept for a limited time: copies in backups (overwritten within 30 days), security logs (section 12), analytics data held by PostHog (deleted within 30 days of your request), and records the law requires us to keep, such as billing records from Apple and RevenueCat;
• not affected: a Pro subscription is billed by Apple. Cancel it in your Apple ID settings, because deleting your account doesn’t cancel it.

Afterwards, the app starts a fresh guest session on your device.

If your account is linked to a brand or partner organisation in the portal, you can start the deletion in the app and we will complete it with you, because we must keep records of video licences that you accepted (section 18).

Parents can ask us to delete a child’s account at hello@agistudio.lt (section 17).

14. Your rights and how to use them

In short: you control your data. Most things can be done in the app; for the rest, email us. It’s free, and we answer within a month.

Under the GDPR you have the right to:

How we handle requests. We respond within one month. For complex or numerous requests we may extend this by up to two more months, and we will tell you why. Requests are free, unless they are clearly unfounded or excessive. To protect your account, we may need to confirm your identity, usually by asking you to write from your account email or to confirm a code we send to it. Guests don’t give us contact details, so we may not be able to link a request to a guest account. Deleting the app removes the guest data stored on your device, and guest accounts are deleted after 12 months without any app activity (section 12). You can ask someone to make a request for you, if you give them written permission.

15. Complaints

In short: tell us first if you can, but you can always go to a data protection authority.

If you are unhappy with how we handle your data, please contact us first at hello@agistudio.lt so we can try to fix it. You also have the right to complain to a supervisory authority, in particular:

• the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, LT-10312 Vilnius, www.vdai.lrv.lt; or
• the data protection authority in the EU country where you live or work, or where you think the problem happened.

16. How we protect your information

In short: encryption, strict access controls and data minimisation. If something goes wrong, we will tell you when the law requires it.

Our measures include:

• encryption of data in transit (TLS) and at rest by our hosting providers;
• row-level security in our database, so each user can only reach their own private data, and sensitive tables are reachable only through controlled server functions;
• passwordless sign-in with short-lived one-time codes, bot protection and rate limits, and a recent sign-in check before account deletion;
• separate, least-privilege credentials for our services, and access to personal data limited to people who need it;
• not exposing your user ID or email to other users (comments show your nickname and a separate public ID);
• masking in session replays, removing personal fields from analytics events, and removing location metadata from profile photos before upload; and
• regular security reviews of new features.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the supervisory authority within 72 hours where required, and tell you without undue delay if the risk is high.

17. Children and teenagers

In short: scrollecom is for people aged 13 and over. We don’t use young users’ data for advertising, and parents can ask us to delete an account.

• scrollecom is not intended for children under 13, and we don’t knowingly collect personal data from them. If we learn that a child under 13 has an account, we will delete it. If you believe we hold data about a child under 13, contact hello@agistudio.lt.
• Some processing in scrollecom is based on consent (analytics and notifications). If you are under the age at which you can give that consent yourself in your country (14 in Lithuania, and between 13 and 16 elsewhere in the EU), a parent or guardian must give or authorise it. If you’re not sure, leave analytics off.
• We don’t show personalised advertising to anyone and don’t sell anyone’s data, including the data of users under 18.
• Users under 18 need a parent or guardian to agree to any purchase.
• Parents and guardians can ask us to access or delete their child’s data at hello@agistudio.lt. We may ask for information to confirm that you are the parent or guardian.

18. Brand, partner and admin portal users

In short: if you use the portal for a brand or partner, we keep business contact details and records of the video licences you accept.

If you use the portal (for example to upload videos for a brand, or as a member of our team), we process:

• your email address, sign-in records and portal access requests (status, and who approved them and when);
• your organisation membership and role;
• videos you upload and their processing records (file names, technical details, review decisions);
• licence records for each video you upload: the licence terms you accepted, the version of the agreement, the time of acceptance, your IP address at the time of acceptance, the licensor’s name and contact details, and attribution, audio and talent-release information; and
• your activity in the portal. PostHog analytics in the portal runs only if you accept it in the cookie banner, with text masked and without session replay.

We use this information to provide the portal (contract), to keep reliable evidence of licences and to handle copyright claims (legitimate interests and legal obligations), and to secure the portal (legitimate interests). Licence records are kept as described in section 12, even if you delete your account, because they prove that we have the right to show the videos. The people who appear in uploaded videos should contact the brand or partner that uploaded them, or us, with any request.

19. If you are in the United States

In short: we don’t sell or share your data for advertising, and you can ask to know, correct or delete it.

This section applies to residents of US states with consumer privacy laws (such as California, Colorado, Connecticut, Virginia and others), to the extent those laws apply to us.

Categories of personal information we collect (in the terms used by California law), with the sources and purposes described in sections 3 and 5:

We don’t collect precise geolocation. We don’t collect or use sensitive personal information to infer characteristics about you.

No sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16.

Your rights. Depending on your state, you may have the right to:

• know what personal information we have collected about you, and access it;
• correct inaccurate personal information;
• delete personal information;
• opt out of sale, sharing, targeted advertising and certain profiling (we don’t do these, so there is nothing to opt out of);
• appeal if we decline your request, by replying to our decision. If we deny your appeal, you can contact your state attorney general; and
• not be discriminated against for exercising your rights.

To exercise them, delete your account in the app or email hello@agistudio.lt. We will verify your request as described in section 14. An authorised agent may make a request for you with your signed permission, and we may ask you to confirm it directly.

Do Not Track and Global Privacy Control. See section 8.

Retention. See section 12.

20. Changes to this policy

In short: we will tell you about important changes before they apply.

We will update this policy when our processing changes or the law requires it. The “Last updated” date at the top shows the current version, and previous versions are available on request at hello@agistudio.lt. The current version is always at https://agistudio.lt/scrollecom/privacy. If we make material changes, we will tell you in the app or by email before they take effect and, where the law requires, ask for your consent again. Continuing to use scrollecom does not mean you consent to anything that needs your consent.

21. Contact

In short: email hello@agistudio.lt.

For any question about this policy or your data, or to exercise your rights:

MB AGI Studio Lithuania Email: hello@agistudio.lt

Support · Terms of Service · Privacy Policy · Community Guidelines