Privacy Policy
1. Scope
This Privacy Policy explains how Tressight (the “App,” “we,” “us,” or “our”) collects, uses, stores, shares, and deletes personal information, and how you may exercise your privacy rights. It applies to the Tressight iOS app and the account, cloud storage, AI processing, and subscription services used by the App.
Tressight provides AI-powered hairstyle analysis and image generation. Before a feature uploads a photo, the App separately explains the cloud processing and third-party AI sharing and asks for your explicit permission. You may decline, but features that require cloud photo processing will not be available.
2. Information We Collect
| Data | How Collected | Purpose |
|---|---|---|
| Photos you select | Camera or the system photo picker | Photo-quality checks, hairstyle analysis, try-on image generation, consistency checks, and history |
| Account information | Sign in with Apple or Google Sign-In | Account creation and authentication; may include your name, email address, and provider user identifier |
| In-app content | Created when you use the App | Analysis reports, generated images, history, favorites, and generation settings |
| Purchase and entitlement data | Apple App Store and RevenueCat | Purchases, purchase restoration, subscription status, and feature access |
| Usage and diagnostic data | Generated while using the App or when an error occurs | Security, troubleshooting, and service operation; may include app version, device and operating-system type, error codes, request identifiers, and feature interaction events |
| Communications | Information you provide by email | Customer support, complaints, and privacy requests |
We do not automatically upload your photo library. We process only photos you actively select. Before upload, the App compresses and normalizes the photo and removes EXIF, GPS, and device metadata.
3. Device Permissions
- Camera: Take a photo for hairstyle analysis and image generation.
- Photo Library: Select specific photos through the system photo picker. We do not browse or upload unselected photos.
- Add to Photo Library: Save a generated image only when you ask the App to do so.
You can revoke permissions in iOS Settings. Features that depend on a revoked permission may stop working.
4. Photos, Facial Information, and AI Processing
We process visible face shape, hair texture, hair density, hairline, hair color, and styling characteristics to provide hairstyle suggestions and reference images.
- We do not use photos for identity verification, face matching, or facial recognition.
- We do not create biometric templates used to uniquely identify a person.
- We do not infer or build profiles about age, gender, ethnicity, health status, or other demographic characteristics from photos.
- Results are for entertainment, styling inspiration, and personal reference. They are not medical, cosmetic-medical, or other professional advice.
Photos and necessary generation instructions are transmitted from your device to our Supabase backend and then to APIMart, an AI API gateway, which uses OpenAI models to perform analysis or image generation. APIMart and underlying model providers may temporarily process or retain inputs and outputs to fulfill requests, prevent abuse, and maintain security.
APIMart's currently published terms state that it does not use API inputs or outputs to train AI models and processes or temporarily stores them only as needed to provide its service. OpenAI's currently published API data policy states that API data is not used for model training by default, but certain content may be retained in abuse-monitoring logs for up to 30 days, or longer where required for legal or security reasons. Provider policies may change; the current provider policies control their processing.
5. How We Use Information
We use personal information only to:
- Provide photo analysis, reports, image generation, history, and favorites;
- Create accounts, maintain sessions, and protect account security;
- Verify purchases, subscriptions, and entitlements;
- Troubleshoot errors and prevent fraud, abuse, and unauthorized access;
- Improve reliability using limited technical events that do not contain photos, report text, names, or email addresses;
- Comply with law and respond to user requests.
We do not sell personal information, use photos or analysis results for third-party advertising, or track you across apps or websites.
6. Service Providers and Sharing
We share information only as necessary with the following recipients:
| Recipient | Purpose | Data That May Be Processed |
|---|---|---|
| Supabase | Authentication, database, private object storage, and Edge Functions; our project is hosted in East US | Account identifiers, photos, reports, generated images, favorites, and job status |
| APIMart | AI API gateway using underlying OpenAI models | Selected photos, generation instructions, necessary parameters, and generated results |
| OpenAI | Underlying AI model processing | Photos, instructions, and outputs relayed by APIMart according to the selected model and channel |
| RevenueCat | Subscription and entitlement verification | App user identifier, purchase records, and entitlement status |
| Apple | Sign in with Apple, App Store purchases, and refunds | Authentication authorization, purchase, and subscription data |
| Google Sign-In | Account identifier, name, email address, and avatar, where authorized |
Providers may process information only as necessary to provide their service, maintain security, or comply with law. We require protection consistent with this Policy and applicable law.
We may also disclose information when required by law or valid legal process, or when reasonably necessary to protect the rights and safety of users, the operator, or the public. If the service or its assets are transferred, the recipient must continue to follow this Policy or provide equivalent protection.
7. International Transfers
The Supabase project and primary cloud data are located in East US. APIMart, OpenAI, RevenueCat, Apple, and Google may process information in the United States, Hong Kong, or other locations where they operate. Your information may therefore be transferred outside your place of residence.
We use HTTPS/TLS, private storage, authentication, access controls, and service-provider agreements to protect transfers. Where applicable law requires additional safeguards, we will use appropriate contractual or other lawful transfer mechanisms.
8. Retention
| Data | Retention Period or Criteria |
|---|---|
| Account information | For the life of the account; deleted after successful account deletion unless retention is legally required |
| Uploaded photos, reports, and generated images | No automatic expiration. Retained while your account remains active and until you request deletion of the relevant cloud data, so the App can provide history and repeat-generation features |
| On-device history, photo files, and generated-image cache | Until you delete the relevant local record, clear local data, uninstall the App, or delete your account |
| AI provider temporary copies and logs | For the period needed to fulfill requests, maintain security, and prevent abuse; OpenAI's default abuse-monitoring period is generally up to 30 days, subject to legal and security exceptions |
| Usage and diagnostic records | For the period needed for troubleshooting, security, and service maintenance, then deleted or de-identified |
| Purchase and compliance records | As required by Apple, payment providers, and applicable tax, accounting, and consumer-protection laws |
Uninstalling the App does not delete your account or cloud photos, reports, and generated images.
9. Deletion and Withdrawal of Permission
- Deleting an individual history item or clearing local data removes records and caches from the current device only. It does not delete the related cloud photo or generated result.
- You may permanently delete your account through “Profile → Privacy → Delete Account.” After a successful request, account information, cloud photos, reports, generated images, and favorites associated with the account will be deleted unless retention is legally required.
- You may email pytonsuper@gmail.com to request deletion of specific cloud content or exercise another privacy right. We may reasonably verify your identity.
- Account deletion does not cancel an Apple auto-renewable subscription. Cancel separately in iOS Settings or through Apple's subscription management page.
- You may stop using photo-processing features or revoke system permissions to withdraw permission for future processing. Withdrawal does not affect processing lawfully completed before withdrawal.
When in-app deletion reports success, we delete then-accessible account data. Third-party security logs, legally retained records, and isolated backups may remain for their established retention periods, are not used for ordinary business, and are deleted or anonymized when those periods expire.
10. Your Privacy Rights
Depending on applicable law, you may request access to, correction or deletion of, or a copy of your personal information; withdraw consent; or object to or restrict certain processing. Submit requests to pytonsuper@gmail.com. We will respond within the period required by applicable law and will not discriminate against you for exercising a privacy right.
Residents of certain U.S. states may also have rights to:
- Know the categories, sources, purposes, and recipients of personal information we collect, use, and disclose;
- Delete or correct personal information;
- Obtain a portable copy;
- Opt out of sale, sharing for cross-context behavioral advertising, or certain profiling; and
- Appeal a denial of a privacy request.
We currently do not sell personal information or share it for cross-context behavioral advertising. To appeal a decision, email us with the subject “Privacy Appeal.”
11. Children
The service is not directed to children under 13, and we do not knowingly collect their personal information. Users below the age of legal majority where they live should use the service only with consent and supervision from a parent or legal guardian. Contact us if you believe a child submitted information without appropriate consent; we will investigate and delete it.
12. Security
We use HTTPS/TLS, private storage buckets, account authentication, database row-level access controls, and least-privilege access. Photos are not made publicly searchable or displayed publicly. No transmission or storage method is completely secure. We will handle legally reportable security incidents as required by applicable law.
When you save or share an image through the system share sheet, you choose the recipient and any subsequent processing is controlled by you and the recipient. The App does not record whom you share with.
13. Legal Pages and Third-Party Links
The App may display this Policy, the Terms, or third-party pages in a web view. Third-party pages may use cookies or similar technologies under their own policies. The App does not use legal pages for advertising tracking.
14. Changes
We may update this Policy. For material changes, we will provide notice in the App, update the date above, or use another reasonable method. Where renewed consent is legally required, the new processing will not begin before consent is obtained.
15. Contact
- Operator and Data Controller: FANG PENG, an individual developer
- Email: pytonsuper@gmail.com
- Product: Tressight
Contact us at the email above with questions about this Policy, our data practices, or a privacy request.