Information you provide
- Account and authentication data (for example, email or identity provider identifiers via Supabase Auth).
- Profile details such as display name and avatar, where provided.
- Photos and content you choose to upload for Experiences.
- Prompts, options, and generation parameters you select for an Experience.
- Support messages you send us, and any report you submit about a result.
- Legal consent records when you accept our terms and disclosures in the app.
Prompts, parameters, and AI results
- The Experience you choose, the input photos you submit, and the parameters or options for that generation.
- AI-generated results produced for you, plus technical metadata about each generation job.
- These are processed to produce, deliver, and store your result and to apply automated safety and quality checks.
Photos and uploaded content
We process uploads to provide the generation, restoration, or export you request.
We do not sell your photos.
We do not use your photos to train Cherlume's own AI models.
Uploaded content is stored in private cloud storage and may be transmitted to trusted AI providers solely to deliver the service.
- Uploaded photos and generated results may be stored to complete processing, show your history, support downloads, and operate your account.
- We retain this data for as long as needed to provide the service, maintain your account and generation history, comply with legal obligations, resolve disputes, prevent abuse, or until you request deletion where applicable.
Purchases and payment metadata
Payments for credits or subscriptions are processed by Apple App Store or Google Play. We receive purchase validation metadata (not your full payment card details) through those platforms and through RevenueCat.
Technical data and logs
- Device and app version information.
- Diagnostic, performance, and security logs from our servers.
- IP address or coarse location derived from network requests (for security and abuse prevention).
- Hashed identifiers stored with legal consent records (for example, a hash of IP address and user-agent for audit).
Usage and product analytics
When you use the app with our online services enabled, we collect product analytics events (for example, screens viewed, generation started or completed, paywall actions, and stable error codes) to understand how Cherlume is used and to improve the product.
These events are tied to your Cherlume account identifier when you are signed in. Cherlume does not use cross-app advertising tracking or device advertising identifiers for this purpose.
Push notifications
If you enable push notifications, we store a device push token and related metadata (such as platform and app version) to send notifications you opt into, for example when a generation completes.
How we use information
- Provide and improve Cherlume Experiences.
- Authenticate users and protect accounts.
- Process generations, credits, and entitlements.
- Apply automated safety and quality checks.
- Respond to support requests, reports, and legal obligations.
Legal bases (EEA/UK)
If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:
- Performance of a contract — to deliver the Experiences and purchases you request.
- Consent — to process the photos you upload (including facial imagery) and to record your acceptance of our terms; you may withdraw consent at any time.
- Legitimate interests — to secure the service, prevent abuse and fraud, and improve the product, balanced against your rights.
- Legal obligation — to comply with applicable law, retain billing records, and respond to lawful requests.
Service providers and AI processors
Cherlume relies on trusted third parties to operate the service. They process data only to provide their service to us, under contract.
AI processing providers receive your input photos, prompts, and parameters solely to generate or evaluate results for your request.
- Authentication, database, and private file storage: Supabase.
- Application hosting and infrastructure: our cloud hosting providers (including Railway for backend services).
- Purchases and entitlements: Apple, Google, and RevenueCat.
- Push notifications (if enabled): Firebase Cloud Messaging (Google).
- AI image generation: fal.ai and Replicate.
- AI evaluation and planning (multimodal analysis, not primary image generation): OpenRouter, which may route requests to models such as Google Gemini or OpenAI GPT for judging and planning tasks.
Storage and security
Uploaded and generated images are stored in private storage buckets. Access uses time-limited signed URLs rather than public permanent links.
We use reasonable technical and organizational safeguards designed to protect data in transit and at rest. No method of transmission or storage is completely secure.
Data retention
We retain information only as long as needed to provide the service, comply with law, resolve disputes, and enforce agreements.
Uploaded photos and generated results are kept to complete processing, deliver results, and support your account history until you request deletion where applicable or until we no longer need the data for these purposes.
Technical logs and consent records may be kept for security, troubleshooting, and audit purposes for a limited period.
To request deletion of your account or personal data, email us from your account address; we verify ownership before processing.
Your rights and choices
- Access, correction, or deletion of your personal data.
- Data portability and, where applicable, the right to object to or restrict processing.
- Withdraw consent at any time (for example, for photo processing) without affecting prior processing.
- Manage optional push notifications in app Settings where offered.
- Control uploads by choosing what photos to submit.
- Lodge a complaint with your local data protection authority.
- Additional rights may apply depending on your region (for example, GDPR/UK GDPR or CCPA/CPRA). Submit requests via the privacy contact below.
Children
Cherlume is not directed at children under 13 (or the minimum age required in your country), and we do not knowingly collect personal information from them.
Some AI features involving faces may require a higher minimum age in certain regions or app stores. Do not upload photos of children without the consent of a parent or guardian, and only where lawful.
International data transfers
Cherlume uses providers located in different countries, including the United States. As a result, your information — including photos and prompts sent for AI processing — may be transferred to and processed outside your country, including outside the EEA/UK.
Where we transfer personal data internationally, we use appropriate safeguards (such as Standard Contractual Clauses) and select providers that maintain suitable protections consistent with this policy.
App store privacy disclosures
This policy reflects the data practices we declare in Apple's App Privacy (Privacy Nutrition Labels) in App Store Connect and in Google Play's Data Safety section. These declarations cover, for example, photos, purchases, app activity, identifiers, and diagnostics.
If our practices change, we update this policy and the corresponding store declarations.
Contact
Privacy questions or deletion requests: support@cherlume.app.