Privacy policy
This policy explains how your personal data is processed when you use the Softflash mobile app and website. For users in Türkiye, the data protection notice (KVKK) also applies, and the explicit consent text applies to face data.
1. Data controller
The data controller is Eren Gürbüz, Kuşadası, Aydın, Türkiye. For any privacy matter, write to therisyy@gmail.com or use the support form.
2. What data we process
The app does not ask for an email address or password. Your account is created with a randomly generated user ID (a pseudonym) tied to your device. This ID does not contain your name or email, but because it is linked to your account it is personal data.
| Data | Examples | Source |
|---|---|---|
| Photos | The photo you upload, the face region cropped from it and the generated result | Uploaded by you, generated on the server |
| Face data (biometric) | The face vector and facial landmarks of every face in the photo and the result; the head angle, eyes, iris and skin color measured from these landmarks (in the Background Cleaner, only for the main people; see “Other people in the photo”) | Calculated from the photo for a moment |
| Account data | Randomly generated user ID, diagnostic code, time zone, store country, platform, app version, creation and last use time, account status (e.g. a restriction for breaking the rules) | The app |
| Notification data | If you allow notifications, your device's notification token. If you turn on the “Campaign and announcement notifications” switch in Settings (it is off by default), your device is subscribed to the announcement and campaign notification topic in your language; turning the switch off unsubscribes it. Allowing notifications alone does not start this subscription. If you turn on the daily credit reminder, the token and your language preference are also stored by us. | The app |
| Plan and credits | Subscription plan, renewal date, credit balance, credit history | The app, Apple, Google, RevenueCat |
| Sales and refund records | Product bought, store, price and proceeds, time; refunds the store has made, the repeated refund flag | Apple, Google, RevenueCat |
| Generation record | Selected style or tool and options, status, error code, verification score numbers, date | The server |
| Consent record | Type of consent, text version, time and the history of giving or withdrawing consent | Given by you |
| Reports and support | Your message, its topic, your email, diagnostic code, order number, the related generation, app version and platform | Written by you |
| Usage and error data | Screen and feature use (only with your analytics permission), device model, app version, error logs | The app and website |
| Technical logs | Logs of requests to our servers (including IP address), the anonymous session (Firebase Authentication), app configuration (Remote Config), the device check (App Check) result that confirms a request comes from the genuine app, and the app update check (Expo) | The app and website |
Payment details are processed by Apple and Google. We never see your card details.
3. Face data (biometric data)
For the photo you apply an AI style or tool to and for the generated result, our server calculates a mathematical face vector and facial landmarks for every face (in the Background Cleaner, only for the main people; see “Other people in the photo”). This data is used only for these purposes:
- Checking that the photo is suitable: the number of faces, the position and size of each face, the head angle and whether the eyes are visible are checked.
- Verifying that your face did not change: the vectors of the faces in the input and the result, the proportions of the facial landmarks and the iris and skin color found from these landmarks are compared.
- Placing your original face into the result when needed: if the AI changed the face, the face from the original photo is aligned to the result with the landmarks and placed in it, matched to the scene's light. That result passes the same verification. This step is not done in tools such as the Background Cleaner; a result that does not pass verification is not delivered.
This is a special category of personal data. Face data cannot be changed like a password; if it were obtained by someone else, it could be misused to recognize or impersonate you. That is why these rules apply:
- When you pick a photo, even before you give consent, the face is detected on your device with Google ML Kit: only the face position, head angle and whether the eyes are open are checked. No face vector or landmarks are calculated at this step, and the photo does not leave your device.
- When you tap “Select person” for subject light in the Filters editor, the person's silhouette is separated on your device (Apple Vision on iOS, Google ML Kit on Android). This is a silhouette mask: no facial features are extracted, and no face vector or landmarks are calculated. The photo does not leave your device; the mask is held in memory only while the photo is open. The Night Clean preset uses the same mask; to charge its credit, only the preset's name and a request ID are sent to our server, not the photo.
- The face vector and landmarks are calculated only with your explicit consent. If you do not consent, you cannot use the AI styles and tools (e.g. the Background Cleaner). Filters keep working.
- They are held only on the servers of our hosting provider Google in Belgium (europe-west1), in the memory of our guard service that works on our behalf, for the duration of the operation, and discarded when the operation ends. They are never written to disk, a database or logs.
- They are not sent to the AI generation service (Gemini API), not shared with third parties, not used for any purpose other than those above and not used to identify you. To apply the style or tool, your photo and the face region cropped from it are sent to that service; these are the photo itself, not a biometric template. In the Background Cleaner, the photo sent to this service also contains the image of the people in the background; the face region is cropped only from the main people. The image of the people in the background is processed only to remove them from the photo and is deleted on the same schedule as the photo.
- Only the score numbers that result from the comparison are written to the generation record. If you report "My face changed", these numbers are also copied to the complaint record. Your face cannot be rebuilt from these numbers. If you allow analytics, whether the verification passed is also recorded in usage analytics.
Other people in the photo: The verification checks that every face in the photo did not change. So if other people appear in your photo, the same data is calculated from their faces, for the same purposes and under the same rules; for them too, only the score numbers stay in the generation record. In the Background Cleaner tool, face data is calculated only for the main people in the photo (the largest one or two faces). The faces of other people in the background are only detected on the server; their position and size are used in memory during the operation to check that no new face appears in the result. No face vector is calculated for them and no iris or skin color is measured; the rough eye, nose and mouth points that the face detector finds along with each face are not used and are discarded when the operation ends. When you upload the photo, you declare that you have their explicit consent. In the Background Cleaner, this consent is not required for the people in the background you want removed from the photo; their image is processed only to remove them from the photo, and no face vectors are calculated for them. You must have the consent of the main people who remain in the photo. A person who appears in a photo can exercise their rights by writing to therisyy@gmail.com or using the support form, even without an account.
4. Why we process data and our legal basis
| Purpose | Legal basis |
|---|---|
| Applying the style or tool you choose to your photo and delivering the result | Formation and performance of a contract |
| Using face data to check that the photo is suitable, verify that your face did not change and place your original face into the result when needed | Explicit consent |
| In the Background Cleaner, processing the image of the people in the background only to remove them from the photo (no face vectors are calculated) | Under legal review; this row will be updated once settled |
| Subscription, credit (including the Night Clean preset's credit) and refund operations | Performance of a contract, legal obligation |
| Sending the store delivery details and our view on a refund request, flagging repeated refunds | Legitimate interest (preventing abuse), performance of a contract |
| Service notifications you ask for (result ready, daily credit reminder) | Performance of a contract |
| Campaign and announcement notifications | Explicit consent (the switch in Settings); in Türkiye, prior approval under Law No. 6563 |
| Answering support requests and fulfilling data rights | Performance of a contract, legal obligation |
| Preventing abuse, security and error tracking | Legitimate interest |
| Usage analytics | Explicit consent (section 8) |
Store refund requests: When you ask Apple or Google for a refund, our subscription provider RevenueCat sends the store, on our behalf, information showing that the purchase was delivered to you and our view on the refund. If the number of refunds the store has made on your account reaches three, the account is automatically flagged as a repeated refunder, and on later refund requests we tell the store that we prefer no refund. The flag does not stop you from buying, and the store always makes the refund decision. Apple requires your consent for this sharing; that consent is in section 6 of the terms of use. The legal basis for the processing is our legitimate interest. If you think the flag is wrong, you can object through the support form; we will review it and remove it where appropriate.
We do not sell your data for advertising.
5. Who we share data with
Data is shared only with providers working on our behalf, and only to deliver the service:
| Provider | Purpose | Data |
|---|---|---|
| Google (Firebase, Cloud, Gemini API, ML Kit) | Hosting the app, website and face verification service, database, temporary storage, anonymous sessions, notifications, device checks, AI generation, error and crash logs | Photos and the face region cropped from them, face data processed in memory on the hosting servers, account and credit data, notification token, device check result, error and crash logs, server request logs including IP address |
| RevenueCat | Subscription and purchase tracking, answering store refund requests | Randomly generated user ID, purchase records, store country, repeated refund flag |
| PostHog (EU) | Usage analytics (only with your permission) | Randomly generated user ID, usage events |
| Expo (650 Industries) | Delivering app updates | IP address, platform, app and runtime version, update client ID |
| Apple and Google | Store, payment, refund requests, notifications, device checks (App Attest, Play Integrity) | Purchase, delivery status of the purchase and our view on the refund when you request a refund, device notification and device check details |
Your photo and the face region cropped from it are sent to Google's AI service, the Gemini API, to apply the style or tool you choose. Some effects (such as Lo-Fi Digicam) do not use an AI service; the photo is processed only on our own servers. The face vector and facial landmarks are not sent to these services. In the Background Cleaner, the photo sent also contains the image of the people in the background; the face region is cropped only from the main people. This image is processed only to remove them from the photo and is deleted on the same schedule as the photo. Under Google's terms, this data is not used to improve Google's products or to train its general models; Google may keep it for a limited time only to detect abuse (section 7). Our guard service that calculates face data also runs on Google Cloud; there Google only provides hosting on our behalf. If we start working with an advertising measurement partner, we will update this table and ask for your permission first where required.
Data may also be shared with competent authorities and courts where the law requires it.
6. International transfers
Our servers run in Google's Belgium region (europe-west1). AI generation runs on Google's Gemini API: your photo may be processed, only to apply the style or tool, on Google's global infrastructure (outside the EU, including the United States). The face vector and facial landmarks are always processed only on our servers in Belgium, in memory. Firebase's session, crash reporting, notification, device check and configuration services and our server logs are processed on Google's global infrastructure (including the United States). Analytics data is held on PostHog's EU infrastructure. RevenueCat and Expo are based in the United States. Transfers from Türkiye are subject to the conditions and safeguards set out in KVKK Article 9. Transfers from the EU rely on the EU Standard Contractual Clauses (SCC).
7. Retention periods
| Data | Period |
|---|---|
| Photos and results (our servers) | Right after delivery, within 24 hours at the latest |
| Photo and face region sent to Vertex AI before version 2 of this policy (Google) | Under Google's abuse monitoring policy, may be logged only to examine suspected abuse and kept for up to 90 days. Not used for model training. |
| Photo and face region sent to the Gemini API (Google) | 55 days under Google's abuse monitoring policy, only to detect abuse. Not used for product improvement or general model training; may be used only in Google's models for policy enforcement. |
| Face vector and facial landmarks | In memory, for the duration of the operation only |
| Generation records | 30 days |
| Account and credit data | Until you delete your account (Settings > Delete my data, or the data deletion form) |
| Sales and refund records | Until you delete your account |
| Repeated refund flag | Until you delete your account; removed earlier if your objection is upheld |
| Consent records and history | Until you delete your account |
| Notification token (stored by us) | Until you turn off the reminder or delete your account |
| Server request logs (including IP) | 30 days |
| Credit history | Until a deletion request |
| Report and complaint records | Until a deletion request |
| Admin action records (such as a restriction, credit adjustment or data deletion on your account; no photos or messages) | Kept after a deletion request to show that the action was taken |
| Analytics | 12 months |
| Error logs | 90 days |
| In-app support requests | Until a deletion request |
| Web forms | 24 months |
| Recovery and backup copies of deleted data | 30 days at the latest |
| History (Gallery) | On your device only, until you delete it |
The Gallery is never sent to our servers. On iOS it may be included in your phone's backup (iCloud) and restored to a new phone from that backup; on Android it is not backed up. Apart from a backup, your history is lost if you delete the app.
8. Analytics, cookies and the website
In the app and on the website, usage analytics run only with your permission. If you do not allow them, analytics stay off; this does not stop you from using the service. You can change your decision at any time in Settings in the app, and from the “Cookie preferences” link at the bottom of the page on the website. Analytics data is linked not to your name or email but to the randomly generated user ID (a pseudonym) tied to your account, so it is personal data, not anonymous data.
The website works without cookies. If you allow it, analytics cookies are used to measure usage. If you decline, nothing is stored on your device for analytics; only your choice is saved. Your choice on the website is stored only in your browser.
When you send a web form, what you write is stored to answer your request. To prevent spam, a hash of your IP address created with a secret key is kept briefly and deleted within a few days; the form record does not contain the IP address itself. For server request logs, see section 7.
9. Children
Softflash is not for children under 13, or under 16 in the European Union and the European Economic Area. Photos of children under 13 must not be uploaded. If we learn that we have processed such data, we delete it.
10. Your rights
You have the right to access your data, ask for it to be corrected or deleted, restrict or object to its processing, receive it in a portable format and withdraw your consent at any time. Withdrawing consent does not make earlier processing unlawful.
You can send requests to therisyy@gmail.com or through the support form. You can also use the same channels to object to an outcome against you from an automated assessment, such as the repeated refund flag. Because your account is anonymous, we ask you to include your diagnostic code (at the bottom of Settings) and your store order number if you have one. We answer within 30 days at the latest.
You can complain to the data protection authority of the country you live in. In Türkiye, you must apply to us before complaining to the Personal Data Protection Board (KVKK Article 14); the time limits are in the data protection notice (KVKK).
11. Deleting your data
In the app, Settings > Delete my data removes your data from our servers right away. The records that are not deleted, or are deleted when their period ends, are listed on the data deletion page. If you no longer have the app, use the data deletion form.
12. Security
Data is encrypted in transit and at rest. Only the server processes that deliver the service can access photos, and access is limited by authorization and logging. No system is perfect. If a data breach happens, we will inform you and the competent authority as the law requires.
13. Changes
We may update this policy. The current version number and date appear at the top of the page. We announce important changes on this page a reasonable time before they take effect and, where possible, in the app too.