Privacy Policy
Effective date: 11 October 2026
Hairloom is published by Cretova LLC, a Wyoming limited liability company, 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA ("we", "us"). We are the controller of the personal data described here. This policy covers the Hairloom iPhone app and this website (hairloom.app).
1. What data Hairloom handles
- Your selfie (a photo you take or choose) and the preview images made from it.
- Your choices: the style or colour you pick, and your three onboarding answers: whether styles are for women, men or both, your current hair length, and your hair texture. They are stored on your device. Your hair texture is sent with every preview request, your women/men/both choice is sent with a face-shape request, and your hair length stays on your device.
- Your face shape, if you ask for it: a short result (a shape name, a one-sentence explanation and a few suggested style names) that the app stores on your device until you take a new selfie or delete your photos.
- An anonymous app user ID created by RevenueCat. We use it to apply usage limits and to find your photos when you ask us to delete them.
- Technical data: your IP address, which our hosting provider (Cloudflare) receives with every request. We use it for security and to limit abuse (for example, how many new free previews one network can create per day).
- Purchase information handled by Apple and RevenueCat (see section 5).
2. When photos leave your device
Nothing is uploaded until you tap Agree and continue on the consent screen. After that, each time you create a preview, or ask for your face shape ("What's my face shape?"), the app resizes your selfie and sends it over the internet to Hairloom's server. Previews you save in My Looks, and your selfie, are also kept on your iPhone in Hairloom's own storage.
Hairloom does not save anything to your Photos library unless you tap Save to Photos. The app asks only for permission to add photos, and it cannot read your library.
3. Who processes your photos
- Cloudflare hosts Hairloom's server and the temporary storage for your selfie and previews.
- AI image service. To change the hairstyle or colour, your selfie and the chosen style (and your hair texture) are sent to a third-party AI image service. We currently use Kie.ai, and may use fal.ai as an alternative. The service creates the preview and returns it to us. Kie.ai deletes uploaded images after 24 hours and generated results after 14 days. If we switch provider we will only use one whose retention is no longer than that.
- AI vision service (face shape). When you ask for your face shape, your selfie is sent through Hairloom's server to a third-party AI vision model, reached through the same provider, together with your women/men/both choice. The model describes your face shape in words and suggests styles; we ask it for no scores or ratings. Hairloom's server keeps the answer, with a one-way hash of the selfie (not the photo), for 24 hours so the same photo is not analysed twice.
- We do not use your photos to train models and we do not sell or share them for advertising.
4. How long we keep it
- Your selfie and previews on Hairloom's servers are deleted within 24 hours (a storage expiry rule plus an hourly clean-up job).
- The AI service deletes its copies within 14 days (see section 3).
- For the face-shape check, the selfie itself is not stored on Hairloom's server. The answer and the hash are kept for 24 hours; the answer also stays on your iPhone until you take a new selfie or delete your photos.
- Records that a preview job ran (the style, its status, and a timestamp, linked to your anonymous app user ID) are kept for 24 hours. Usage counters are kept for about a day. A record that your free preview has been used, linked to the anonymous app user ID, is kept so the free preview cannot be repeated. It contains no photos.
- On your iPhone, your selfie and looks stay until you delete them. Use Settings > Delete my photos to remove them from the iPhone and ask our servers to delete your photos, previews and preview records right away; usage counters (see above) are kept. Deleting the app also removes them from the device. Device backups made by iOS may contain them; those are controlled by you and Apple.
5. Purchases and RevenueCat
Subscriptions are sold by Apple. We use RevenueCat, a service provider, to check and manage your subscription status. RevenueCat receives an anonymous app user ID and your purchase receipt information from Apple. It does not receive your photos. We use this to unlock Hairloom Pro, restore purchases and keep subscription records. We never see your payment card details; Apple handles payment. RevenueCat's own practices are described in its privacy policy.
6. No tracking
- No account or sign-in.
- No analytics or crash-reporting SDKs and no advertising SDKs.
- No selling your data, and no sharing it for cross-context behavioral advertising.
- No tracking across other companies' apps or websites.
This website does not use cookies or analytics. Our hosting provider may keep standard server logs (such as IP address and time of request) for security and operation.
7. Permissions you can grant
| Permission | What it does |
|---|---|
| Camera | Only to take a selfie for hairstyle previews when you tap Take a selfie. |
| Photo picker | Lets you choose a selfie from your library. iOS shows only the photo you pick. |
| Add to Photos | Only to save a preview when you tap Save to Photos. Hairloom cannot read your library. |
8. Security
Photos travel between the app and our server over HTTPS. On your iPhone, Hairloom's data is protected by the iOS app sandbox and your device's own protections (passcode and iOS data protection). Hairloom does not add its own encryption layer to the files it stores on your device. No system is perfectly secure, so keep your device updated and locked.
9. Children
Hairloom is not directed to children under 13 and we do not knowingly collect their data. If you believe a child under 13 has used Hairloom, contact us at support@hairloom.app and we will delete the data.
10. Your rights (EEA, UK, Switzerland)
Under the GDPR and UK GDPR you have the right to access, correct, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time. You may also complain to your local data protection authority.
- Photos: you can erase them yourself at any time with Settings > Delete my photos.
- Withdrawing consent: in the app, open Settings > Withdraw AI consent and confirm. This stops all AI photo processing: it does everything Delete my photos does (your looks and selfie on the iPhone, and your photos and previews on our servers), clears the saved face-shape result, forgets your consent and returns you to the consent screen. Nothing is uploaded again unless you agree again. The AI service still deletes its own copies on its schedule (within 14 days). Withdrawing does not cancel a subscription: Apple manages those (see Support).
- Other requests: email support@hairloom.app. We hold only an anonymous app user ID, not your name or email, so we may be unable to find records for a request. Settings > Delete my photos works without it.
Our legal bases: your consent (uploading your photo to create previews), performing our contract with you (providing the app and subscription), and our legitimate interests and legal obligations (security, abuse prevention, subscription records, accounting).
11. Your rights (California and other US states)
If you live in California (CCPA/CPRA) or another US state with a privacy law, you may have the right to know, access, correct and delete personal information, to opt out of sale or sharing, and to limit use of sensitive information. You will not be treated differently for using these rights.
- Categories we receive: photos you choose to upload (which may show your face), identifiers (anonymous app user ID, IP address), and commercial information (purchase and subscription records) through Apple and RevenueCat.
- We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months.
To make a request, email support@hairloom.app. We may need to verify your identity. An authorized agent may submit a request for you.
12. International users
We are based in the United States. Photos are processed by Cloudflare and the AI service, which may handle data in the United States or other countries. Where the law requires, those transfers rely on approved safeguards.
13. Changes to this policy
We may update this policy. We will post the new version here with a new effective date, and for material changes (including changes to how photos are handled) we will ask for your consent again in the app.
14. Contact
Cretova LLC
1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA
Privacy and general support: support@hairloom.app