Picvana Privacy Policy

1. Information we process

Photos and instructions you submit. When you start an edit, the photo you chose or took (resized on your device, at most about 2048 px on the long side) and any short text instruction you typed are uploaded over an encrypted connection (HTTPS). They are used only to produce the result you asked for.

A random device identifier. On first launch the App creates a random ID (a UUID) that is not linked to your name, phone number or advertising ID. We use it to count your free allowance and subscription usage, to prevent abuse and to match your purchases.

Usage records. For each edit our server keeps the request ID, the device identifier, the edit mode, the number of images, a timestamp and whether it succeeded, so that allowances are counted correctly and failed edits are refunded. Our server logs record the same kind of technical metadata (mode, template version, result count, duration, error code, cost). They never contain your photo or the text you typed.

Network address. Your IP address is used in memory to limit request rates. Only a keyed hash of it, using a key that changes every day, is stored together with a daily counter, and it is deleted after that day.

Purchases. Subscriptions are sold by Apple (App Store) or Google (Google Play); we never receive your payment card details. We use RevenueCat to verify your subscription status. The App's device identifier is used as your RevenueCat user ID, and RevenueCat receives the store's purchase records and basic device information (such as the OS version and the App version).

Reports you send. If you report an AI result, we receive the reason you chose, the edit mode, the template version and any note you typed. The photo is not sent with a report.

Email. If you write to us, we receive your email address and what you write, and use them only to answer you.

2. Information that stays on your device

Your edit history (the original photo and its results) is stored only inside the App on your device. Entries are deleted automatically after 30 days or once there are more than 100 of them, and you can delete any entry or clear the whole history at any time in the App (Settings → Clear history). Images you save go to your photo library and are under your control.

The App asks for camera access only to take a photo inside the App, and uses the system photo picker to let you choose a photo. Saving a result asks for permission to add it to your photo library.

3. AI processing and who receives your data

Cloudflare, Inc. hosts our server (Cloudflare Workers) and processes requests on our behalf.

xAI (the Grok image model) receives your photo and the instruction through our API gateway and returns the generated image. Under its API terms it may keep request data for a limited time for security and abuse monitoring. We do not send it your device identifier or any other information about you.

RevenueCat, Inc., Apple and Google process subscription and purchase data as described above.

We do not sell your personal information, do not share it for advertising, and do not use your photos to train AI models. We may disclose information if the law requires it.

4. Cross-border processing

Our server and our service providers operate in several countries, including the United States, so your information may be processed outside the country or region where you live (including outside mainland China). We only transfer what is needed for the purposes above, over encrypted connections, to providers bound by contract to protect it. By using the AI features after the in-app notice, you agree to this processing.

5. How long we keep information

Photos and text instructions: not stored on our servers; they exist in memory only for the time it takes to process the request. Usage counters and the device identifier: kept as long as needed to honor your free allowance and subscriptions, and deleted when you ask us to. Request records are trimmed to the most recent 50 per device. Hashed network addresses: deleted daily. Server logs: kept for a few days by Cloudflare. Reports: we keep the latest 2000. Support emails: as long as needed to handle your request.

6. Legal basis and your consent

We process your photo only after you agree to AI processing in the App; you can withdraw this at any time in Settings (AI photo processing), after which no photo is uploaded. Other processing is necessary to provide the service you requested and the subscription you bought, to comply with law, or is based on our legitimate interest in preventing abuse.

7. Your rights

Depending on where you live, you may ask to access, correct, delete or obtain a copy of your personal information, to withdraw consent, or to object to or restrict processing. Local data can be deleted directly in the App or by uninstalling it. For server-side data (usage counters linked to the device identifier), email us at support@cyofun.com with the device ID shown in Settings; we will verify and respond within 15 working days. Step-by-step instructions and what gets deleted: Delete your data. Subscriptions can be cancelled in your App Store or Google Play account. You may also complain to your local data protection authority.

8. Children

The App is not directed to children. Children under 14 (or the minimum age required in their country) should use it only with a parent or guardian's consent. We do not knowingly collect personal information from children; if you believe a child has sent us information, contact us and we will delete it. Do not upload photos of other people, including children, without the right to do so.

9. Security

We use encryption in transit, keep no copies of your photos, store only what is listed above, and restrict access to our systems. No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach as the law requires.

10. Changes and contact

We may update this policy; the effective date above will change, and significant changes will be announced in the App. Questions or requests: support@cyofun.com, CyoFun (Luoyang Chuangyou Interactive Information Technology Co., Ltd.), Luoyang, Henan Province, China.