Privacy Policy

Effective date: 2026-04-28

This Privacy Policy explains what information PaletteSnap (the "App", operated by Mohammed Alquraini) collects, how it is used, and how you can control it. PaletteSnap is an iOS app that performs AI seasonal color analysis on a single selfie.

1. Summary

• PaletteSnap has no login, no email capture, and no analytics SDK.
• Your selfie is sent over HTTPS to our backend, then forwarded to Google's Gemini 2.5 Flash vision model via OpenRouter, for the analysis request only. The selfie is not stored on our backend after the response.
• On-device face detection (Apple Vision framework) is used only to help you frame the selfie. Face geometry never leaves your phone.
• We do not sell your data, do not share it with advertisers, and do not use it to train any model.
• PaletteSnap does not track you across other companies' apps or websites.

2. Information we collect

Face data

PaletteSnap is a seasonal-color-analysis app. Because the analysis is computed from a selfie of your face, the data we process necessarily includes face data. We treat that data with the following commitments.

• What we collect: a single still selfie image (a JPEG photograph) that contains your face. We do not collect Face ID biometric templates, FaceID-style 3D facial geometry, an enrolment-style face print, infrared depth maps, or any data from the TrueDepth sensor. Apple Face ID data never leaves the device's Secure Enclave and is not exposed to any third-party app, including PaletteSnap.
• On-device face detection (Apple Vision framework): while you are framing the selfie, the app uses Apple's on-device Vision framework to detect that a face is present and well-positioned (face bounding box and approximate pose). This detection runs entirely on your iPhone, is used only to provide live framing feedback in the camera UI, is never transmitted anywhere, and is discarded immediately after the photo is taken.
• Backend processing of the selfie: when you tap Analyze, the JPEG selfie is sent over HTTPS to our backend at api.palettesnap.apflowhq.com. The backend forwards the same JPEG to Google's Gemini 2.5 Flash vision model via OpenRouter for one inference request. The model returns a structured JSON object (seasonal color season, undertone, palette hex codes, makeup recommendations, colors to avoid, confidence, rationale).
• Planned uses of the face data: the only use is computing your seasonal-color result for that one analysis. Face data is not used for advertising, profiling, identity verification, biometric authentication, training any model, or any purpose other than returning the color-analysis result.
• Sharing with third parties: the selfie is sent to OpenRouter (request routing) and Google (Gemini 2.5 Flash inference). Neither stores the request body beyond the request lifetime under their stated zero-retention API policies. We do not share face data with any other third party — no advertisers, no analytics, no data brokers.
• Storage and retention of face data: zero retention. The selfie bytes live in our backend's request-handler memory only for the duration of the inference call (typically 5–15 seconds), then are released by Go's garbage collector. We do not write the selfie to any database, file store, log, queue, or backup. The on-device app does not save the selfie to disk unless you choose to (we do not). After the analysis result is returned, no copy of your selfie or any face-derived feature exists on our systems.
• Where this is documented in the privacy policy: this dedicated Face Data sub-section under §2; the third-party listing in §5; the retention statement in §7; and the security statement in §10.

Selfie photo

• What: the single photo you submit for analysis (see Face Data above for the face-specific treatment).
• How: sent over HTTPS to our backend, then forwarded to Google's Gemini 2.5 Flash vision model via OpenRouter for the analysis request.
• Retention on our backend: the photo is processed for the analysis request and is not retained after the response is returned. We do not save it to any database, file store, log, or backup.
• Retention by OpenRouter and Google: we use OpenRouter's standard zero-retention routing and Google's Gemini API. Per their stated policies, request bodies are processed for the inference call and are not retained for training or other downstream use. See openrouter.ai/privacy and ai.google.dev/gemini-api/terms.

Apple App Attest key hash

• What: a SHA-256 hash of an Apple App Attest public key generated by your device on first launch.
• Why: lets us enforce the one-free-analysis-per-device limit without requiring an account.
• What it is not: not your Apple ID, not your IDFA, not your phone number, not reversible to a real-world identity.
• Retention: stored in Redis indefinitely, keyed by the hash, so the free-analysis cap survives reinstalls of the app on the same device.

RevenueCat anonymous app user ID

• What: a pseudonymous identifier generated on-device by the RevenueCat SDK on first launch.
• Why: lets RevenueCat manage your subscription entitlement state, and lets our backend enforce the 30-analyses-per-day rate limit for paid users.
• What it is not: not linked to your name, email, Apple ID, or IDFA.
• Retention: retained for the life of the subscription plus a short grace window so renewals and refunds can be honoured.

Subscription receipts

• What: the App Store purchase receipt for any PaletteSnap subscription you buy.
• How: Apple handles the purchase, and RevenueCat relays the entitlement state to the app.
• Retention: stored by RevenueCat for the life of the subscription plus a short grace window.

3. Information we do not collect

PaletteSnap does not collect your name, email address, phone number, postal address, contacts, calendar, location, health data, IDFA, or advertising identifier. PaletteSnap has no analytics SDK, no crash analytics SDK beyond the aggregate reports Apple makes available to developers through App Store Connect, and no third-party tracking SDKs.

4. How we use your information

• To run the AI seasonal color analysis on your selfie and return the result. This is the only use of the selfie / face data.
• On-device face framing feedback while you compose the selfie. Runs in Apple's Vision framework locally, never transmitted.
• To enforce the one-free-analysis-per-device cap on the unpaid tier.
• To verify your subscription entitlement and apply the daily request limit to paid users.
• To respond to your support requests when you email us.

We do not use face data or any other collected information for advertising, profiling, identity verification, biometric authentication, or training any model.

5. Third parties

We use the following third parties to deliver the App. Each is bound by its own privacy policy.

• Apple Inc. — App Store distribution, in-app purchase processing, and App Attest device attestation. See Apple's privacy policy at apple.com/legal/privacy.
• OpenRouter — request routing for the vision-model inference call. The selfie is sent through OpenRouter to reach Google's Gemini 2.5 Flash. See openrouter.ai/privacy.
• Google LLC — vision analysis of your selfie via the Gemini 2.5 Flash model. See ai.google.dev/gemini-api/terms and policies.google.com/privacy.
• RevenueCat, Inc. — subscription state management. See revenuecat.com/privacy.

We do not use Google Analytics, Firebase, Facebook SDK, ad networks, or attribution SDKs. The face data sent to OpenRouter and Google is used only for the immediate inference call, is not retained beyond the request lifetime, and is not used to train any model.

6. App Tracking Transparency

PaletteSnap does not track you across apps and websites owned by other companies. We do not request access to your IDFA, do not show ads, and do not share device or usage data with data brokers, ad networks, or analytics providers that link identifiers across other companies' apps. Per Apple's App Tracking Transparency framework, we do not present a tracking permission prompt because we do not track.

7. Data retention

• Selfies and face data: zero retention. Not retained on our backend after the analysis response. Not retained by OpenRouter or Google beyond the request lifetime under their stated zero-retention API policies. No copy of your selfie or any face-derived feature is kept on any server we operate.
• On-device face detection (Apple Vision framework): face geometry computed locally during selfie framing is discarded immediately after the photo is taken and is never transmitted.
• App Attest key hash: retained indefinitely so the free-analysis cap survives reinstalls.
• RevenueCat appUserID and receipts: retained for the life of the subscription plus a short grace window.

8. Your rights

If you are in the European Economic Area, the United Kingdom, Switzerland, or California, you have rights under the GDPR (Articles 15-22) and the CCPA, including the right to access, correct, delete, restrict processing of, port, or object to processing of your personal data, and the right to opt out of the sale or sharing of personal information. PaletteSnap does not sell or share personal information.

To exercise any of these rights, email gmohammed0020@gmail.com with the request and the App Attest key hash or RevenueCat appUserID associated with your device (both are visible in the App's debug log on request). We will respond within 30 days.

9. Children's privacy

PaletteSnap is rated 4+ and is suitable for general audiences. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has used the App, email us and we will delete any associated records.

10. Security

All traffic between the App and our backend is encrypted with TLS 1.2+. App Attest cryptographically binds analysis requests to a specific device. We do not store selfies or any face data, so there is no selfie data or face data at rest to breach.

11. Changes to this policy

If we make material changes to this Privacy Policy, we will update the effective date above and post the new version at this URL before the change takes effect. Continued use of the App after the effective date constitutes acceptance of the change.

12. Contact

Questions about this Privacy Policy? Email gmohammed0020@gmail.com.

PaletteSnap is operated by Mohammed Alquraini (legal entity: Mohammed Salim Humaiyad), Sultanate of Oman.