Privacy Policy

1. What data we process

• Account: your guest account ID; your email and password if you created an account (the password is stored only as a secure hash by our authentication provider); your name and email from Google if you sign in with Google.
• Images: uploaded photos, selfies for Soul, Copy Shot references and generated results.
• Requests: text descriptions of edits, your wishes and conversations with the AI agent, and your answers during first launch (“how did you hear about us”, “what do you want to do”).
• Coins: your balance and the history of credits and charges.
• Technical data: the sign-in session cookie, analytics cookies (Google Analytics), a cookie with your chosen language, a flag in browser storage that you completed onboarding, your push notification subscription (if enabled), and technical logs. Your IP address is used to protect against abuse and is stored only as an irreversible hash for up to 2 days.

2. Why

• To run generations and show you results and history.
• To keep your account, gallery and coins.
• To notify you when your photos are ready, if you turned notifications on.
• For moderation and protection against bots, abuse and fraud.
• To improve the Service based on anonymized statistics.

We don't sell your data and don't use your photos to train models.

3. Who we share data with

Only with providers the Service can't work without, and only as much as needed:

• Supabase — database, accounts and file storage ([storage region]).
• [Hosting provider] — the server the app runs on ([server location]).
• OpenAI — image generation and analysis, moderation.
• fal.ai — generation, upscaling and background removal.
• Cloudflare — checking that you're not a bot (Turnstile).
• Google — if you choose to sign in with Google.
• Google Analytics — anonymized statistics on visits (pages, device type, approximate region) to improve the Service. It uses cookies. In the EEA and the UK, only with your consent — you can change your choice in Settings → Cookie settings.
• Your browser's push service (Apple, Google or Mozilla) — to deliver notifications, if you turned them on.

Providers may be located outside your country, including in the USA, and may keep data for a limited time under their own rules (for example, to detect abuse). [Note for the lawyer: check the requirements of the countries where the Service operates, e.g. GDPR and Russia's Federal Law 152-FZ on data localization and cross-border transfer.]

4. How long we keep it

• Photos, results and agent conversations — until you delete them or while your account exists.
• A result deleted from the gallery is removed from storage.
• Uploaded photos that aren't linked to anything are deleted automatically after a day.
• Abuse-protection counters — up to 2 days.
• After an account is deleted, its data is erased within [30] days, except what we're required to keep by law.

5. Your rights

You can request access to your data, its correction or deletion, and deletion of your account by writing to [privacy@shootie.app]. You can delete individual results right in the gallery. We'll reply within [30] days.

6. Security

Personal photos are kept in private storage and opened through temporary links. Access to data is restricted by rules at the database level. Data is transmitted only over an encrypted connection.

7. Age

The Service is not intended for people under [18]. Selfies of children are not accepted for Soul.

8. Changes

We'll update this policy when the Service changes and let you know about significant changes in the app. See also the Terms of Use.