Privacy Policy — Headshot Studio

Effective date: August 12, 2026

Headshot Studio is built to need as little of your data as possible. This policy explains exactly what happens to your photos and information when you use the app.

No accounts

Headshot Studio has no login, no sign-up, and no user profile. We don't collect your name, email address, or any contact information.

Live coaching — on-device, always

The camera feed used for live coaching (framing, lighting, distance guidance) is processed entirely on your iPhone. It is never transmitted, uploaded, or shared. Photos you capture stay on your device unless you choose to use Studio Retouch (below).

Studio Retouch — opt-in, ephemeral

Studio Retouch is a feature you choose to use. When you do:

• You select two of your own saved photos.
• Those two photos are sent over an encrypted (TLS) connection to our processing service, which is a Cloudflare Worker that calls OpenAI's image API.
• The photos are used solely to generate your single retouched studio headshot.
• The two photos you upload are held in memory for that one request only — we never write them to storage, log them, or retain them, and neither does Cloudflare. They are deleted as soon as your headshot has been generated. OpenAI processes them under its API data policy: they are never used for training, and any abuse-monitoring copies are deleted within 30 days.
• Your finished headshot is yours, and it stays on your device. As soon as a Studio Retouch headshot is generated it is saved into your portfolio on your device. Nothing about it expires: it stays there until you delete it. The 24 hours described in the next point is about a copy on our service, not about your copy.
• Our copy of the result may be held briefly, encrypted. Each install can generate one Studio Retouch headshot before buying anything, so that you can see a real result before deciding. For that one pre-purchase headshot our service keeps a single encrypted copy of the result — never of the photos you uploaded — for up to 24 hours, and for one reason only: so a crash, a lost connection, or a backgrounded app doesn't cost you the headshot you were waiting for. It is encrypted with a key only our service holds and is used for nothing else. It stops being available exactly 24 hours after it is created — we will not serve it back after that — and an automatic clean-up sweep that runs every hour erases it, so it is gone no later than the hour after that. Erasing our copy has no effect on the headshot on your device. Headshots generated with a paid Studio Retouch credit are returned straight to your device and are not stored at all.
• Your photos are never used to train any AI model — ours or a third party's.
• A consent screen explains this before your first upload, every time you use the app for the first time.

If you don't use Studio Retouch, no photo ever leaves your device.

Face data

Headshot Studio never performs facial recognition and never creates a faceprint or any other biometric identifier. Here is every way the app touches face data.

• On-device face detection (no collection). During live coaching, Apple's Vision framework runs on your iPhone to detect where your face is in the camera preview — its position, size, and framing. These detection results exist only in memory: they are used to show coaching hints, are never written to disk, never leave your device, and are discarded the moment coaching moves on. The same on-device detection also runs once when a headshot is displayed or exported, to center the crop on your face — with the same guarantees: in memory only, never stored, never transmitted. Before a Studio Retouch, the same on-device check confirms a face is present in the photos you selected; nothing that check measures is stored or transmitted. The one thing that does leave the device is its verdict, and only when it fails: if no face is found we stop before uploading anything, and our anonymous analytics record that the attempt ended in no_face_detected — a closed-list outcome code, carrying nothing about the photo itself. We — and our servers — never receive the detection results.
• Photos that show your face. Photos you capture stay on your device (see above). If you choose Studio Retouch, the two photos you select are transmitted over TLS and used solely to generate your retouched headshot, as described in the Studio Retouch section; they are processed for that single request and are never used to train any AI model.
• Retention. We retain no face data of any kind: detection results are never stored, and we keep no copies of the photos you upload to Studio Retouch — they exist on our processing service only for the duration of your request. The one exception, described above, is the single generated result of a pre-purchase headshot, which is held encrypted and recoverable for at most 24 hours, then erased by an hourly clean-up sweep. That period applies to our copy only; the headshot saved on your own device is yours and stays until you delete it.
• Sharing. Face data is never sold or shared with third parties. The only parties that touch a Studio Retouch photo are our processing service (Cloudflare) and OpenAI's image API, strictly to fulfill your request.

The anonymous credit token

To keep track of your Studio Retouch credit balance (for example, credits included with Studio Pro or purchased in a pack), your device generates a random token. This token:

• Is generated on-device and is not derived from any hardware identifier.
• Is not your name, email, Apple ID, or any other identity information.
• Is used only to link a purchase to a credit balance in our system.
• Is never shared with advertisers, analytics providers, or any other third party.

We retain only the token and its associated credit balance — nothing else. There is no way for us to connect that token back to you personally.

The anonymous usage analytics described below use a different random identifier, and the credit token is never sent to our analytics processor — so nothing in our analytics can be traced back to a purchase or a credit balance. The two values meet in one place only: when your device asks our own service to generate a headshot, it sends the analytics identifier alongside the credit token, so we can record what that generation cost us. Our service holds that pairing only until the cost has been recorded — about 24 hours at the outside, and erased by the same hourly sweep — and the pairing itself is never sent anywhere. With analytics switched off, no analytics identifier is sent at all, so the pairing never exists.

Purchases

All purchases (Studio Pro, Studio Retouch packs) are handled entirely by Apple through the App Store. We never see or store your payment details, card numbers, or billing information.

Ad attribution

When the app is installed after you tap one of our own App Store ads, we use Apple's AdServices framework to learn which of our ads led to that install — the campaign, ad group, and keyword identifiers only, never your identity, your searches, or your browsing. If you make a purchase, we store those identifiers with the purchase record so we can tell which of our ads pay for themselves. This is first-party measurement: the identifiers are never sold and are never shared with other companies for their own purposes, and they contain no way to identify you. They are included in our own anonymous usage analytics (below), which our analytics processor handles on our behalf.

Anonymous usage analytics

The app sends anonymous product analytics — which steps of the app are reached, and which purchases complete — so we can see where people get stuck and fix it. This is what that does and does not involve.

• What is sent. Named product events (for example: onboarding finished, a photo captured, a paywall shown, a headshot exported, a purchase completed), each with a small, fixed set of properties: the app version and build, the platform, whether the install has Studio Pro, closed-list values such as which export format was chosen or which error a generation returned, and counts and durations that are always bucketed ("2–3 shots", "30s–2m") rather than exact. Purchase events carry the product identifier and the price the App Store displayed for your storefront.
• What is never sent. Photos, thumbnails, filenames, or any image content; face-detection results — the positions, sizes and measurements described above; photo, request, or session identifiers; your credit token or any Apple transaction identifier; prompt text or any free-form text; your name, email, Apple ID, or advertising identifier; and your city, coordinates, carrier, device name, or locale. No event ever contains an IP address. The app has no way to express any of these in an event: property names come from a fixed allowlist in our source code, and a unit test fails the build if any event carries a property outside it. To be exact about the one image-related thing that is sent: when a Studio Retouch fails, the event says why, from a fixed list of outcomes — including no_face_detected (the on-device check found no face) and moderation_blocked (the image service declined the request). Those name the failure, never the photo.
• The analytics install identifier. Each install generates its own random identifier (a UUID) so that one anonymous stream of events can be told apart from another. It is generated on your device, is not derived from any hardware identifier, and is not the credit token described above.
• Who processes it. Events go to PostHog Cloud (United States region), which stores and analyses them on our behalf as our processor. Automatic profile building, session recording, and screen capture are off. Sending anything over the internet necessarily exposes your device's IP address to the server receiving it; PostHog is configured to discard that address at ingestion, so no location is ever derived from it and none is stored. Our processing service also reports what a generated headshot cost us under the same anonymous install identifier — never a photo, a token, or a request identifier.
• Turning it off. Settings → Privacy → Anonymous Analytics. Switching it off takes effect immediately: nothing further is collected, anything queued on your device but not yet sent is deleted, and the analytics install identifier is deleted from your device. Switching it back on generates a brand-new identifier that is deliberately unlinkable to the old one. To be straightforward about the limit of that: events already sent before you switched it off carry no name, device identifier, or contact information, so there is nothing that would let us find "your" events and delete them retroactively — they expire with the retention period below.
• How long it is kept. Analytics events are retained for at most 13 months, then deleted.
• What it never affects. Switching analytics off does not affect your purchases, your Studio Pro unlock, or your Studio Retouch credits — those are keyed to the credit token, which analytics never touches.

What we don't do

• No third-party SDKs collect anything in the app — no analytics SDK, no advertising SDK, no crash reporter. The anonymous usage analytics described above are sent by our own code, directly to our analytics processor, and contain only what is listed there.
• No ads in the app, and no third-party ad networks or ad SDKs.
• No tracking: nothing we collect is combined with data from other companies' apps or websites, or used to follow you across them. No data is ever sold to anyone.
• No third-party sharing beyond the minimum needed to run Studio Retouch (Cloudflare and OpenAI) and to process anonymous usage analytics (PostHog), all described above.

Permissions

• Camera — used only for live coaching and capturing your photos. Never accessed in the background.
• Photo Library (add-only) — used only to save your finished headshots to your library, if you choose to save them. We never read your existing photo library.

Data retention

• On-device photos: retained on your device under your control; we have no access to them. This includes your finished Studio Retouch headshots, which stay in your portfolio until you delete them — none of the periods below applies to them.
• Studio Retouch uploads: deleted immediately after processing — retained for the duration of a single request, at most.
• Pre-purchase Studio Retouch results (our copy): one encrypted copy of the generated headshot, recoverable for at most 24 hours and then erased by an hourly clean-up sweep. Results generated with a paid credit are not stored at all.
• Credit ledger: an anonymous token paired with a numeric credit balance. No photos, names, or identifiers are stored alongside it.
• Pre-purchase headshot record: a one-way, salted hash of your credit token, recording that this install has had its one pre-purchase headshot. The token itself is not stored in that record, and the hash cannot be reversed.
• Analytics events: at most 13 months, as described above.

Children's privacy

Headshot Studio is not directed at children and does not knowingly collect data from children.

Changes to this policy

If this policy changes, the effective date above will be updated. Material changes will be reflected in the app's release notes.

Contact

Questions about this policy or your data can be sent to:
admin@3paws.ai

Governing law

This policy is governed by the laws of Canada.