Privacy Policy
This policy describes how Persona (“Persona”, “we”) collects, uses, stores, and shares information when you use our mobile app.
1. Face data (photos that may depict faces)
1.1 What we collect. When you use AI generation features, you choose and upload photos from your device. Those photos may depict faces — your own or of people you are authorized to photograph. In some modes you may also add optional reference images (for example for style). We also collect any text prompts and style instructions you enter together with the photo. We do not build a face template, biometric identifier, faceprint, or face recognition database. We do not match the photo against any face database.
1.2 Why we process face data. The photo is processed for the single purpose of generating the AI image you requested in the app, and to enforce limits and abuse prevention (for example, blocking disallowed content). We do not use your photos for advertising, profiling, or to train public AI models.
1.3 How long we store face data, and why.
- On our servers (Google Firebase / Cloud Functions, region: United States). The original photo and prompt are stored only for the duration needed to produce the generation result and return it to your device. In practice this means transient processing measured in seconds to minutes, and in any case no longer than 24 hours from upload. After that the original photo is deleted from our backend.
- Operational logs. We keep minimal technical logs (request identifiers, error codes, timestamps) for up to 30 days, used to troubleshoot failures and prevent abuse. These logs do not contain the photo itself.
- Generated result. The generated image is delivered to your device and saved locally in your in-app Studio gallery. It is removed from our backend together with the original photo (within the 24-hour window above). You can delete the generated image at any time from inside the app or by uninstalling it.
- Why these limits. We do not store face data indefinitely. The retention periods above are the shortest practical durations that still let us deliver the generation, recover from transient failures, and meet legal/abuse-prevention obligations.
1.4 Third parties we share face data with. To deliver the feature, the photo and prompt are sent from our backend to the following service providers, and only to these:
- Google LLC — Firebase / Cloud Functions / related Google Cloud services that host our backend. Google acts as our infrastructure processor. Google's privacy practices: policies.google.com/privacy; Firebase-specific data handling: firebase.google.com/support/privacy.
- Replicate, Inc. (United States) — runs the AI model that produces the image. Replicate acts as our AI inference processor. Replicate's privacy policy: replicate.com/privacy; terms: replicate.com/terms.
We do not share face data with advertising networks, data brokers, or any other third parties beyond the two providers listed above.
1.5 Whether the third parties store face data, and on what terms.
- Google (Firebase / Cloud Functions). Photos pass through Google Cloud servers (United States) while our backend handles the request. Google processes this data on our behalf, under the Google Cloud / Firebase Data Processing and Security Terms, and does not use it to advertise to you or to train Google's general AI models. Any persisted copies in Google Cloud Storage that we create are deleted by our backend in the same retention window described in section 1.3 (no longer than 24 hours). See cloud.google.com/terms/data-processing-addendum.
- Replicate, Inc. Photos are sent to Replicate solely to run the model inference. Per Replicate's privacy policy and API terms, Replicate processes inputs to return predictions and may retain inputs and outputs for a limited operational period to provide and improve the service, debug failures, and detect abuse, after which they are deleted. Replicate does not sell the data and does not use it to train public AI models without consent. Full details: replicate.com/privacy.
Each provider is contractually bound to provide a level of data protection equal to or higher than the protections described in this policy, and to use the data only to deliver the services we configure.
1.6 Your control over face data. You can cancel the upload at any time before tapping Send to AI in the in-app consent dialog. You can request deletion of any face data we still hold by contacting us at netkaktakto@gmail.com; we will action the request within 30 days and confirm in writing.
Quoted summary for App Review (face data). “Persona processes photos you choose to upload, which may include faces, only to generate the AI image you requested. Originals are deleted from our backend within 24 hours; operational logs (no photos) are kept up to 30 days. The data is shared only with Google (Firebase / Cloud Functions) and Replicate, Inc., who act as our processors under contractual data-protection terms. Their retention is limited to delivering the inference and limited operational/abuse-prevention purposes per their privacy policies (Google: policies.google.com/privacy; Replicate: replicate.com/privacy). We do not build a faceprint, do not match against any face database, and do not use your photos to train public AI models.”
2. Data we process
- Photos you upload or provide for generation (may include face imagery).
- Text prompts and style instructions.
- Subscription and purchase metadata via Apple App Store and Adapty (no photos).
- Basic technical and diagnostic information (Firebase Analytics, Crashlytics) for reliability and abuse prevention.
3. Why we process data
We process your data to generate images, manage subscriptions, improve app performance, prevent abuse, comply with law where applicable, and provide support. We do not sell your personal data.
4. Third-party processors
We use a small, fixed set of service providers to deliver core functionality. Photos, prompts, and generation requests are shared only with:
- Google LLC — Firebase, Cloud Functions, Analytics, Crashlytics, and related Google Cloud services (United States region). Privacy policy: policies.google.com/privacy; Firebase data handling: firebase.google.com/support/privacy.
- Replicate, Inc. (United States) — runs the AI model that produces the image. Privacy policy: replicate.com/privacy; terms: replicate.com/terms.
- Adapty, Inc. — used only for in-app subscription billing state and analytics events tied to purchases (iOS). Adapty does not receive any photo, face image, or prompt. Privacy: adapty.io/privacy.
These providers process information only to deliver the services we configure and are bound by their own privacy and security commitments, summarized in Section 1.5. Before a photo or prompt is sent to the AI service, the Persona app shows an in-app consent dialog explaining what is sent and to whom, and requires your explicit confirmation (Send to AI).
5. Retention and security
We retain personal data only for the time needed to provide the feature and to meet security and legal obligations. The concrete retention windows for face data are set out in Section 1.3; in short:
- Original uploaded photos: deleted from our backend within 24 hours of upload (typically within seconds to minutes after the generation completes).
- Operational logs without photos: up to 30 days.
- Generated results: stored on your device in the Studio gallery until you delete them or uninstall the app.
We use industry-standard technical and organizational safeguards, including transport encryption (HTTPS/TLS) between the device, our backend, and our processors.
6. Local storage
Generated results and app preferences may be stored locally on your device to improve speed and keep your Studio content available between sessions.
7. Your rights
Depending on your location, you may have rights to request access, correction, or deletion of personal data. Contact us to submit a request.
8. Contact
Privacy requests: netkaktakto@gmail.com