Privacy Policy

1. Introduction

CinderSpire Studio ("we," "us," or "our") operates the Lookify mobile application (the "App"), an AI-powered virtual try-on service that lets you visualize different hairstyles, hair colors, makeup styles, and clothing on your photos.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App. We are committed to protecting your privacy and ensuring transparency in our data practices.

By using Lookify, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please do not use the App.

2. Information We Collect

2.1 Information You Provide

2.2 Automatically Collected Information

2.3 Purchase & Subscription Data

When you subscribe to Lookify Premium or purchase credit packs, transaction data is processed and stored by the platform's app store (Apple App Store or Google Play Store) and our subscription management services (RevenueCat and Adapty). We receive:

• Subscription status (active, expired, cancelled, in trial)
• Plan type (monthly, yearly) and credit balance
• Transaction identifiers (anonymous)
• Trial eligibility information

We do not receive or store your payment method details (credit card numbers, bank information, etc.). All payments are processed securely by Apple or Google.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide the Service: Process your photos through our AI to generate virtual try-on results
• Manage Subscriptions: Track your subscription status, credit balance, and entitlements
• Improve the App: Analyze usage patterns and session recordings to enhance features, fix bugs, and optimize the user experience
• Serve Advertisements: Display relevant ads to free-tier users via Google AdMob
• Customer Support: Diagnose issues using crash reports and device information
• Prevent Abuse: Use device identifiers for rate limiting and to prevent fraudulent use of free credits
• Legal Compliance: Comply with applicable laws and regulations
• Remote Configuration: Deliver feature flags, trial durations, and in-app settings via Firebase Remote Config

4. Third-Party Services

We integrate the following third-party services, each with their own privacy policies governing data they collect:

We encourage you to review the privacy policies of these third-party services to understand their data practices.

5. Cookies & Tracking Technologies

As a mobile application, Lookify does not use traditional browser cookies. However, the following tracking technologies may be used:

• Advertising Identifiers: IDFA (iOS) and GAID (Android) may be used by Google AdMob to deliver personalized advertisements. You can reset or limit these identifiers in your device settings.
• Firebase Analytics: Uses device identifiers and instance IDs to track app usage and engagement metrics.
• Microsoft Clarity: Records anonymized session data including screen taps, scrolls, and navigation patterns to generate heatmaps and session replays. Sensitive input fields are automatically masked.
• Sentry: Uses session data to group crash reports and track error patterns across app versions.

Opting Out

• Ad Personalization (iOS): Go to Settings > Privacy & Security > Tracking, and disable tracking for Lookify. Alternatively, enable "Ask App Not to Track" globally.
• Ad Personalization (Android): Go to Settings > Privacy > Ads, and select "Delete advertising ID" or "Opt out of Ads Personalization."
• Analytics: You may limit analytics data collection by restricting background data usage for the App in your device settings.

6. Data Retention

You may request early deletion of your data by contacting us (see Section 12).

7. Data Sharing & International Transfers

We do not sell your personal data to third parties. We share data only as described in Section 4 (Third-Party Services) and in the following circumstances:

• Legal Requirements: When required by law, regulation, legal process, or governmental request
• Protection of Rights: To protect the rights, property, or safety of CinderSpire Studio, our users, or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets, in which case your data would remain subject to this Privacy Policy

Our third-party service providers operate globally. Your data may be transferred to and processed in countries outside your country of residence, including the United States and countries within the European Economic Area. These transfers are conducted under appropriate safeguards, including Standard Contractual Clauses (SCCs) where required by applicable law.

8. Your Rights & Choices

8.1 General Rights (All Users)

Regardless of your location, you have the right to:

• Request information about what data we hold about you
• Request deletion of your data
• Opt out of personalized advertising
• Uninstall the App at any time to stop all data collection

8.2 European Economic Area (GDPR)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation:

• Right of Access: Obtain a copy of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restriction: Restrict the processing of your personal data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal

Legal Basis for Processing: We process your data based on (a) your consent (photos, advertising identifiers), (b) performance of a contract (subscriptions), and (c) legitimate interests (analytics, crash reports, security).

You may lodge a complaint with your local Data Protection Authority if you believe your rights have been violated.

8.3 California (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to Know: Request the categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the "sale" or "sharing" of your personal information. We do not sell personal information in the traditional sense, but ad-related data sharing may constitute a "sale" under CCPA.
• Right to Non-Discrimination: You will not be penalized for exercising your privacy rights

To exercise your CCPA rights, contact us at [email protected]. We will respond within 45 days.

8.4 Turkey (KVKK)

If you are located in Turkey, you have rights under the Kisisel Verilerin Korunmasi Kanunu (KVKK - Law No. 6698):

• Learn whether your personal data is processed
• Request information about the processing
• Learn the purpose of processing and whether it is used in accordance with its purpose
• Know the third parties to whom your data is transferred
• Request rectification of incomplete or inaccurate data
• Request deletion or destruction of your data under the conditions specified in Article 7 of KVKK
• Object to a decision made solely by automated processing which produces a negative result concerning you
• Claim compensation for damages arising from unlawful processing

To exercise your KVKK rights, contact us at [email protected]. We will respond within 30 days as required by law.

9. Children's Privacy

Lookify is not intended for use by children under the age of 13 (or the applicable minimum age in your jurisdiction, such as 16 in certain EEA countries). We do not knowingly collect personal information from children under these age thresholds.

If we become aware that we have collected personal data from a child under the applicable minimum age without parental consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected] and we will take immediate action.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• All data transmitted between the App and our servers uses HTTPS/TLS encryption
• API requests are routed through our secure Cloudflare Worker proxy — no API keys are stored in the App
• Photos are processed in-memory and never written to persistent storage on our servers
• Device identifiers are pseudonymized and not linked to personal identity
• Access to backend systems is restricted with authentication and role-based access controls

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will:

• Update the "Last Updated" date at the top of this page
• Post the revised policy at this URL
• For material changes, provide notice through the App or other appropriate means

We encourage you to review this Privacy Policy periodically. Your continued use of the App after changes are posted constitutes your acceptance of the revised policy.

12. Contact Us