Privacy Policy

Updated October 7, 2026

Your privacy is important to us. This privacy policy explains how we collect, use, and protect your personal information.

Information We Collect

We collect photos you choose to upload, your style questionnaire answers, color analysis results, and saved preferences. In the iOS app, a Firebase account identifier connects your results, saved looks, backups, and purchases, including when you start without linking an Apple account. If you choose Sign in with Apple, we also receive the name and email address that Apple makes available. We receive purchase and subscription status through Apple and RevenueCat, rather than your payment card details. Website checkout uses Stripe to process payment information; we receive the transaction information needed to deliver your purchase and provide support.

How We Use Your Information

We use your photos and style information to provide color analysis, clothing scans, and generated style previews. Cloud processing shares the photos and relevant style information with service providers; this is not exclusively on-device processing.

Photo Processing Providers

Google Firebase hosts account records, uploaded photos, and results. In the iOS app, photos, derived face or hair masks, and style answers are sent to OpenAI or Replicate (including Google models hosted through Replicate) as needed to analyze the image or generate a preview. The website may also send images directly to Black Forest Labs. The iOS app asks for your explicit permission before sending photos for AI processing. You can decline or turn off AI photo processing in Account → Privacy & AI. Turning it off prevents new requests; processing already started may finish. Local palette comparisons and other on-device tools do not require that permission.

Face landmarks, face and hair masks, and appearance estimates help place previews and suggest colors; we do not use them to identify or authenticate people. Local editing keeps its working images on your device, but saving a look to your account may also back up that image and its editing information to Firebase. AI-processing permission and account backup are separate features.

Provider Retention and Model Training

For iOS photo requests to OpenAI, we turn off optional storage of responses for later retrieval. OpenAI may still retain abuse-monitoring data for up to 30 days by default, with exceptions for legal and safety requirements. Website requests may use its default response-storage period. This is not a zero-retention service. See OpenAI's API data controls.

Replicate documents automatic removal of API prediction inputs, outputs, files, and logs after one hour by default. Copies we save to your account remain until deleted. See Replicate's retention documentation.

Website features that send images directly to Black Forest Labs are governed by its API terms and privacy policy, which allow use of inputs and outputs for model improvement and do not provide a fixed general retention deadline. The iOS app does not use that direct service; its FLUX image edits run through Replicate. We do not promise that every AI provider offers zero retention or excludes submitted images from training. Contact us about provider-specific processing or deletion requests.

Storage and Deletion

Uploaded photos and saved analysis results remain in your account so you can return to them. The iOS app also caches photos and previews on your device. To request account and stored-photo deletion, open Account → Account settings → Delete account & data. Accounts linked to Apple require Apple confirmation to disconnect that authorization. Deleting the account does not cancel an Apple subscription; manage subscriptions in your Apple account settings.

Deletion removes account records and associated photos from active app storage and clears app-managed local photo caches. Recent processing can require a short wait; if deletion fails, keep the app available and retry. Late uploads and processing results are cleaned up asynchronously. Photos you exported to your photo library or shared elsewhere are outside this cleanup.

Our cloud photo bucket retains recoverable deleted copies for seven days before permanent expiry. These copies are not available through the app. We retain small server-only records of deleted account and run identifiers indefinitely to prevent old login tokens or delayed processing from recreating deleted data. These records do not contain your photos. Provider backups, security logs, purchase records, and data already sent to processors have separate retention rules; account deletion does not instantly erase every processor's records.

Purchase, diagnostic, security, and deletion records may remain with the services that process them under their retention policies. For questions about retained records or deletion of website data, contact hi@stormlightventures.io. Our providers publish their policies at OpenAI, Replicate, Black Forest Labs, Google, and RevenueCat.

Data Security

We implement appropriate security measures to protect your personal information from unauthorized access or disclosure.

Analytics

We use Gizmo Analytics to understand aggregate site usage. For payment attribution, Gizmo creates a random session token for each browser tab that rotates after 30 minutes of inactivity. When available, we pass this token to Stripe with the checkout session so Gizmo can connect a payment to the initial site visit. This token does not contain your email address or uploaded photos.

The iOS app includes Firebase Analytics and Crashlytics to measure feature usage and diagnose crashes and performance problems. This can include app-installation identifiers, device and operating-system information, screens and tools used, questionnaire selections, purchase events, timing measurements, and crash information. Analytics can infer an approximate location from your network address; it does not need GPS access. RevenueCat processes purchase history and an account identifier to provide paid access, restore purchases, and report purchase performance. These iOS services are separate from website analytics.

Your Choices and Contact

You can choose local tools without authorizing AI photo processing, revoke that permission in Account → Privacy & AI, and delete your app account. For access, correction, deletion, or other privacy requests, including website photos and records, email hi@stormlightventures.io. Include enough information to locate the record, but do not send passwords or payment card details. We may need to verify ownership before changing or deleting information.