Privacy Policy

1 What we collect and why

Email address

Collected at account creation via Google Sign-In, for sign-in identity and account recovery.

Display name & profile photo URL

Collected at account creation via Google Sign-In, for personalizing your account; provided by Google, not chosen by us.

Uploaded photo

Collected each hairstyle generation, sent to our AI provider to generate the preview; not used for any other purpose.

Generated result image

Created each hairstyle generation, shown to you; stored so you can view past results.

Purchase/subscription status

Collected when subscribing or buying credits for entitlement checks.

App usage events

Collected throughout app use to understand feature usage and diagnose problems.

2 Where your data lives, and who processes it

Firebase Authentication (Google)

Authenticates you. You sign in with your Google account; we do not collect or store a password. Firebase issues the short-lived ID token the app uses to call our backend, and we receive your email address, display name, and profile photo URL as provided by your Google account.

Cloud Firestore (Google/Firebase)

Stores your basic profile record (email address, display name, profile photo URL, and account-created / last-sign-in timestamps) so your account info is available across sessions and devices.

Amazon S3 (AWS)

Stores your uploaded photos and generated results in private storage buckets. Nothing in these buckets is publicly accessible; every read happens through a short-lived, single-use signed link. Uploaded source photos are automatically deleted 24 hours after your generation finishes; generated results are retained for 90 days unless you delete your account sooner, in which case they are deleted immediately.

Amazon DynamoDB (AWS)

Stores records of each generation you request (which style, when, status) and a billing ledger of credit transactions. The billing ledger is retained after account deletion for financial record-keeping — see "Account deletion" below.

Google Gemini API

The AI model that generates your hairstyle preview. Your uploaded photo is sent to this API for the sole purpose of producing that one generation; we do not use your photos to train any model, and we do not share your photos with any other party. See Google's own API terms for how Google itself handles data submitted to the Gemini API.

RevenueCat

Manages subscription and in-app-purchase state. Receives an anonymized account identifier and your purchase receipts from the App Store / Play Store; never receives your photos, email, or password.

Firebase Analytics (Google)

Receives aggregated usage events tagged with generic parameters like a style identifier or a subscription-plan identifier. We never send photos, image data, authentication tokens, email addresses, or any other directly-identifying information to analytics.

3 Account deletion

Deleting your account from the app permanently and immediately deletes:

• Your uploaded photos and generated results (Amazon S3)
• Your generation history records (Amazon DynamoDB)
• Your cached subscription-status record

This does not automatically delete your underlying Google/Firebase sign-in or your Firestore profile record (email, display name, profile photo URL). To have these fully removed, contact support.trycut@gmail.com and we will complete the deletion manually.

We retain your credit-transaction ledger (which purchases were made, which credits were spent, when) after deletion, stripped of any content you generated, because financial/billing records are needed for accounting, tax, and fraud-prevention purposes. This ledger contains no photos and no generated images.

4 Your rights

Depending on where you live, you may have the right to request a copy of the data we hold about you, or to request its deletion. Contact support.trycut@gmail.com to exercise these rights.

5 Changes to this policy

We will update this page when what we collect or how we use it changes, and note the date of the most recent revision.