Privacy Policy

This Privacy Policy describes how we collect, use, and handle your personal information when you use Picora and related services.

We collect the following information:

• Content you submit: photos (which may include faces), videos, audio, and the text you type when you create something. We collect it only when you choose to upload it or tap to create.
• Account information, such as an anonymous device identifier and your subscription status, created automatically when you first open the app
• Usage data and preferences, collected automatically as you use the app
• The answers you give during onboarding, such as your gender and the styles you like
• The words you type when you search for a style
• Install attribution data: which ad, if any, led you to install the app, matched using details about your device and its IP address
• Your device's advertising identifier (IDFA), only if you allow tracking (see Third-Party Services in the App below)
• Crash reports, and a notification token if you allow notifications
• Communication data, when you contact us

We use the information we collect to:

• Provide and maintain our services
• Improve and personalize your experience
• Communicate with you
• Ensure security and prevent fraud
• Process uploaded photos to generate stylized outputs (no facial recognition or biometric analysis is performed)
• Send your content to third-party AI providers to create the result you asked for (see Third-Party AI Providers below)
• Check uploads and text for safety with automated moderation
• Suggest edits for a photo you upload
• Find styles that match what you search for
• Measure which ads bring people to the app and whether they subscribe

Our website uses Google Analytics, a service from Google, to understand how visitors find and use it. Google Analytics uses cookies to collect usage data such as the pages you visit, the features you use, the plan you buy, your device and browser, your approximate location, and the site that sent you here, linked to the anonymous account identifier described above. It never receives your photos, videos, or the text you type. Google's advertising features are turned off for this data. You can read how Google uses information from sites that use its services and opt out with the Google Analytics Opt-out Browser Add-on. The website also sends PostHog the same kind of usage data, and while a purchase screen is open it records how you use the page, with everything you type and every photo and video hidden, so we can see where buying goes wrong.

The Picora iOS app includes software from these companies, which receive the data listed:

• Google Firebase: Analytics (the features you use, your device, and your approximate location), Crashlytics (crash reports), Cloud Messaging (a token to deliver the notifications you allow), and Remote Config and In-App Messaging (app settings and in-app messages)
• PostHog: product analytics (the features you use, your device, your account ID, and your onboarding answers)
• RevenueCat: purchases and subscriptions (your account ID, your purchase history, install attribution data, and your onboarding answers). RevenueCat sends purchase events to Meta, TikTok, AppsFlyer, and AppStack to measure our ads; the events sent to Meta can include the gender you chose during onboarding.
• AppsFlyer and AppStack: install attribution, which works out which ad, if any, led you to install Picora, using details about your device and its IP address
• Apple Search Ads: Apple's AdServices framework gives the app a token that says whether you came from an Apple Search Ads ad. The token is sent to RevenueCat and to our servers. It does not use your advertising identifier.
• Crisp: support chat. When you open Contact Support, the messages you send, your account ID, and your subscription status go to Crisp.

The Picora Android app does not include AppsFlyer or AppStack. It includes Meta's SDK, which tells Meta when the app is installed and opened, to measure our ads.

Tracking. At the end of onboarding, iOS asks whether Picora may track you (Apple's App Tracking Transparency prompt). Only if you tap Allow does the app collect your device's advertising identifier (IDFA). AppsFlyer, Firebase Analytics, and RevenueCat then receive it, and RevenueCat passes it to Meta and TikTok to measure our ads. If you do not allow tracking, the IDFA is never collected. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking.

Picora uses third-party AI services to create your results. The first time you send a photo, video, audio clip, or text prompt to create something, the app shows a Data Usage Notice that names these providers and asks you to Agree or Disagree. None of that content is sent for creation until you tap Agree. If you tap Disagree, nothing is sent. The app remembers your answer on your device.

When you create something, your photos, videos, audio, and text are sent from our servers to one of these providers, depending on the style you choose:

• fal.ai
• Replicate
• Atlas Cloud
• Kie.ai
• OpenRouter
• Higgsfield
• OpenAI, which also checks uploads and text for safety
• Sightengine, which checks an uploaded photo when our safety check finds it may be sexual: it estimates whether a face in it may belong to someone under 18, so that the request can be blocked. It does not identify who anyone is.

Through these providers, your content may be processed by AI models made by Google, OpenAI, ByteDance, Alibaba, xAI, Meta, Kuaishou (Kling), MiniMax, Black Forest Labs, Lightricks, and PixVerse.

Style search works differently. The words you type to search for a style are sent to OpenAI, without the Data Usage Notice, to find matching styles. If you installed the app from an ad, that ad's keyword and name may be sent to OpenAI in the same way, to choose the styles you see during onboarding.

Every provider we share data with gives it the same or equal protection as stated in this policy. Except for Higgsfield, they use your content only to process the request and return the result to us, and they do not use it to train their models. Higgsfield's terms let it keep content and use it to improve its models, and the app's Data Usage Notice tells you so before you agree; see Higgsfield's privacy policy.

When users apply AI effects, the selected photo is sent securely to our servers for processing. As part of this process, the photo may be shared with the third-party AI providers listed above solely to generate the requested effect. The photo is used only during processing and is not stored or retained afterward by the third party, except by Higgsfield as described above. Uploaded photos and your results are stored on our end in secure cloud storage. You can delete them at any time, as described in Deleting Your Data below.

No facial recognition (identifying who someone is) is performed at any stage. The only analysis of faces is Sightengine's age check described above, used only to block content. We do not train AI models on your content.

We implement appropriate security measures to protect your personal information. However, no method of transmission over the Internet or electronic storage is 100% secure.

You have the right to:

• Access your personal information
• Correct inaccurate data
• Request deletion of your data
• Object to data processing

AI processing. The app does not yet have a setting to withdraw the consent you gave in the Data Usage Notice. You can still stop it at any time:

• Stop creating. Nothing is sent to the AI providers to create a result unless you upload something or tap to create.
• Delete the app. This clears your saved answer (deleting your account alone does not), so if you install Picora again it asks before anything is sent for creation.
• Delete your account in the app, or contact us, to have the content you already sent removed from our servers (see Deleting Your Data).

Withdrawing consent does not affect processing that already happened.

Tracking. You can allow or stop tracking at any time in iOS Settings → Privacy & Security → Tracking.

You can delete your data in the app at any time:

• One creation: long-press it in History and delete it.
• All creations: Settings → Delete All Generations.
• Your account: Settings → Delete Account. This deletes your account and all your creations.

Deleted items leave the app right away. On our servers they are marked as deleted, and a nightly cleanup removes their photos, videos, audio, and results from our storage, starting one day after you delete them. Some records are kept in a deleted state rather than erased: your account record, a record of each creation without its files, and the text of the prompts you typed. To have these erased as well, contact us.

Deleting your account does not delete data held by the services listed in Third-Party Services in the App, such as purchase records at Apple and RevenueCat, analytics events, and support chats. Contact us to ask for that data to be deleted.

If you have any questions about this Privacy Policy, please contact us at hi@picora.app, tap Contact Support in the app's Settings, or visit our Contact page.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.