At a glance
- No accounts. Installing the App creates a random anonymous ID. We never ask for your name or contact details.
- Photos are sent only after you agree. When you make a studio photo, the photo you chose goes through the Developer's server (Cloudflare) to the AI provider (OpenAI).
- Photos on our server are deleted within 7 days. Your originals and saved photos stay on your device and in your own iCloud Drive, which the Developer cannot access.
- No face recognition. Face position and head angle are measured on your device only. We do not create or store facial feature data.
- No ads, no tracking. We do not collect the advertising identifier (IDFA) and do not track you across other companies' apps or websites.
1. Information we process
1-1. When you make a studio photo (optional, after consent)
- The photo you take or choose, which shows your face. Before sending, the App removes metadata such as location and sends a copy framed to the guide (head and shoulders), with margins added or edges cropped.
- Your choices: purpose (résumé or profile), background color, flyaway-hair tidying, whether to straighten your head or remove glasses, and the head angle the device measured when straightening (a number in degrees).
- The results: the final photo and a watermarked preview.
1-2. Information created or collected while you use the App
- Anonymous user ID: a random ID and secret created when the App first connects. The secret stays in your device's Keychain; the server keeps only a hash of it.
- Device verification: to prevent repeated free trials, we use Apple App Attest (device key ID, public key, verification records) and Apple DeviceCheck (a per-device value showing whether the free trial was used, stored by Apple).
- Usage records: number, status, and time of generations per photo, and daily usage counts.
- Purchase records: from Apple's signed transaction, the transaction ID, product ID, the photo purchased, and refund status. We never receive card or other payment details; Apple processes payments.
- Analytics: screen flow and choices (for example, purpose chosen, retakes, price shown, time to first result, feedback option) recorded only as fixed words and numbers. This may include the device's classification of whether glasses were worn and head direction (frontal, tilted, turned). It never includes photos, facial measurements, or free text.
- Notification token: if you allow notifications, an Apple push token used to tell you when your photo is ready.
- Connection data: your IP address is used only while handling a request to block excessive traffic and is not stored on the Developer's server.
1-3. Processed on your device only
- Face analysis: for capture guidance and framing, Apple's on-device Vision framework measures face position and size, head angle, brightness, and whether glasses are worn. These values do not leave your device (except the classification in 1-2).
- Originals and saved photos: stored in the App's "My Photos" and in your own iCloud Drive ("Chalkak" folder). The Developer cannot access them.
- "Resize only, no retouching": Ordinary photo cropping and resizing run entirely on your device and sends nothing.
1-4. When you contact us
- Your email address and message. If you use "Contact" in the App, the app version, iOS version, device model, and your anonymous user ID are added to the message (you may delete them before sending).
2. Why we process it
- To make studio photos and deliver previews and final photos
- To verify purchases, deliver final photos, and apply refunds
- To manage free trials and daily limits and prevent abuse
- To notify you when a photo is ready or a preview is about to expire
- To diagnose errors, improve quality, and manage costs
- To answer inquiries and handle disputes
We do not use face photos for AI training, advertising, or any other service.
3. Retention and deletion
| Information | Retention |
|---|---|
| Uploaded photos never used to make a photo | 24 hours after upload |
| Unpurchased photos (original and previews) | 7 days after the first result |
| Final photos of purchased photos | Deleted as soon as we confirm they are saved on your device; if not received, 7 days after both the purchase and that result |
| Original and previews of purchased photos | 7 days after both the purchase and the latest result. If you use a remaining edit later, the App uploads the original from your device again. |
| Photos you delete in "My Photos" | The server copy is deleted immediately. |
| Analytics | 1 year from recording (on the Developer's server and in the analytics tool PostHog) |
| Notification token | Until you turn off notifications or delete the App and Apple reports the token is no longer valid |
| Anonymous user ID, device verification, free-trial and daily usage records | While we provide the service (to prevent repeated free trials). Deleted on request. |
| Purchase records (payment and supply of goods) | 5 years (Act on Consumer Protection in Electronic Commerce) |
| Inquiry, complaint, and dispute records | 3 years (same Act) |
A cleanup job runs every hour and deletes expired photos from server storage. Photos that are being made, awaiting purchase approval, or under error review are kept until that finishes. Deleted files are removed from storage so they cannot be restored, and records are removed from the database.
Photos sent to the AI provider (OpenAI) are retained and deleted under OpenAI's policies; the Developer cannot delete them directly (Section 4).
4. Processors and international transfers
To provide the service, the App entrusts processing to the companies below, which are located outside Korea. Data is sent over an encrypted connection (HTTPS) while you use the App.
| Recipient (country) | Purpose | Data | Retention |
|---|---|---|---|
| Cloudflare, Inc. (USA). Storage: Asia-Pacific data centers | Running the Developer's server, storing photos, results, and records, relaying requests | Items in 1-1 and 1-2 | As in Section 3 |
| OpenAI, L.L.C. (USA) | Generating studio photos | A copy of the photo you chose and the generation instructions | Under OpenAI's policies. OpenAI states that it does not use data sent through its API to train models by default. |
| Apple Inc. (USA) | In-app purchases, device verification (App Attest, DeviceCheck), notification delivery, your iCloud Drive storage | Purchase data, device verification data, notification token and text, photos you save | Under Apple's policies |
| PostHog, Inc. (USA) | Usage analytics. The Developer's server sends data every 5 minutes over HTTPS. | Analytics records in 1-2 and server processing records (photo generation, purchase, and notification results), anonymous user number, photo number, install environment (development or release). Photos, facial measurements, and IP addresses are never sent. | 1 year from sending |
Photos are sent to OpenAI only after you give consent in the App. Without consent you cannot make studio photos, but "Resize only, no retouching" still works. You can turn off notifications anytime in iOS Settings.
- Cloudflare Privacy Policy
- OpenAI Privacy Policy, OpenAI API data usage
- Apple Privacy Policy
- PostHog Privacy Policy
Other than the above, we do not share your personal information, except when required by law.
5. Your rights
- You may request access to, correction of, deletion of, or suspension of processing of your personal information at any time.
- In the App: deleting a photo in "My Photos" deletes the server copy immediately. Notifications can be turned off in iOS Settings.
- By email: write to iksang.h@gmail.com. Since there are no accounts, sending your request through Settings > "Contact" in the App lets us find your records by your anonymous user ID. We handle requests without delay (within 10 days) and let you know the result.
- Records the law requires us to keep, such as purchase records, may not be deleted during the required period; we will tell you why.
- You may also make requests through a legal representative or an authorized person.
6. Security measures
- All transfers use encrypted connections (HTTPS).
- User secrets stay in the device Keychain; the server stores only hashes.
- Photos and results are served only after ownership checks, and unwatermarked files of unpurchased photos are never served by any route.
- Photos, file paths, and face data are never written to logs or analytics.
- Expired photos are deleted automatically (Section 3).
- Server keys are kept in a separate secret store, never in code.
7. Facial data and sensitive information
The App finds faces to measure position and angle, but it does not perform face recognition to identify individuals (biometrics) and does not create or store facial feature data. We do not collect other sensitive information.
8. Cookies and tracking
The App does not use cookies or the advertising identifier (IDFA) and does not track you across other companies' apps or websites. This website does not use cookies either.
9. Children
The App is intended for users aged 14 and older. Photos of children under 14 must be made by their legal guardian using the App. If you learn that a child's information was processed without guardian consent, please contact us and we will delete it promptly.
10. Privacy officer
- Name: Iksang Hwang (Developer)
- Email: iksang.h@gmail.com
11. Changes to this policy
We may update this policy when laws or the service change. We will announce changes in the App or on this page at least 7 days before they take effect (30 days for changes unfavorable to you).
Published: September 25, 2026 · Effective: September 25, 2026