Privacy Policy

Privacy Policy for Hairfie

Effective Date: October 12, 2026

Hairfie ("we," "our," or "us") is operated by an individual developer based in New Zealand, reachable at [email protected]. This Privacy Policy explains how we collect, use, process, store, and protect information when you use the Hairfie mobile application and related services.

Information We Collect

User Photos and Facial Data

Hairfie lets you select a photo that may contain a face so that the app can apply a chosen hairstyle and generate a preview image.

When you choose a photo and request a hairstyle preview, the photo is transmitted over an encrypted connection to our servers in the United States, where our self-developed AI model temporarily processes facial features — including face position, facial contours, and orientation — solely to align the selected hairstyle with the face in the photo and produce the preview.

We use this facial processing only for the purpose of generating the hairstyle preview you requested. In particular:

• We do not perform facial recognition
• We do not identify or verify your identity
• We do not retain or persistently store biometric identifiers or facial geometry templates — facial features are computed in transient memory only to align the hairstyle, and are not written to persistent storage
• We do not build facial profiles
• We do not maintain a database of facial data
• We do not use your photo or any derived facial data for advertising, analytics, profiling, tracking, or machine-learning model training

The original photo and any facial features derived from it are held in transient server memory only and are deleted immediately after the preview is generated. They are not written to persistent server storage.

You should only upload photos of yourself or photos for which you have the depicted person's consent. The same facial processing and deletion protections described here apply regardless of who appears in the photo.

By choosing to upload a photo and request a hairstyle preview, you are instructing us to carry out this facial processing on your behalf in order to deliver that feature.

Generated Previews ("My hairstyle")

The preview image that Hairfie generates from your photo — which may contain your face — is saved to your personal "My hairstyle" library so that you can review, download, share, or delete it later. Previews in your library are stored on our servers in the United States and are associated with your account.

You can delete any individual preview at any time from within the app. When you delete your account, all of your previews are permanently deleted within 30 days. We do not use your saved previews for model training, advertising, analytics, or any purpose other than providing your library to you.

Authentication

Hairfie supports two sign-in methods: Sign in with Apple and Sign in with Google. When you choose a provider and sign in, that provider gives us a stable, app-specific user identifier and, at your option, your name and email address (with Apple, this may be a private email relay address). We use these only to create and maintain your account and to keep your "My hairstyle" library associated with you across devices and reinstalls. We never receive or store your Apple or Google account password.

Each provider processes sign-in data as an independent data controller, under its own privacy policy:

• Apple — apple.com/legal/privacy
• Google — policies.google.com/privacy

We are not responsible for the provider's own handling of your account information.

Usage and Diagnostic Data

We may collect limited, non-identifiable information such as app interactions, device type, operating system version, and crash logs to improve app performance and reliability. This first-party diagnostic data is collected by the app itself and is not shared with any advertising or crash-reporting service. It does not include photos or the contents of your "My hairstyle" library. Separately, the App uses Adjust for install attribution and aggregated analytics, as described in the next section.

Attribution and Analytics (Adjust)

We integrate Adjust, a mobile measurement and analytics service operated by Adjust GmbH (Germany), to understand which installation source or marketing campaign led you to the App, to prepare aggregated install and usage statistics, and to detect and prevent install fraud. Adjust is not used to display advertising inside the App, and we do not use it to build advertising profiles about you or to track you across other companies' apps and websites for advertising purposes.

Depending on your device settings and permissions, the Adjust SDK may process the following information:

• Device identifiers, including the Apple identifier for vendors (IDFV), and the advertising identifier (IDFA) only if you grant permission through Apple's App Tracking Transparency prompt
• Technical device information, such as device model, operating system version, and language settings
• Your IP address, used for coarse install attribution and fraud prevention (and truncated or geo-obfuscated where supported)
• App lifecycle and in-app events, such as installation, first launch, app sessions, and purchase confirmations

Event information sent to Adjust describes that an event occurred — it never includes your photos, the contents of your "My hairstyle" library, messages, or sign-in credentials.

Adjust processes this data as our service provider (data processor) under a data processing agreement, and may not use it for purposes other than providing attribution, aggregated reporting, and fraud prevention on our behalf. Adjust may process data on servers in the European Union, the United States, and other regions in which it operates.

You can prevent IDFA access by declining the App Tracking Transparency prompt, and you can turn off "Allow Apps to Request to Track" or reset your advertising identifier at any time in your iOS privacy settings. You can also use Adjust's device opt-out mechanism described in its privacy policy at adjust.com.

In-App Purchases

Hairfie offers in-app purchases processed through Apple's App Store. We do not collect or store your payment card details. Apple handles all payment information as an independent data controller; we only receive transaction receipts (such as product identifier, purchase status, and credited balance) necessary to deliver the credits you purchased.

How We Use Your Information

We use collected information only to provide and operate the core functionality of the app:

• Photos and any transient facial data are used only to generate the hairstyle previews you request
• Saved previews are used only to populate your personal "My hairstyle" library
• Sign-in identifiers from Apple and Google are used only to authenticate you and associate your library with your account
• Usage and diagnostic data is used to maintain, improve, and optimize app performance
• Attribution and analytics data collected through Adjust is used only to measure install sources and marketing performance, prepare aggregated statistics, and prevent install fraud — not to serve advertising inside the App
• In-app purchase receipts are used only to credit your account and confirm entitlement

We do not sell or rent your personal data. We do not use photos, facial data, or saved previews for advertising, marketing, analytics, profiling, tracking, or machine-learning model training, and these are never shared with Adjust or any other analytics or advertising provider.

AI Processing (Self-Hosted Model)

Hairfie uses a self-developed AI model to generate hairstyle previews. The model runs on servers located in the United States. We do not rely on any third-party AI service providers to process your photos.

When you request a preview:

• Your selected photo is transmitted over HTTPS to our US servers
• Our model processes the image in transient memory solely to produce the preview you requested
• The original photo and any facial features derived from it are deleted from server memory immediately after the preview is generated
• The resulting preview is saved to your "My hairstyle" library on our US servers until you delete it or your account is deleted
• We do not use your photos, facial data, or saved previews to train, fine-tune, or otherwise improve our model or any other model

Third-Party Services

The App does not integrate any third-party advertising SDK, and no third party displays advertising inside the App. The third-party services the App uses are:

• Sign in with Apple (Apple Inc.) — to authenticate you. Apple acts as an independent data controller under its own privacy policy (apple.com/legal/privacy).
• Sign in with Google (Google LLC) — to authenticate you. Google acts as an independent data controller under its own privacy policy (policies.google.com/privacy).
• Apple In-App Purchase (Apple Inc.) — to process payments and deliver credits. Apple acts as an independent data controller.
• Adjust (Adjust GmbH) — to attribute installs, prepare aggregated usage and marketing statistics, and prevent install fraud. Adjust acts strictly as our service provider (data processor) and is not used to serve advertising in the App; it does not receive your photos or the contents of your "My hairstyle" library.

We do not share your photos, facial data, or saved previews with any third party for their own purposes.

Data Storage and Retention

We do not sell or rent user data.

Your Privacy Rights (General)

You retain ownership of your photos and generated previews.

Regardless of where you live, you can:

• Delete individual saved previews at any time from the "My hairstyle" screen
• Delete your account directly from the in-app Delete Account button in Settings. This is the fastest and preferred method. When you delete your account, all server-side previews and account identifiers are permanently deleted within 30 days. You can also email us at [email protected] if you need help.
• Stop all future data collection by deleting the app. This prevents further uploads from that device; data already stored on our servers (such as your account and saved previews) is retained according to the retention periods in this policy unless you also delete your account. Any photos remaining on your device can be removed through your device settings.

If you have questions or requests regarding your data, you may contact us using the information at the end of this policy. We will respond within a reasonable timeframe and as required by applicable law.

Privacy Rights for California and US Residents

California (CCPA/CPRA)

If you are a California resident, you have the following rights regarding your personal information:

• Right to know what personal information we collect, use, and disclose
• Right to delete personal information we hold about you, subject to certain exceptions
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing of personal information
• Right to limit use of sensitive personal information
• Right not to receive discriminatory treatment for exercising your privacy rights

We do not "sell" personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. The third parties listed in this policy handle data either as independent controllers for their own sign-in or payment services (Apple, Google) or as service providers/processors acting only on our instructions (Adjust), and we do not use or disclose sensitive personal information other than for purposes necessary to provide the service. You can prevent advertising-identifier (IDFA) processing at any time through your iOS tracking settings.

To exercise any of the rights above, use the in-app Delete Account button in Settings for deletion requests, or email us at [email protected] for all other requests. We will verify your request using your signed-in account session or the email address associated with your account.

Illinois (BIPA)

Illinois' Biometric Information Privacy Act regulates the collection, use, storage, and destruction of biometric identifiers and biometric information, including scans of face geometry.

Hairfie processes facial features only to align a hairstyle with the face in your photo and generate a preview. We do not perform facial recognition, do not identify users, and do not retain or persistently store biometric identifiers or facial geometry templates — any facial geometry is computed in transient server memory solely to produce the preview and is not written to persistent storage. The original photo and any derived facial features are deleted from server memory immediately after the preview is generated. Generated preview images are retained in your "My hairstyle" library until you delete them or your account is deleted, after which they are permanently deleted within 30 days. We do not sell, lease, trade, or otherwise profit from facial data.

If you are an Illinois resident and believe your biometric information has been handled in a way that violates BIPA, you may contact us at the address below.

Texas and Washington State

Residents of Texas (Capture or Use of Biometric Identifier Act) and Washington (RCW 19.375) have additional rights regarding biometric identifiers. We process facial features only for the limited purpose described in this policy, do not retain them beyond processing, and do not sell them. Questions or requests may be directed to the contact address below.

Privacy Rights for EEA, UK, and Swiss Users (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following applies.

Lawful Basis

We process your photo and transient facial features only to perform the hairstyle preview service you request, on the basis of Article 6(1)(b) GDPR (performance of a contract) and, where applicable, Article 6(1)(a) GDPR (consent). We rely on Article 6(1)(f) (legitimate interests) for limited usage and diagnostic data used to keep the app reliable and secure, and for aggregated install attribution and fraud prevention via Adjust. Where device identifiers (such as advertising identifiers) are accessed through Adjust in the EEA, UK, or Switzerland, such access is based on your consent given through the applicable permission or consent prompt, which you may withdraw at any time in your device settings.

We take the position that the facial processing Hairfie performs does not constitute "biometric data for the purpose of uniquely identifying a natural person" under Article 9(1) GDPR, because the app does not identify, authenticate, or otherwise uniquely single out any individual — it only aligns a hairstyle with a face in a photo. Even so, we apply the transparency, retention, and security protections described throughout this policy, and you may exercise all of the rights below.

Your GDPR Rights

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Erase your personal information where there is no compelling reason for continued processing
• Restrict or object to processing of your personal information
• Data portability where processing is based on consent or contract
• Withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal
• Lodge a complaint with your local data protection authority

To exercise any of these rights, use the in-app Delete Account button in Settings for deletion requests, or email us at [email protected] for all other requests. Because photos and transient facial data are not retained after a preview is generated, most data subject requests concern your account identifier and saved previews, which you can delete directly in the app.

International Transfers

Our servers are located in the United States. When you use Hairfie from the EEA, UK, or Switzerland, your information (including your photo during transient processing and your saved previews) is transferred to the United States. Attribution and analytics data processed by Adjust may be handled in the European Union, the United States, and other regions in which Adjust operates. We take reasonable steps to ensure that your information receives an adequate level of protection in accordance with applicable data protection law, including contractual and technical safeguards (such as standard contractual clauses where appropriate). You may contact us for more information about these safeguards.

New Zealand Privacy Rights

If you are a New Zealand resident, you have rights under the Privacy Act 2020 to access and correct personal information we hold about you. You may exercise these rights by contacting us at the address below.

Security

We implement reasonable technical and organizational measures to protect data during transmission and processing. All photos, generated previews, and authentication data are transmitted over encrypted connections (HTTPS/TLS), and saved previews are associated only with your account. However, no system is completely secure, and we cannot guarantee absolute security.

Children's Privacy

Hairfie is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are under 13, please do not use the app or provide any information to us. If we learn that we have collected information from a child under 13, we will delete it as soon as possible.

If you are in the European Economic Area, the United Kingdom, or Switzerland, Hairfie is not intended for users under the age of 16 in line with GDPR. We do not knowingly collect personal data from children under 16 in these regions. If you believe a child under 16 has provided us with personal data, please contact us so we can delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted in the app and on this page with an updated effective date. If changes are material, we will provide a more prominent notice (such as an in-app banner) before the changes take effect.

Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Email: [email protected]