1. Operator and scope
Wonyoung Jang operates Cufit AI. This policy applies to photo-based AI generation, saved photos, generation history, purchases and related app services. Privacy contact: nex5turbo.app@gmail.com.
2. Information processed
- A pseudonymous server-issued user identifier and device authentication information stored in Keychain, used to protect your requests, credits and history. The app does not require an email-and-password registration screen.
- Photos you select, photos saved for reuse, selected presets and models, text or generation settings, generated images, request status and generation history.
- AI consent version, scope and choice, together with the information needed to apply and record that choice.
- Purchase, subscription and credit transaction identifiers, products, purchase state and balance records. Apple processes your payment details; we do not receive full card numbers.
- App and device information, usage events, pseudonymous user identifiers, crash reports and performance information processed through Firebase. Notification tokens are processed when notification features are used and permitted.
Photos and generated results can identify people even when an account has no name or email. We do not describe all information as anonymous or claim that no personal information is processed.
3. AI generation and consent
Before photo generation, the app asks for AI consent and describes the photos or other content to be sent. Google Gemini processes submitted images and generation instructions to produce the requested result. Supabase provides authenticated backend functions, database and image storage. We use uploaded content to deliver the selected generation and saved-photo features.
You can withdraw AI consent in Settings to block new upload approvals and AI submissions. Previously approved uploads or requests already sent to Google may finish. Withdrawal alone does not delete saved photos or generation history. Google's use and retention of requests depend on the API service, project settings and applicable terms; this policy does not promise that all provider copies are immediately deleted or that every API configuration excludes model improvement. See Gemini API terms and Google Cloud Privacy Notice.
4. Retention and deletion
New temporary input photos tracked by the current processing flow are scheduled for deletion 24 hours after processing, through periodic cleanup. This does not mean every image is deleted exactly 24 hours after upload. Photos you explicitly save for reuse remain until deleted. Generated results remain in History; older uploads, provider logs and backups may have different retention.
Delete saved photos from their menu. To request deletion of other stored content, history or your pseudonymous account information, contact us through the privacy email. We verify the request against information available in the app; do not send the Keychain secret. Uninstalling alone does not delete server data, purchases or provider copies. Transaction, security and legally required records may be retained separately.
5. Providers and international processing
- Supabase: authentication of device requests, database, generation backend and image storage.
- Google Gemini: AI image processing and generation.
- Google Firebase: Analytics, Crashlytics and messaging. App-defined analytics events describe feature use and outcomes rather than photo pixels or private prompt text.
- RevenueCat: subscription and purchase verification, restoration and purchase-related identifiers.
- Apple: App Store purchases, subscriptions and platform services.
Information is sent over encrypted network connections when the corresponding features are used and may be processed in the United States or other provider operating regions. Retention and backup practices also depend on the provider's terms and configuration.
6. Choices, rights and security
Choose only photos you have permission to use. Camera or photo access is used for content you select; you can revoke permissions in iOS settings. Avoid submitting sensitive documents or unnecessary personal information. You may request access, correction, deletion or other applicable rights by email. We use authenticated service requests, access controls and encrypted transmission; no storage or network system can guarantee absolute security.
A parent or guardian may contact us about a child's information. The presence of a general audience rating does not mean photographs cannot contain personal information.
7. Changes
We update this policy and effective date as processing changes, retain previous versions and provide notice of material changes through the app or this page as applicable.