Privacy Policy

Effective Date: April 9, 2026

SwapHair AI ("we", "our", "the app") is committed to protecting your privacy. This policy explains what data we collect, how we use it, the third parties we share it with, and your rights.

1. Information We Collect

Photos you provide: When you upload or capture a selfie and tap Generate, the image and the selected style description are transmitted over HTTPS to our secure relay server hosted on Vercel (hairswap-proxy.vercel.app), which immediately forwards the request to Black Forest Labs' FLUX Kontext AI service (api.bfl.ai) for image generation. Before the first generation, the app shows an in-app consent dialog naming Black Forest Labs so you can review and agree (or decline) before any photo is sent. Photos are processed once and immediately discarded — they are never stored on our relay server, never cached, never saved to any database, and never used to train AI models.

On-device data: The following data is stored locally on your device only and is never transmitted to us:

• Saved hairstyle previews (stored via SwiftData on your device)
• App preferences (gender selection, haptic settings, favorites)
• Usage statistics (generation count, streaks, badges)
• Face shape analysis results (processed entirely on-device using Apple Vision framework)

Subscription data: Subscription purchases are managed by Apple and RevenueCat. We receive anonymized subscription status information (whether you have an active subscription) but do not have access to your payment details, Apple ID, or personal billing information.

Analytics: We use Firebase Analytics to collect anonymized usage data (screen views, feature usage, crash reports) to improve the app. This data cannot be used to identify you personally.

2. How We Use Your Information

• Photo processing: Your selfie is sent to the BFL FLUX API exclusively for generating hairstyle previews. The image is transmitted via encrypted HTTPS, processed, and immediately deleted. It is never stored, shared, or used for AI model training.
• Face analysis & landmarks (on-device only): Apple's Vision framework (VNDetectFaceLandmarksRequest and VNGeneratePersonSegmentationRequest) detects the position of your face landmarks — eyes, nose, mouth, and chin — and a person silhouette mask, directly on your iPhone or iPad. These are used only to construct a precise mask of your face area, which is composited over the AI-generated result so your actual facial features are preserved (rather than distorted) in the final image. The face landmarks and segmentation mask are computed in memory and never written to disk, transmitted off-device, or shared with any third party. We do not perform face recognition, biometric identification, or identity matching, and we do not create or store a face print or face template. The selfie image itself is sent to Black Forest Labs for hairstyle generation as described in Section 3 (BFL does not retain it after processing).
• Color Lab: Hair color previews are generated entirely on your device using Core Image. No photos are sent to any server for this feature.
• Subscriptions: To verify your subscription status and provide premium features.
• Analytics: To understand how features are used and improve the app experience.

3. Third-Party Services

We share data with the following processors only for the narrow purposes described. Each processor provides data protection that is the same as, or substantially equivalent to, the protection we provide.

• Black Forest Labs (BFL) — FLUX Kontext AI: Receives your selfie and style description over HTTPS for the sole purpose of generating your hairstyle preview. BFL does not store photos after processing and does not use them to train AI models. See bfl.ai/privacy.
• Vercel (relay hosting): Hosts our secure API relay (hairswap-proxy.vercel.app) which forwards requests to BFL without logging, caching, or storing photo data. Vercel operates under GDPR-compliant data processing terms. See vercel.com/legal/privacy-policy.
• RevenueCat: Manages subscription status. Receives anonymized purchase data from Apple. See revenuecat.com/privacy.
• Firebase Analytics (Google): Provides anonymized usage analytics and crash reporting. No photos or personal identifiers are sent to Firebase. See firebase.google.com/support/privacy.
• Apple (StoreKit): Handles all payment processing for subscriptions and in-app purchases. We never receive your payment details.

4. Data Retention

We do not retain any personal data on our servers. Photos are processed in real-time and immediately deleted. All user preferences, saved looks, and app data are stored locally on your device. Deleting the app removes all local data.

5. Data Sharing and Consent

We do not sell, share, or transfer your personal information to third parties for marketing or advertising purposes. Data is only shared with the third-party services listed above, solely for the purposes described.

Before your selfie is sent to Black Forest Labs for AI processing, the app shows an explicit in-app consent dialog that names the third-party processor and summarizes this policy. You must tap "I Agree" to proceed; you can tap "Privacy Policy" to read this policy in full, or "Cancel" to decline. No photo data leaves your device until you explicitly consent.

6. Children's Privacy

SwapHair AI is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

7. Your Rights

Since we do not store personal data on servers, there is generally no personal data to access, modify, or delete on our end. You can:

• Delete all local app data by uninstalling the app
• Clear cached images from within the app settings
• Manage or cancel your subscription through Apple Settings

8. Security

All data transmission between the app and our processing service uses HTTPS encryption. Photos are processed in-memory and never written to persistent storage on any server.

9. Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected by updating the effective date at the top of this page.

10. Contact Us

If you have questions about this privacy policy, contact us at:
ypetrosyan17@gmail.com