Privacy Policy
Last updated
The short version
- No account. You can use ManeBooth without signing up. We never ask for your name or email in the app.
- Your looks stay on your iPhone. Your selfie, the haircut photos you add, your looks, photobooth strips and stylist cards are stored on your phone.
- Photos are sent only to make a look. When you try a haircut, your selfie and the haircut photo travel over an encrypted connection to our server, which passes them to our image provider and does not store them.
- We keep very little, for a short time. Our server keeps a random install ID, your look counts and purchase records, and links to your results for 30 days.
- No ads, no tracking, no selling. No advertising identifier (IDFA), no analytics SDK, and we never sell or share your data for advertising. We never use your photos to train models.
- You are in control. Settings, then Delete all my photos and data, removes everything on your phone and asks our server to delete what it holds for your install.
1. Who we are
ManeBooth is an iPhone app provided by Nghia Le, trading as LilGroup ("LilGroup", "we", "us"). This policy explains what information the app uses, why, where it is kept and the choices you have. It applies to the ManeBooth iOS app and this website.
For users in the EU, EEA and UK, LilGroup is the "controller" of the limited personal data we process. You can reach us at oscar.lehuu@gmail.com.
2. Data stored on your iPhone
ManeBooth works without an account. What you create in the app stays on your device:
- your selfie, and the answers you give about your hair (length, texture, goal);
- the haircut photos you paste, pick or take;
- your looks, photobooth strips, side and back views, stylist cards and cut notes;
- salon visit dates you choose, and your app settings;
- a random install ID, kept in your iPhone's Keychain (it stays there if you delete the app), so our server can count your looks without knowing who you are.
We cannot access this data on your phone.
3. Making a look: what is sent and why
ManeBooth's main feature needs to process photos on a server. Each time you try a haircut, re-try a look, open the photobooth strip or make a stylist card, the app sends over an encrypted connection (HTTPS):
- your selfie and the haircut photo, shrunk to at most 1024 pixels on the long side;
- the options you chose (for example keep my colour or keep my length) and your hair answers;
- your random install ID, and, for paid features, Apple's signed record of your purchase so we can check your plan.
Our server runs on Cloudflare. It forwards the photos to fal.ai, our image provider, which runs the image model (OpenAI's GPT Image, or ByteDance's Seedream if the first one fails) and returns the result as a private link. For stylist cut notes, the result image and the haircut photo are sent to OpenRouter, which runs a text model (OpenAI) that writes the notes. The app then downloads the result to your phone.
Our server does not save your photos. It only works with them in memory for the few seconds a request takes. To avoid charging you twice for the same request, it stores a one-way fingerprint (hash) of the inputs, which cannot be turned back into a photo.
ManeBooth does not try to recognise who you are. We do not create face templates or other biometric identifiers, and we do not compare your face with any other face.
Haircut photos you add may show another person. They are used only to copy the hairstyle onto your own photo; please add only photos you have the right to use (see our Terms of Use).
4. What our server keeps
- Your random install ID, your plan, how many looks you have used this week and any look-pack credit, so limits work and failed tries are never counted.
- Look records: a look ID, the private link to the result image, which model made it, and retry counts. Stylist notes text and links to side and back views are kept with the look.
- Purchase records: Apple transaction IDs and product IDs, so one purchase cannot be used twice.
- Request fingerprints (hashes) for the duplicate check described above.
- A per-minute request counter keyed by your install ID and your IP address, to stop abuse.
- Basic request logs kept by Cloudflare (time, route, status and error messages, not your photos).
None of this includes your name, email, Apple ID or your photos. How long each item is kept is in How long we keep data.
5. Purchases and subscriptions
Subscriptions and the look pack are sold through Apple In-App Purchase. Apple handles payment; we never see your card or your Apple ID. We use RevenueCat to manage purchases: it receives your random install ID, your purchase and subscription status, and basic device information (such as iOS version and country) needed to validate purchases.
6. Camera, Photos and notifications
- Camera: only if you choose to take a selfie or a photo of a haircut. You can pick from Photos instead.
- Photos: ManeBooth uses Apple's photo picker, so it only sees the photos you choose. Saving a look or a stylist card to Photos asks for permission to add photos only.
- Notifications: salon reminders are scheduled on your iPhone. They do not go through our server.
7. When you contact us
If you email us, we receive your email address and what you write. The app's help email fills in your app version and iOS version, and the look ID when there is one, to help us find the problem; you can remove them before sending. We use this only to answer you.
8. What we never do
- We never sell your data or share it for advertising.
- We never use the advertising identifier (IDFA) or track you across other apps and websites.
- We never use your photos or looks to train models, and never use them for anything other than making your looks.
- We never store your photos on our server.
- We never publish or share your looks. Sharing only happens when you tap Share or Send to my salon.
9. Who we share data with
We use a small number of providers that process data for us:
| Provider | What they receive | Why |
|---|---|---|
| Cloudflare (US, global network) | All requests from the app, including photos in transit; the server data in section 4 | Runs our server and database |
| fal.ai (US) | Your selfie, the haircut photo and the instructions for each look | Runs the image models (OpenAI GPT Image, ByteDance Seedream) and hosts the result at a private link |
| OpenRouter (US) | The result image and the haircut photo, when you make a stylist card | Runs the text model (OpenAI) that writes cut notes |
| RevenueCat (US) | Random install ID, purchase status, basic device information | Manages subscriptions and purchases |
| Apple | Payment and App Store data, under your agreement with Apple | App Store, payments, refunds |
These providers handle data under their own terms and privacy policies, linked above. We may also disclose information if the law requires it.
10. How long we keep data
- Your photos: not kept on our server at all. Our providers may keep request data for a limited time under their own policies.
- Look records, links to results, stylist notes and view links: deleted from our server 30 days after they are made. Your looks stay on your phone until you delete them.
- Request fingerprints: 7 days.
- Per-minute request counters (install ID and IP address): deleted within 24 hours.
- Cloudflare request logs: a few days.
- Install ID, look counts and purchase records: while you use ManeBooth, until you delete your data in the app or ask us to.
- Support emails: as long as needed to help you, then deleted within 12 months.
11. Deleting your data and your choices
- Delete your selfie: Settings, then Your photo, then Delete.
- Delete everything: Settings, then Delete all my photos and data. This removes your photos, looks, cards and settings from your iPhone and asks our server to delete the records it holds for your install ID.
- Delete the app: removes your photos, looks and cards from your phone. The random install ID stays in your iPhone's Keychain so your look counts carry over if you reinstall; use Delete all my photos and data first if you want our server records removed straight away. Otherwise they expire as described above, or you can email us.
- Turn off permissions for Camera, Photos and Notifications at any time in iPhone Settings.
Deleting your data does not cancel a subscription; cancel it in iPhone Settings, your name, Subscriptions.
12. Age limits and children
ManeBooth is intended for people aged 13 and over. If you are under 18, please use ManeBooth only with permission from a parent or guardian.
ManeBooth is not directed at children, and we do not knowingly collect personal information from children under 13. If you believe a child has used the app, contact us and we will help delete any data we hold.
13. Security
Data on your iPhone is protected by iOS security, including your passcode and device encryption. Photos travel over encrypted connections and are not stored on our server. Results are hosted at long, unguessable private links. No system is perfectly secure, but we keep the data we handle to a minimum to reduce risk.
14. International transfers
Our providers, including Cloudflare, fal.ai, OpenRouter and RevenueCat, are based in or process data in the United States, so your photos and purchase information may be processed there. When personal data from the EU, EEA or UK is transferred to the US, we rely on the safeguards our providers offer under GDPR Chapter V, in particular the European Commission's Standard Contractual Clauses (with the UK Addendum or International Data Transfer Agreement for UK data) or, where a provider is certified, the EU–US Data Privacy Framework.
15. If you are in the EU, EEA or UK
The EU General Data Protection Regulation (GDPR) and the UK GDPR give you specific rights. The controller is LilGroup; see Contact us.
Our legal bases
| Purpose | Legal basis |
|---|---|
| Processing your selfie and haircut photo to make the looks, strips, views and notes you ask for | Performance of our contract with you (Art. 6(1)(b) GDPR). We do not process them to identify you, so they are not used as biometric data. |
| Purchases, checking your plan and counting looks | Performance of our contract with you (Art. 6(1)(b)) |
| Request counters, duplicate checks and logs to prevent abuse and keep the service working | Our legitimate interest in running a secure, fair service (Art. 6(1)(f)) |
| Answering support emails | Our legitimate interest in helping you (Art. 6(1)(f)) |
Your rights
You have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. To use these rights, email oscar.lehuu@gmail.com and, if you can, send it from the app's help email (Settings, then Help and feedback) or include a look ID, so we can find your records. We will reply within one month.
You also have the right to complain to your local data protection authority. In the UK this is the Information Commissioner's Office (ICO).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Representatives
LilGroup is established in Australia. It contracts directly with its processors and has not appointed separate EU or UK representatives at this stage. Contact us using the details below for any GDPR request.
16. If you are in California (US)
This section is our notice under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). We provide it as good practice; LilGroup is a small business and may not meet the CCPA's applicability thresholds, but we apply the same choices to everyone.
Categories we collect, and the sources and purposes described above:
- Identifiers: a random install ID; your IP address in per-minute request counters, deleted within 24 hours; your email address if you contact us.
- Commercial information: App Store purchase and subscription status.
- Visual information: your selfie and haircut photos, processed to make looks and not stored on our server.
No sale or sharing. We do not sell your personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16. We use personal information only to provide the features you ask for.
Your rights. You may ask to know what personal information we have collected about you, to delete it and to correct it. We will not discriminate against you for using these rights. Email oscar.lehuu@gmail.com; an authorised agent may also make a request on your behalf. Because we have no accounts, we may need a look ID (the app's help email includes it) to find your records.
Retention: see How long we keep data.
17. If you are in Australia
We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). LilGroup is a small business and may fall under the Act's small-business exemption, but we choose to follow the APPs regardless.
Some providers are overseas, mainly in the United States (see International transfers). We choose providers that protect information to a standard similar to the APPs.
You can ask to access or correct your personal information, or make a privacy complaint, by emailing oscar.lehuu@gmail.com. We aim to respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
18. Changes to this policy
We may update this policy when the app or the law changes. We will change the "Last updated" date above and, for important changes, tell you in the app. If a change affects how we use your photos, we will ask for your agreement again where the law requires it.
19. Contact us
Nghia Le, trading as LilGroup
7 King Street, Prospect, South Australia 5082, Australia
Phone: +61 414 603 198
Email: oscar.lehuu@gmail.com