Privacy Policy

Last updated 18 October 2026.

The short version

Your photos are edited on your phone. There is one exception, and it is worth reading rather than skipping: the AI tools send the photo you have open to our service so a model can do the work, because those particular edits cannot run on a phone. Nothing you do not tap is ever sent, and nothing is stored.

What never leaves your device

• Every photo you open, unless you tap one of the AI tools listed below — or share a saved photo yourself from the iOS share sheet, in which case it goes only where you send it. The app hands the photo to the app you pick and sends nothing of its own.
• Face detection. It runs entirely on your phone; no image is sent for analysis, and the points it finds are discarded when you close the photo.
• Smoothing, healing, whitening, lighting and grades. All of it happens on the device, and none of it involves a server.
• Your editing history and any per-photo retouching you do.
• The full-resolution original. Even when an AI tool runs, what is sent is the smaller version you are looking at on screen.

The AI tools, in detail

Makeup, hair colour, haircuts, hairstyles, beards, eyebrows, object removal, clothing, headshots and backdrops each need a generative model far too large to run on a phone. Tapping one of them, and only tapping one of them, sends that photo to our service.

• Where it goes. To our service, which passes it to Google’s Gemini model on Google Cloud (Vertex AI) and returns the result. Google chooses which of its data centres handles the edit, in the United States or in another country. Google handles it under their own terms.
• How long we keep it. We do not. It exists in memory for the length of the request. Our service has no image storage of any kind — no bucket, no database, no cache — so there is nowhere for a copy to be written even by mistake.
• What we log. That an edit happened, which tool, your account identifier, and the size in bytes. Never the image, never a filename.
• How to avoid it entirely. Do not use those ten tools. Everything else in the app works with no network connection at all.

What we store, and where

If you create an account, we store one thing on Google Firebase servers:

• Your account identity — the email address or the identifier supplied by Apple or Google when you sign in, and, if you sign in with Google, the name on that Google account. This is handled by Firebase Authentication.

We do not store when a free trial started. The free trial is part of an App Store subscription, so its dates are kept by Apple and RevenueCat with the rest of your purchase (see Purchases, below).

Your saved Presets are not stored with us either. A Preset is a small set of numbers, typically a few hundred bytes with no image data, and it is stored on your phone only. An account is required to use the app, because it is what your subscription is attached to.

How we can be specific about this

The app includes a tool that records every network request it makes, with the size of each. Over a complete session — launching, signing in, choosing a photo, detecting a face, editing and exporting — it recorded five requests, all to Google Firebase, and the largest single upload was 1,551 bytes. For scale, a photograph at the size this app exports is several hundred thousand bytes. No image data left the device. That recording predates usage analytics, which adds requests to PostHog carrying only the events listed under Usage analytics.

Our service also keeps a count of how many AI edits your account has used, this month and during the free trial, so the allowance can be enforced. It is a number stored against your account identifier, nothing more.

It also keeps a record of each AI edit you make: when, which tool, which model ran it, how long it took, how it ended and what it cost us to run. It is kept against your account identifier, so that we can see what the AI tools cost and look into an edit that went wrong. It never holds the photo, the result, or the choice you made in the tool. It is deleted when you delete your account, and each month of it expires on its own about two years later.

Purchases

Subscriptions are handled by RevenueCat and by Apple. We never see your payment details. RevenueCat receives a purchase receipt and an identifier for your account so your subscription follows you between devices. If you buy a pack of extra AI edits, RevenueCat also keeps, against the same identifier, how many of them you have left.

When you use an AI tool, our service asks RevenueCat, using that identifier, whether your account has an active subscription and whether it is in its free trial. That is how the allowance above is chosen; the answer is kept for a few minutes at most.

Emails

If you sign up with an email address and a password, you get one message with a link that confirms the address is yours. It is sent by Firebase Authentication, the Google service that holds your account, and the AI tools need it opened before they will run: an address nobody has confirmed costs nothing to make up, and each made-up one used to be three free AI edits. Signing in with Apple or Google needs no link, because they confirm you themselves. We do not write to an address until it has been confirmed.

We send a small number of emails about your account: a welcome when it is created, and a confirmation if you delete the account. When something happens to your subscription we may also email you about it — that your free trial has started and the date you will be charged unless you cancel, that a payment failed, or that the subscription was cancelled. There are no reminder emails before a trial ends; Apple sends its own notices about your subscription. Our emails go to the email address on your account and are sent through Resend, which keeps a delivery record of each message. They contain no tracking pixels and no links that follow you. There is no newsletter.

Usage analytics

The app sends anonymous usage events to PostHog, so we can see whether people get from installing it to a finished photo, and whether the parts we built are the parts people use. This is the complete list of what it records:

• the app was installed, updated, opened, brought to the front or put away;
• a trial started;
• you signed in, and whether with Apple, Google or an email address;
• an export finished, and whether at full or standard size;
• a Preset was saved, and how many you now have;
• an AI tool was used, and which one;
• the subscription screen was shown, and why;
• a subscription was bought, and which plan;
• a collage was saved, and which layout and how many photos were in it;
• a screenshot was taken while the editor was open, before you had a subscription — that it happened, and nothing about the photo or what you were doing to it;
• a saved photo was shared from the share sheet, and whether it was the photo or a before-and-after — never where it went or to whom.

Each event also carries what any app's diagnostics do: the app version, the iPhone model, the iOS version, your language and your time zone. It never carries a photo, a file name, anything you typed, your email address or your account — we never tell PostHog who you are, so these events cannot be joined to your account. Each install gets a random identifier instead, which is how one person's second export is told apart from a second person's first. Location lookup from your connection is switched off, and PostHog is set not to store the IP address a request comes from.

You can turn usage analytics off in Settings → Privacy, and it stays off.

Tracking

There is none. PhotoTune contains no advertising SDK, no third-party tracker and no session recording, and nothing above is used to follow you across other companies' apps or websites. We do not build a profile of you and there is nothing to sell. This website loads nothing from anyone else either — no tag manager, no pixel, no embedded font. The download links on this website do carry a label naming the page they are on, such as "web-home", so that App Store Connect can count how many downloads each page led to. The label names the page, not you, and Apple reports it to us only as a total.

Crash reports

Since 2 September 2026 the app sends crash reports to Sentry, so that a crash on a real phone can be fixed rather than guessed at. A report contains what the app was doing when it stopped: the error, the code path, the device model and the app version.

A crash report can never contain your photo. Sentry can be configured to attach a screenshot and a copy of the on-screen layout when an app crashes, and on an editing screen a screenshot is the photograph. Both settings are off, and a test fails the build if either is ever switched on.

Before a report is sent it is stripped of photo file paths, sign-in tokens and email addresses. Reports are not linked to your account and are not used to track you or to build a profile — they exist to tell us what broke.

Location and photo metadata

Exported photos have location data removed. If the photo you opened contained GPS coordinates, the copy PhotoTune saves will not.

Deleting your data

In the app, open Settings and tap Delete account at the bottom. It deletes your account immediately and permanently, and clears the Presets saved on that phone. You do not have to ask us and you do not have to wait.

One small record stays behind: the counts of AI edits used, including the free ones and the free trial’s. Each count is kept in two places, and neither holds your email address or your name. One is the old account identifier. The other is a code we calculate from the identity you signed in with — Apple’s or Google’s identifier for you, or your verified email address — or, for a subscription, from the purchase itself. The calculation is one-way and uses a secret only our service holds, so the code cannot be turned back into your address, and nobody without that secret can tell whether a given address has one.

We keep that code for one reason: the free AI edits are given once per person. Without it, deleting an account and making a new one would hand them out again, every time. A month’s count expires on its own a week after that month ends; the free edits’ count and the free trial’s are kept. No record of when a trial started is kept, because we do not store one. Your purchase history, including any free trial, stays with Apple and RevenueCat, because a subscription is a record of a payment and Apple, not us, controls it — deleting your account does not cancel it, so cancel it in your iPhone’s subscription settings.

The record of your AI edits is deleted with the account. What stays from it is a tally with no account on it at all: how many AI edits were made each day, with which tool, and what they cost us. Nothing in it says whose they were.

The photos in your camera roll are not touched by this, and there are no photos of yours on our side to delete — the AI tools hold one only for the length of a single request, and write it nowhere.

You will get one email confirming the deletion, if your address was verified, and then nothing further. If you would rather we did it for you, [email protected] still reaches a person.

Children

PhotoTune is rated 12+ and is intended for adults. It is not directed at children and we do not knowingly collect data from them.

Changes

If this policy changes materially, the date at the top changes and the app will tell you before the change takes effect.

Contact

[email protected]