TogetherLens Privacy Policy

Last updated: August 31, 2025

This Privacy Policy explains how TogetherLens ("we", "us", or "our") collects, uses, and shares information when you use our mobile app and website (collectively, the "Service").

By using the Service, you agree to this Policy. If you do not agree, please do not use the Service.

What We Do

TogetherLens lets you create group photos from individual face photos using AI. We process your uploaded images on our infrastructure hosted by Hetzner (Germany) and forward them to our AI generation provider, fal.ai, which uses Google Gemini 2.5 Flash for image generation. We integrate RevenueCat to manage in‑app purchases/subscriptions.

Data We Process

• Images you upload (face data): the face/headshot photos you choose to generate a group picture. We do not collect facial geometry, faceprints, or TrueDepth/ARKit facial mapping data.
• Prompts/styles: your chosen styles, prompts, and related configuration.
• Generated results: the output images returned by our AI provider.
• Session and app metadata: non-sensitive session IDs, timestamps, feature flags.
• Device and performance data: limited technical data (e.g., app version, OS version, error logs) to ensure reliability and support.

We do not collect precise location, contacts, or your address book. We do not profile individuals beyond what is necessary to create the requested images.

Why We Process Your Data (Legal Bases)

• Provide the Service: to upload images, generate group pictures, and deliver results (contract/performance of the Service).
• Improve and secure the Service: troubleshooting, preventing abuse, and quality assurance (legitimate interests).
• Payments/subscriptions: to validate purchases and manage access (contract; legitimate interests; in some regions, compliance obligations).
• With your consent: where required for optional features or communications.

Where and How We Process Data

• Hosting: Hetzner Online GmbH (Germany). Your requests are processed by our servers in EU data centers.
• Website & Asset Hosting: Cloudflare Pages hosts our website and serves static assets globally for optimal performance and reliability.
• DNS Management: Cloudflare provides DNS services to route traffic efficiently and securely to our services.
• AI Generation: fal.ai (using Google Gemini 2.5 Flash) receives only what's required to render your images (uploaded images, prompts/styles, and minimal metadata). Files uploaded to fal.ai’s storage are available for a limited period; request payloads may be retained per fal.ai’s policies. See fal.ai's privacy documentation for details.
• Subscriptions: RevenueCat may process purchase receipts, subscription status, and device identifiers necessary to operate in‑app purchases.

Subprocessors and Policies

• Hetzner Online GmbH (hosting, Germany): https://www.hetzner.com/legal/privacy-policy/
• Cloudflare (DNS management and website/asset hosting): https://www.cloudflare.com/privacypolicy/
• fal.ai (AI image generation using Google Gemini 2.5 Flash): https://www.fal.ai/privacy
• RevenueCat (subscriptions): https://www.revenuecat.com/privacy/

We engage these providers to deliver the Service. They act under our instructions and applicable agreements. Their policies may change; please review them for details about their processing.

Retention

• Uploaded and generated images: on our side, we do not persist your original uploads beyond processing. Generated result URLs are stored only on your device (local history) and are cleaned up after 7 days. Our AI provider (fal.ai) retains storage files and request payloads for limited periods per their policies.
• Logs and minimal technical metadata: retained for a reasonable period to operate, secure, and improve the Service.
• Purchase/subscription records: retained as required by platform and accounting rules.

How We Protect Your Data

• Encryption in transit using HTTPS.
• Restricted access and least‑privilege controls.
• Regular reviews of infrastructure and dependencies.

No method of transmission or storage is 100% secure. We work to safeguard your data but cannot guarantee absolute security.

Sharing

We do not sell your personal data. We share data only with:

• Service providers listed above to operate the Service.
• App stores and payment processors as needed for purchases.
• Authorities when legally required (e.g., to comply with a lawful request).

We do not use your images to train our own models. Our AI provider (fal.ai) maintains its own policies; we instruct providers not to use your content for training where possible. Review their policies for details.

Face Data

• What we consider “face data”: photos of faces that you choose to upload. We do not collect biometric identifiers, face geometry, or TrueDepth/ARKit facial mapping data.
• Purpose of use: to generate your requested group photo and deliver the result back to you.
• Sharing: your selected photos are transmitted to our AI generation provider (fal.ai, using Google Gemini 2.5 Flash) strictly to render results.
• Retention: we do not store your original uploads beyond processing; generated result links are kept locally on your device and auto‑pruned after 7 days. Our providers retain data for limited periods per their own policies.
• Marketing/advertising: we do not use face data for marketing, advertising, or user profiling.
• Training: we do not use your content to train our models.

International Transfers

Our primary hosting is in the EU (Germany). If a provider processes data outside your jurisdiction, we rely on appropriate safeguards (e.g., Standard Contractual Clauses) as legally required.

Your Rights

Depending on your location, you may have rights to:

• Access the data we process about you.
• Correct inaccurate data.
• Delete data (subject to legal obligations).
• Restrict or object to certain processing.
• Data portability.
• Withdraw consent where processing is based on consent.

To exercise rights, contact us at [email protected]. We may verify your identity before responding. You can also lodge a complaint with your local data protection authority.

Children

The Service is not directed to children under 13 (or higher age as required by local law). We do not knowingly collect data from children under the applicable age of consent.

Changes to This Policy

We may update this Policy to reflect changes to our practices or for legal reasons. We will post the updated Policy with a new “Last updated” date. Material changes may be communicated in‑app or on our website.

Contact

For privacy questions or requests:

• Email: [email protected]
• Subject: “Privacy Request – TogetherLens”