Privacy Policy

Introduction

This Privacy Policy explains how MuseFace handles information when users use AI-assisted makeup-transfer features. It applies to account access, selected or captured images, generation jobs, generated results, credits, purchases, history, notifications, language settings, and related support requests.

Information we collect

We may process account identifiers, optional email address, authentication state, selected or captured source and reference images, optional local bare-face image cache state, generated result images, generation status, history metadata, credit records, StoreKit verification data, device permission state, notification settings, language preference, and operational request logs.

Information we do not collect

We do not collect or use advertising tracking identifiers, IDFA, TikTok attribution data, full photo-library contents, Face ID data, face embeddings, faceprints, face geometry templates, health information, precise location, or AI provider secrets stored in the iOS app.

No advertising tracking

MuseFace does not request App Tracking Transparency permission, does not use IDFA, does not include TikTok or other advertising attribution SDKs, and does not configure SKAdNetwork for advertising attribution. If a future version adds advertising or analytics tracking, this Privacy Policy, App Store privacy answers, and the iOS privacy manifest will be updated before that release.

Photos and generated images

You choose a bare-face source photo and a reference makeup photo. These photos and the generated preview contain face data. Only your selected images are uploaded; selecting an image does not itself authorize network processing. Before upload, MuseFace asks for explicit permission for the processing described here. Declining leaves public browsing available.

We store input photos and an immutable verification copy in private AWS S3 storage. The backend checks the verified copy before sending normalized copies of both photos and a makeup instruction to OpenAI. We retain generated previews for history, including versions with and without the MuseFace branding overlay where your export rights allow it.

Optional local bare-face image cache

This optional cache is off by default. When enabled for account use, it keeps only the latest source photo on your device, excludes it from backup, and can be cleared or disabled in Settings. It is separate from server uploads and is not an identity faceprint.

Camera, photo, and save permissions

The system photo picker supplies only images you choose. Camera access is used only when you choose to capture a photo. Saving to Photos occurs only on your action. Camera or photo-library permission is separate from permission to send face photos to AWS and OpenAI.

AI generation provider

Our backend sends both selected photos (normalized for format and size) and a makeup-transfer instruction to OpenAI through its Images API. The iOS app does not call OpenAI directly. The photos are used to produce a makeup preview, not to identify you or authenticate your identity. Generated results may change details and are not medical assessments.

OpenAI describes API data as not used for model training by default unless the API customer opts in. Its standard abuse-monitoring retention for the Images API is up to 30 days, with legal and safety exceptions. We do not represent our service as having approved Zero Data Retention or a specific OpenAI processing residency. Its retention is separate from deletion in MuseFace storage. See OpenAI data controls.

How we use information

We use information to authenticate users, protect account-only features, upload selected images, create generation jobs, return results, show history, manage credits, verify StoreKit purchases, refund failed charged generations, prevent abuse, diagnose errors, maintain security, and respond to account, privacy, support, or billing requests.

Device-local Inspo Library

Users may add reference makeup images to a private Inspo Library stored in the app's local data on their device. These saved images, optional names, and tags are not uploaded to MuseFace merely because they were added to the library, and the developer cannot browse them. A selected inspo image is uploaded only when the user actively starts a try-on, at which point it follows the input-image processing and retention rules described here. The library is not account-synced, is not automatically removed by sign-out or account deletion, can be removed with the in-app delete controls, may be included in device backups, and may be lost if the app is uninstalled.

Generation completion notifications

Generation may take a few minutes. The app may ask for notification permission to alert the user when a generation completes or fails. Notification payloads should not include photos, image URLs, object keys, prompts, or sensitive account details.

Third-party processors

AWS hosts our backend, private S3 image storage and Aurora database in US East (N. Virginia), region us-east-1. AWS Cognito supports authentication. Amazon Rekognition processes the verified input photos for face detection, face size/quality checks and content safety. We use DetectFaces and DetectModerationLabels, not a face-identity search collection.

OpenAI receives both normalized input photos and the makeup instruction for generation. Our current backend uses OpenAI directly without a configured application-level OpenAI proxy. Apple provides Sign in with Apple, StoreKit purchases, distribution and optional push delivery. Photos are not placed in notification payloads.

We have opted out of Rekognition content use for service improvement for our AWS account using an AWS Organizations policy, and verified the effective opt-out setting. AWS states that opting out deletes historical copies kept for improvement, while content needed to provide and maintain the service is separate. We do not claim zero provider retention or independent confirmation that every historical provider copy has already been erased. Provider retention and processing locations may differ from our primary AWS storage. See AWS Rekognition data privacy.

MuseFace does not sell face photos or use them for advertising tracking. We do not include TikTok or advertising attribution SDKs.

Your rights and choices

You can decline face-photo processing and continue browsing, or withdraw permission for future uploads and new generations on the in-app Settings → Privacy Policy page (or the face-photo permission entry in older versions). A materially updated disclosure requires renewed permission. We store the accepted disclosure version and acceptance time on this device; no face data is included in that consent record. Withdrawal cannot recall photos already transmitted or cancel an already accepted generation job.

For an Apple-linked account, use the in-app Delete Account action to request account and associated server-media deletion. Server media deletion is asynchronous and retries failures; it does not cancel Apple subscriptions. Guests and users requesting specific photo deletion can contact support@museface.app; provide a job identifier if available; we will help identify the relevant guest records, not a password or a new face photo. We may verify ownership before acting.

Local cache clearing, sign-out, account deletion and permission withdrawal are different operations. Clear optional source cache and saved inspo separately in the app. Local inspo and exported Photos copies are not removed by server account deletion. You control camera, Photos and notification permissions in iOS Settings, and subscriptions through Apple.

Children and minors

MuseFace is intended for clear single-person face images. Minors should use the app only with guardian guidance, and users are responsible for uploading photos they have the right and consent to use.

Retention and deletion

Inputs associated with an accepted generation job become eligible for application cleanup 72 hours after job creation, once that job has finished (succeeded or failed). A background worker scans for eligible objects approximately every minute. It attempts to delete the verified input copy and corresponding original, and records successful deletion; failures remain eligible for retry. This is not a guarantee that every photo is erased within 72 hours of upload.

Unused guest uploads are eligible for cleanup after their upload session expires. A verified S3 lifecycle backstop also covers both account and guest temporary-input directories, including originals and verification copies, with expiry set to seven days after each object is uploaded or replaced. S3 rounds expiry eligibility to the next UTC midnight and performs deletion asynchronously; this is not a guarantee of physical deletion within exactly 168 hours. This backstop includes unassociated uploads and interrupted-processing leftovers in those directories. Incomplete multipart uploads there are aborted after one day. Generated results are outside these rules.

Generated result images and history have no automatic expiry and remain for the history feature until deletion is completed. Optional source cache remains locally until cleared or disabled; device-local Inspo Library remains until you delete its items or remove the app, and may be in device backups. Result-image caches are excluded from backup; exported Photos copies remain under your control.

Account deletion removes direct account fields and disconnects history, queues associated object deletion, retries failures with backoff, and rechecks completed deletion targets for late uploads. Transaction, anti-fraud and deletion-reconciliation metadata may remain where needed for integrity and legal obligations; it is not a retained face template. Aurora automated recovery backups are configured for one day; manually retained snapshots, if any, are separate. Operational logs currently have no configured automatic expiry; they are not intended to contain image bytes, and sensitive tokens and image URLs/keys are redacted by the application logger.

Deleting MuseFace objects does not itself delete copies held under a provider's own retention rules. The OpenAI and Rekognition practices in sections 5 and 8 apply separately. Contact support@museface.app for deletion or retention questions.

Changes to this policy

We may update this Privacy Policy when MuseFace changes its features, processors, permissions, data practices, or legal requirements. The updated policy will be published at this page with a revised effective date or last-updated date.

Contact

For privacy questions or requests, contact us at support@museface.app.

Face-photo processing and permission

Face data means the faces visible in selected source and reference photos, the generated face preview, and temporary detection measurements needed to check input suitability. Rekognition responses can include face position, confidence, quality, pose and landmarks. MuseFace evaluates face count, confidence, image brightness/sharpness, face area and moderation labels in memory. It does not use age estimates as an upload gate, perform identity matching, or create or persist a faceprint, identity embedding or face-geometry template.

Our database retains image object identifiers, owner/job identifiers, status and necessary transaction/history metadata, not a searchable biometric template. Private image objects and short-lived signed links are distinct from a face-recognition collection. The photos themselves still contain identifiable faces even though no identity template is created. The purposes, providers, storage, retention and deletion choices in sections 4, 5, 8, 9 and 11 apply to this face data.

Before either selected face photo is uploaded, the app asks you to agree to sending both photos to AWS in the US (us-east-1) for private storage, face-quality/content checks, and to OpenAI for makeup generation. The short confirmation links to this policy for the complete processing, retention and deletion information in sections 4, 5, 8 and 11. Reading this page or granting camera/photo access does not grant face-photo processing permission.

In the updated app, opening Privacy Policy from Settings shows this full document directly. If permission is active, the native Withdraw permission action on that same screen stops future uploads and new generation requests, even if the webpage cannot load. Withdrawal does not recall transmitted photos, cancel accepted jobs or delete history; deletion options are described in section 9. Permission is granted only through the explicit upload confirmation, never by the webpage.