DecadeShot — Privacy Policy

30 fields below are still to be filled in before publication (shown in amber).

Last updated: ⬜ [publication date]

Effective: ⬜ [publication date]

1. Who we are

DecadeShot is an app and website that turns a photo you choose into a stylised portrait in the look of a past decade.

The service is operated by ⬜ [legal entity name], ⬜ [registered address]. You can reach us at ⬜ [support email — must be a real, monitored mailbox].

⬜ If the entity has an EU or UK establishment, or targets the EU/UK, name an Article 27 representative here.

This policy covers the DecadeShot Android app, the DecadeShot iOS app and the website at decadeshot.com. It does not cover anything you do after you leave us — for example, a photo you save to your phone and then post somewhere else.

2. The short version

• There is no account. We never ask for your name, email address, phone number or date of birth.
• The photo you upload is never stored on our servers. It exists in memory for the seconds it takes to make your picture, is sent to one AI image provider to do that, and is then gone.
• The pictures we make for you are deleted automatically 24 hours after they are made.
• We do not compute or store face embeddings, face templates or any other biometric identifier.
• We never use your photo, your prompt or your results to train any model, and we never show them to another user.
• We do not sell your data, and we do not use it for advertising. There are no ads and no ad network in the app.
• You must be 18 or over to use DecadeShot.

Everything below is the long version of those seven lines.

3. What we collect, and why

We group this the way the app actually works, not the way a template would.

3.1 A random device identifier

When you first open the app or the website, your device generates a random identifier (a UUID). It is not derived from any hardware identifier, it is not your advertising ID, and it does not identify you as a person. We use it for one thing: to know how many credits this installation has, and which generations belong to it.

Where it is stored, and how long it lasts, differs by platform, and we set this out precisely because it affects you:

The identifier is sent with each request to our API, and it is the user identifier we give to analytics and to our purchase processor. It is pseudonymous: on its own it tells us nothing about who you are.

3.2 An installation fingerprint, used only to stop abuse of the free photo

DecadeShot gives one free credit on first launch. To stop the same installation from collecting that free photo over and over, the app may send an install identifier: a salted SHA-256 hash (lowercase hex) of an identifier that survives a reinstall — ANDROID_ID on Android, a value derived from the Keychain identifier on iOS. The underlying identifier itself never leaves your device, and the server rejects anything that is not a 64-character hash. The website sends nothing, because browsers have no stable equivalent.

In the same narrow case we record a hashed, truncated form of your IP address: we first reduce it to its network (the /24 for IPv4, the /64 for IPv6) and then store a salted SHA-256 hash of that network. We never write your raw IP address anywhere. The salt is 32 random bytes generated once and kept alongside the data, so the hash cannot be reversed by trying every possible address.

Both of these apply only to the free credit. They can never block a paid generation, a purchase, a promo code or any other function. If a limit is reached, the only consequence is that the installation starts at zero credits instead of one.

3.3 The photo you upload

This is the part that matters most, so it is the most specific.

1. The app resizes your photo on your device before anything is sent.
2. It is uploaded to our API over HTTPS as part of a single generation request.
3. Our server may crop it to the aspect ratio of the style you picked. This happens in memory.
4. It is sent to one third-party AI image provider (§5) together with the text prompt for the style you chose, for the duration of that one request.
5. When the job finishes, it is gone.

The photo is never written to a database, an object store, a log or a backup of ours. There is no column for it in our database and no bucket it is copied to. It is not queued, not cached and not retained for quality review.

We do not run face detection, face recognition, face matching or face clustering on it. We do not compute, store or compare face embeddings, face templates or any other biometric identifier. We do not estimate your age, gender, ethnicity or emotion from it. (The app has a "gender" chip; that is a styling choice you make, not something we infer from your face.)

We never use your photo to train, fine-tune, evaluate or improve any model, and we never use it to promote the app.

⬜ Owner note, for accuracy: one analytics field in the taxonomy — photo_selected.face_area — was designed to report a five-value coarse bucket (unknown / none / tiny / small / good / large) describing how much of the frame the face fills. On Android it is hard-coded to unknown because on-device face detection was removed, and no box, landmark, crop, count, confidence or image ever leaves the device. If that field is ever made live on any client, this section must say so.

3.4 Your generated pictures

The pictures we make are stored on our servers (on our own disk or in a private Cloudflare R2 bucket, served only through short-lived signed links) so that you can come back to them in the app.

They are deleted automatically 24 hours after they are made. A background sweeper runs every ten minutes and removes every expired image; the object store additionally carries its own one-day lifecycle rule as a second line of defence. After that, the link to a picture stops working — including a share link. If you want to keep a picture, save it to your device.

3.5 Share links

If you create a share link, anyone who has that link can open the picture until it expires with the picture at 24 hours. A share link is an unguessable token; we do not publish or index them, but a link is not a password — treat it as public.

3.6 Purchases

Credits and the Pro subscription are sold by Google Play or Apple (in the apps) and by Paddle (on the website). We never see your card number, bank details or billing address.

To know that a purchase happened and to grant the credits, we use RevenueCat as our receipt validator. RevenueCat receives the store transaction and your random device identifier, and nothing else. We store, in our own database, the store transaction ID, the product purchased, the platform and the amount — so that credits are granted exactly once and so that a refund can be reversed. That transaction ID is also what lets your credits move to a new phone when you tap Restore purchases.

3.7 Usage analytics and crash reports

Where they are enabled in a build, we use Google Firebase Analytics and Firebase Crashlytics in the apps, and Google Analytics 4 on the website, together with our own event log on our own server.

We record things like: the app was opened, a style was viewed, a generation was started, a generation succeeded or failed, a result was saved or shared, a paywall was shown, a purchase started, a legal document was opened, a crash occurred. These are recorded against the same random device identifier described in §3.1.

Your photo, your prompt and your generated pictures are never sent to analytics. Neither is any name, email address or contact detail, because we do not have any.

On Android, collection of the Android Advertising ID is switched off. On iOS, the app does not link the advertising frameworks at all, does not ask for the IDFA, and therefore shows no App Tracking Transparency prompt. We do not track you across other companies' apps or websites.

3.8 Support messages

If you email support, we receive your message, your email address and the device identifier the app adds to the message (so we can find your credits). We keep it only for as long as it takes to answer you and to keep a record of the resolution.

3.9 What we do not collect

No name, email address, phone number, postal address or date of birth. No contacts, calendar, location, files, messages or health data. No camera access — the app has no camera permission at all and reaches your photos only through the system photo picker, which shows us only the one picture you pick. No biometric data. No advertising identifier. No account, so no password.

4. Consent and age

DecadeShot is for people aged 18 and over. Before your first generation, you confirm that you are 18 or older and that the photo is of you or that you have the permission of the person in it.

We record the version of that confirmation and the time you gave it, against your device identifier, and we record which version authorised each generation. If the terms change materially, we ask you to confirm again. We do this because a record that a confirmation was given is the only way the confirmation means anything.

We do not knowingly process a photo of anyone under 18. If you believe a photo of a minor has been uploaded, contact us at ⬜ [support email] and we will act on it.

5. Who else sees your data

We share only what each recipient needs to do its job.

5.1 AI image providers

Your photo and the style prompt are sent to one third-party AI image provider per generation, for the duration of that request. We send no device identifier, no install identifier, no name and no purchase information with it — the provider receives an image and a text prompt and nothing that identifies you.

We route through more than one provider so that a single outage does not lose your credit. The providers currently in use are:

These are gateways to large image models. ⬜ Owner decision: whether to name them individually (as above) or describe them generically as "third-party AI image providers". Naming them is more honest and is what a regulator would prefer; it also means this list must be updated whenever the provider chain changes.

⬜ Owner action, and it is a real gap: we do not currently hold written retention or non-training commitments from these providers. Before publication, either obtain them, or change the wording above to say plainly what we can and cannot promise about what a provider does with an image after it has answered. Do not publish a promise we cannot keep on somebody else's infrastructure.

5.2 Everyone else

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

We may disclose information if we are legally required to — but note what we would have to give: there is no account, no name and no email address, the photo does not exist, and the pictures are gone after 24 hours.

6. Where your data is processed

Our servers are located in ⬜ [region — e.g. Mumbai, India / Singapore]. Our object storage and network protection are provided by Cloudflare, which operates globally.

The AI image providers in §5.1 operate their own infrastructure and we do not control which country a given request is processed in. If you are in a region with data-transfer rules, please take this section as express notice that a photo you upload may be processed outside your country, for the seconds it takes to generate your picture.

⬜ Owner decision: if the EU/UK is a target market, name the transfer mechanism (Standard Contractual Clauses or equivalent) here, or state that the EU/UK is not served.

7. How long we keep things

⬜ Owner action: the four undecided rows above are not optional — Google Play's Data safety form and Apple's App Privacy questionnaire both ask, and an unanswered retention period is the kind of inconsistency that gets an app pulled.

8. Your rights and choices

Because there is no account, the practical controls are these:

• Delete your pictures now. Every picture is deleted after 24 hours anyway. In the app, deleting a result removes it immediately.
• Delete everything on this device. Uninstalling the app removes the device identifier on Android and on the web, and with it the link between you and anything we hold. ⚠️ On iOS the identifier stays in the Keychain on purpose, so that credits you paid for are not lost; tell us if you want it and the balance behind it erased.
• "Clear cache" in the app's settings removes locally cached images and style data. It does not delete your credits.
• Ask us. Write to ⬜ [support email] and quote the device identifier shown on the app's Settings screen. We can tell you what is stored against it and delete it. That identifier is the only way we can find your data, because we hold nothing else that points to you.
• Opt out of analytics. ⬜ [decide: either (a) ship an analytics opt-out switch in the app's Settings and describe it here, or (b) state plainly that analytics is pseudonymous, carries no photo or prompt, and cannot be switched off separately from using the app.] An opt-out switch is the stronger position and is expected in some markets.

Depending on where you live, you may have rights to access, correct, delete, restrict or port your data, to object to processing, and to complain to your data protection authority. To exercise any of them, write to ⬜ [support email]. We will respond within ⬜ [30 days / the period your governing law requires].

India: if you are in India, you may contact us at the same address about any personal data we hold, and ⬜ [name the grievance officer and contact details, if the Digital Personal Data Protection Act 2023 applies to the deployment].

Gulf states: if you are in Saudi Arabia, the UAE or another GCC state, the same contact address applies for any request under your local personal data protection law.

Legal bases (where the GDPR or a similar law applies): we process your photo to perform the contract you entered into when you asked us to generate a picture; we process purchase data to perform that contract and to comply with legal obligations; we process pseudonymous analytics and anti-abuse data under our legitimate interests in keeping the service working and in stopping the free photo from being farmed; and we rely on your consent for the 18+ and photo-ownership confirmation you give before your first generation.

9. Security

All traffic to and from our service uses HTTPS. Generated pictures are stored in a private bucket and served only through short-lived signed links. The administration console is reachable only with a secret token and, where configured, only from behind an additional access gate. The raw values behind our anti-abuse hashes are never stored.

No service is perfectly secure. The strongest protection we can offer is the one built into the design: the photo is not there to be stolen, and the pictures are gone in a day.

10. Advertising

There are no ads in DecadeShot. No ad SDK, no ad network, no banners, no interstitials, no rewarded video. ⬜ Owner note: the server retains a disabled, unconfigured rewarded-ad feature. If it is ever switched on, this section, the Google Play Data safety form and — on iOS — the App Tracking Transparency position all have to change before the release that enables it.

11. Changes to this policy

If we change how we handle your data, we will update this page and change the date at the top. For a material change we will also raise the in-app consent version, which means you will be asked to confirm the new terms before your next generation.

12. Contact

⬜ [legal entity name] ⬜ [registered address] ⬜ [support email]