Privacy Policy

This Privacy Policy explains how CALORIE COUNTER APP LIMITED (“we”, “us”, or “our”) processes information when you use the PhotoVinci iOS application and the PhotoVinci website (the “Service”). We are the controller of the personal information described in this policy, except where a provider acts independently under its own terms.

PhotoVinci creates AI-generated images from photos you provide. This policy explains what we collect, why, who receives it — including the AI provider that generates your images — and the choices you have. Your permission for AI photo processing is separate from accepting the Terms of Use, and you can withdraw it at any time.

1. Information We Collect

1.1 Account and user identifiers

PhotoVinci creates an account identifier the first time you open the app, so you can start as a guest. If you sign in with Apple, Google or an email address, we process the account information provided by you or your sign-in provider, which may include your email address and, with Sign in with Apple, your name if you choose to share it. Authentication is handled through Firebase Authentication.

To offer the free photo once per device, we store a random device identifier kept in your iPhone’s keychain together with your account identifier.

1.2 Photos and AI profiles

We process the photos you select from your photo library or take with the in-app camera, the AI profiles you create — a name, the gender you choose for it, and its photos — the gender and language you set for your account, and the images PhotoVinci generates for you.

Photo checks run on your iPhone, and we do not create biometric identifiers. When you add a photo, PhotoVinci uses Apple’s on-device Vision framework to check that it shows one clear face. The check runs entirely on your device and its results are not sent to us. We do not create or store face templates, faceprints or other biometric identifiers, and we do not use your photos to identify you.

Photos you add — including photos you upload for a single creation — and the images generated for you are stored in Firebase Cloud Storage under your account; related records are stored in Cloud Firestore. Before photos are sent for generation, our servers resize them and remove embedded metadata such as location. Cloud access is restricted by account ownership and service access controls, and your photos are not published in a public gallery. Generated images are delivered to you through private links.

Only add photos of yourself, or of another adult who has agreed to it. Do not upload photos of children, and avoid including other people, documents or other unnecessary personal details in your photos.

1.3 AI image generation

To create an image, our servers send the photos you selected, together with the written instructions for the template or scene you chose, to OpenAI, which generates the image and returns it to us. Before your photos are sent for the first time, PhotoVinci explains what is shared and with whom and asks for your permission. You can withdraw it at any time in PhotoVinci Settings → AI Photo Processing. Without it, PhotoVinci cannot create new images, but your account and existing creations remain available.

OpenAI processes this content on our behalf under its API business terms. Under OpenAI’s API data policies, content sent through the API is not used to train OpenAI’s models, and OpenAI may keep it for a limited period to monitor for abuse before deleting it, unless the law requires longer retention.

1.4 Notifications

If you allow notifications, we store a device delivery token, your app version and your app language to tell you when your photos are ready or could not be created. You can change this at any time in iPhone Settings. We do not send marketing notifications.

1.5 Product interaction and technical data

We use Google Analytics for Firebase, Mixpanel and PostHog to understand how PhotoVinci is used and to improve it, and Sentry to detect and fix crashes and errors. Events include app openings, onboarding steps, screens viewed, templates and scenes used, creation results, subscription offers, trials and purchases. Event properties may include app and operating-system versions, language, country, subscription or credit status, product identifiers, prices and currency. These services receive your PhotoVinci account identifier and a random installation identifier, and their software may collect device information and approximate location derived from network information.

Session recordings. To find and fix problems, PostHog may record how you use the app: the screens you visit and what is shown on them — including your photos and generated images — together with technical logs and network timings. We use these recordings only to understand and improve the app.

Crash and error reports sent to Sentry contain technical details of the problem and your account identifier. We remove links to your stored photos and do not send email addresses with them. Our servers also keep technical logs needed for operation and security, which may include your account identifier and the instructions sent for a creation.

The app does not currently offer a setting to turn these analytics off. You can object to this processing by contacting us, as described in Section 7.

1.6 Purchases

We process subscription status, product identifiers, transaction information and receipts, purchase history and credit balances to verify purchases and provide access. Apple handles App Store payments; we do not receive your full payment-card information. With each purchase we also record its price, currency, country, app version and installation identifier, and we report purchases, renewals, cancellations and refunds to Google Analytics to measure revenue.

1.7 Support requests and website use

When you email us or use the contact form, we receive the information you include, such as your name, email and message. The contact form sends these details through Formspark to handle your support request. The website is hosted on Firebase Hosting, which processes standard request information, such as IP addresses and browser details, for delivery and security. This website does not load an advertising pixel or a separate analytics service.

1.8 Advertising and tracking

PhotoVinci does not currently track you across apps and websites owned by other companies, does not request access to your device’s advertising identifier (IDFA), and does not share your information with advertising networks. If we introduce advertising measurement, we will update this policy and ask for your permission through Apple’s App Tracking Transparency prompt before any such tracking begins.

1.9 Sources of information

We receive information directly from you when you add photos, create profiles, choose preferences or contact support; from your device and app when you use features; and from sign-in, purchase and AI providers. Apple or Google sign-in may supply the profile information you authorize, Apple supplies purchase verification, and OpenAI returns the images you request.

2. Information We Do Not Require

You do not need to provide contacts, location, financial account information or unrelated personal documents to use PhotoVinci. PhotoVinci does not access your location, microphone or address book. Camera, photo library and notification permissions are requested only for the features that need them and can be controlled in iPhone Settings. If you decline one, you can still use other features — for example, choose photos from your library instead of taking new ones with the camera.

3. How We Use Information

• Create the AI images you request from your photos and the template or scene you choose.
• Save and synchronize your profiles, photos and creations.
• Notify you when your photos are ready, according to your settings.
• Authenticate accounts, validate purchases, and manage subscription and credit access.
• Prevent abuse, including limiting the free photo to one per device.
• Maintain, secure, troubleshoot and improve the Service, including through analytics, crash reports and session recordings.
• Respond to support and privacy requests and comply with applicable legal requirements.

Where data-protection law requires a legal basis, we rely on performance of our agreement with you for requested features, consent where required — including your permission for AI photo processing — legitimate interests in operating, securing and improving the Service where permitted, and compliance with legal obligations. You may object to processing based on legitimate interests, subject to applicable law.

Authorized members of our team may access account content, including photos and generated images, only where necessary to provide support, investigate problems or misuse, or test and improve the quality of the images PhotoVinci creates.

PhotoVinci generates images automatically from the content you submit. Generated images are AI creations: they may not accurately represent you, and they are not photographs of real events. They are not used to make decisions about your legal rights or your eligibility for employment, credit or insurance.

4. Data Linking and Tracking

Your account identifier connects your saved content, purchases and settings. Analytics, session recordings and crash reports are linked to your account identifier and a random installation identifier, so events from your app can be associated with your account. They are not combined with data from other companies’ apps or websites for advertising.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

5. Service Providers

We use providers that process information needed to deliver the Service, including:

• Google Firebase and Google Cloud: authentication, cloud storage, databases, backend processing, app configuration, notifications, website hosting, and usage analytics through Google Analytics for Firebase.
• OpenAI: generation of images from your selected photos and the instructions for the template or scene you choose.
• Mixpanel: product usage analytics.
• PostHog: product analytics and session recordings.
• Sentry: crash and error reporting.
• Apple: Sign in with Apple, App Store payments, subscription management and push notification delivery.
• Google: Sign in with Google.
• Formspark: processing and delivery of website contact form submissions, including your name, email and message.
• Email providers: handling support correspondence.

We share information with providers only as needed for these functions, and the providers that receive your personal information are bound to protect it to a standard equal to the one described in this policy. Their handling of information is also subject to their own terms and privacy practices. We may disclose information where required by law, to protect rights or security, or as part of a business transfer subject to applicable protections.

Your photos are sent to OpenAI only to create the images you ask for. We do not send your photos or generated images to Mixpanel, Google Analytics or Sentry; PostHog session recordings may include them as they appear on your screen.

6. Storage and Retention

Account information, profiles, photos, generated images and related records are stored with Google Cloud in the United States to provide your saved history and synchronization. We keep them until you delete them or your account. Deleting a profile removes it and its photos; images already created from it stay in your creations until you delete your account. Temporary processing data, security logs, backups, transaction records and provider-held data follow separate retention schedules according to their purpose and applicable obligations.

Account deletion removes all files stored under your account — profile photos, photos uploaded for creations and generated images — together with your account records, settings and Firebase authentication account from our active systems, and revokes Sign in with Apple. Some records remain where needed: purchase and transaction records for accounting, tax, dispute and fraud-prevention purposes; the record that a device has used its free photo, to prevent abuse; and backup copies until the applicable backup cycle expires. These records are not used to restore your deleted content. Uninstalling the app alone does not delete your account, and signing out keeps your content in your account.

Information already received by Google Analytics, Mixpanel, PostHog and Sentry is subject to the retention settings of those services, and account deletion does not automatically erase it. Contact us for help with access or deletion of provider-held information.

7. Your Rights and Choices

7.1 Delete your account

To permanently delete your PhotoVinci account, open PhotoVinci Settings → Delete account and confirm. This is available for guest and signed-in accounts and needs an internet connection. Deletion is permanent. It does not delete original photos from your iPhone photo library and does not cancel an Apple subscription — manage or cancel your subscription separately through Apple.

7.2 Permissions, consent and privacy requests

For privacy requests or help with deletion, email support@photovinci.app and optionally use “PhotoVinci — Data Request” as the subject. We may need information to verify your request without exposing another user’s data.

• Turn AI photo processing on or off in PhotoVinci Settings → AI Photo Processing. Turning it off stops new photos from being sent for generation.
• Manage camera, photo library and notification permissions in iPhone Settings.
• Manage subscriptions in your Apple Account. Account deletion does not cancel a subscription.
• Depending on applicable law, request access, correction, deletion, portability or restriction of processing, or object to certain processing, including analytics and session recordings.
• Withdraw consent where processing relies on consent, without affecting processing that took place before.

7.3 Access, portability and handling requests

You can ask whether we process your personal information and request a copy of the relevant records, correction of inaccurate information, or a portable copy where applicable law provides that right. Describe the information and approximate dates involved and provide the account email or other details that help us locate your records. Guest users can also contact us for help. Do not send passwords, authentication tokens or full payment-card information.

“PhotoVinci — Data Request” is a suggested subject line, not a requirement. We may verify your identity, or the authority of someone acting for you, using information proportionate to the request. We respond within the applicable legal deadline; UK and EEA requests are generally answered within one month, with extensions where the law permits. If a request is limited or refused, we explain why and what complaint options you have, as required by law.

European Economic Area and United Kingdom

Subject to the conditions of applicable data-protection law, you may exercise the rights above and lodge a complaint with your local supervisory authority, including the UK Information Commissioner’s Office where applicable. You can contact us first to help resolve a concern, but you are not required to.

California residents

Where California privacy law applies, you may request information about the categories and specific pieces of personal information processed, request correction or deletion, and exercise applicable opt-out rights. We do not sell or share personal information as those terms are defined by California law. We will not discriminate against you for exercising your privacy rights.

8. Children’s Privacy

The Service is not directed to children under 13, or a higher minimum age required by applicable law. Where a young person needs a parent’s or guardian’s permission under applicable law, that permission is required to use the Service. Do not upload photos of children. If you believe a child below the applicable minimum age has provided personal information, or that a child’s photo has been uploaded, contact us so we can investigate and delete it as appropriate.

9. International Processing

We are based in the United Kingdom. Our providers, including Google Cloud and OpenAI, process information in the United States and other countries. Where required by applicable law, international transfers use an appropriate safeguard, such as an adequacy decision or applicable contractual protections.

10. Security

We use reasonable technical and organizational safeguards, including encrypted network connections, authentication and access controls. No online service or storage system can be guaranteed completely secure. Keep your account and device secure, and avoid including unnecessary personal information in the photos you submit.

11. Changes to This Policy

We may update this policy as features or data practices change. The current version will appear here with an updated date. For material changes, we will provide additional notice where required, for example in the app. If a change requires new consent, we will ask for it before the new processing begins. Changes to this policy do not override the choices you have made in the app or in iPhone Settings.

12. Contact Us

For privacy questions and requests, contact the controller below. Mention PhotoVinci so we can route your request correctly. We respond within the time required by applicable law.