Privacy Policy

Last updated: 11 November 2026

Who we are

Balaya is made by 4Studios LLC in the United States (“we”, “us”). We decide how and why the personal data described here is used, so we are its controller.

This policy covers the Balaya app for iPhone and Android, our server at api.balaya.app, and the website balaya.app, including the short links we post on social media.

Contact: privacy@balaya.app.

What stays on your phone

• Your selfie. The app keeps one copy in its own storage, so it’s there next time. It stays until you take a new one, tap “Delete my photos”, or delete the app.
• Your hair profile (the result of the hair analysis), your quiz answers, the time you agreed on the consent screen, and your favourite and compared looks.
• Photo checks. Before a photo is used, the app checks it on your phone: the light, that there is one face, and the framing. It also marks where your hair is. This uses face and hair detection that runs only on your phone. The face points are never sent to us or stored. The hair outline is kept in the app’s temporary files until your next selfie and is sent with a look (see Photos you send).
• Looks and reference photos. Rendered looks and the reference photos you pick are held in the app’s memory while it’s open. They’re only saved if you save or share them.
• Salon reminders are notifications scheduled on your phone. Nothing about them is sent to us.

Your phone’s own backup (iCloud or Google) may include this app data, under Apple’s or Google’s terms. Images you save go to your photo library, and images you share go wherever you send them.

What we receive, and why

Photos you send for a result

When. Only when you ask for a hair analysis, try a look, or use “Copy a look”, and only after you have agreed on the consent screen.

What is sent. Your phone first makes a copy of the photo no larger than 1024 pixels and removes its location and other photo metadata. Then it sends:

• Hair analysis: your selfie and, if you answered it, your hair texture from the quiz.
• A look: your selfie, the look and colour you chose (as catalogue codes), your hair texture, and the hair outline made on your phone, when there is one.
• Copy a look: your selfie and the reference photo you chose.

What happens to it. Our server passes the photos to the AI providers listed below and sends the result back to your phone. Photos are held in our server’s memory only while your request runs. We don’t write them to storage or to our logs, and we don’t keep the analysis or the rendered looks.

The hair analysis describes your face shape, hair type and pattern, hair density, skin undertone, whether you wear glasses or a head covering (so a covering is always left as it is), suggested cuts and colours, and stylist notes. It goes to your phone only. It also says whether the person in the photo may be under 18. That one answer is the only part we keep on our server: if it is yes, looks can’t be made for this copy of the app (see Children).

The safety check. Before each look, an AI model checks that your photo shows one person, with the face visible, clothed, and who appears to be an adult. For “Copy a look”, it also checks that the reference photo shows hair, has no sexual content, and doesn’t appear to show a child. If a check fails, the look isn’t made and isn’t counted. So that the same selfie isn’t checked again for every look, we keep a fingerprint of it (a SHA-256 hash, which can’t be turned back into the photo) together with the result, until it hasn’t been used for 30 days, and at most 32 per copy of the app. Reference photos are checked every time and no fingerprint is kept.

Legal basis: providing the service you ask for (our contract with you) and your consent on the consent screen. The safety check and the under-18 answer rely on our legitimate interest in keeping Balaya safe and lawful, in particular in preventing sexual images and images of children.

You can withdraw your consent at any time: stop sending photos and tap “Delete my photos”. This doesn’t affect results already made.

AI providers

We use AI service providers to run the models that read your photo, check it and render your looks. They process photos on our behalf, under contract, only to produce the result you asked for. They are based in the United States and the European Union. We may change providers or models; what they receive and why stays as described here. To get the current list of providers, email privacy@balaya.app.

We don’t send your name, your app ID or your purchase details to these providers, only the photos and instructions needed for the result.

We don’t use your photos, hair profile or looks to train AI models, and we don’t allow our AI providers to use them to train theirs. Under their terms, a provider may keep a request for a limited time to detect abuse or to meet legal duties, and then deletes it.

Purchases

RevenueCat, Inc. (United States) manages subscriptions and look packs for us. The app creates a random, anonymous ID for your copy of Balaya (the “app ID”). RevenueCat receives it together with your purchase details (product, price, store country, purchase, renewal, cancellation and refund dates), your phone model, system and app version, and your IP address, so that purchases can be unlocked and restored. When the paywall is shown, RevenueCat may also record that it was shown and which plans it offered.

All payments are made through the App Store or Google Play. Apple and Google handle the payment; we never see your card, your name, or your Apple or Google account.

RevenueCat tells our server when a purchase, renewal, cancellation or refund happens. From that, our server keeps your plan and when it ends, your store country (it sets how many looks a week your plan includes), and your look balance.

Legal basis: our contract with you, and our legal duties for tax and accounting.

Looks, limits and abuse prevention

To count your looks, keep your balance and stop misuse, our server keeps the following, linked to your app ID:

• your plan, when it ends, and your store country;
• how many looks you used this week and today, and your look balance;
• whether the hair analysis that comes without a purchase has been used, and the under-18 answer from the analysis;
• a list of your recent look requests, without any images, so a failed look is given back and no look is charged twice;
• the times of your last requests, for 60 seconds, to limit how fast requests can be sent;
• the IDs of purchase events from RevenueCat, so none is applied twice;
• the photo fingerprints from the safety check.

Device checks. When the app connects, it may send a token from Apple App Attest or Google Play Integrity, which shows the request comes from a genuine copy of Balaya on a real device. We use it only to prevent abuse, such as reinstalling the app to get another analysis. We don’t store the token.

IP address. Cloudflare, which runs our server, receives your IP address with every request. We use it only to limit how many requests one network can send, in the form of a code that changes every day. We don’t store or log your IP address.

Legal basis: our contract with you (applying the limits of your plan) and our legitimate interest in keeping the service available, fair and secure.

Server logs

For each request, our server writes one log line: the time, the kind of request, a pseudonymous code made from your app ID, your plan and store country, which AI model answered, how long it took, whether it worked and why not, an estimate of the AI cost, and the app version. Logs never contain photos, look instructions, analysis results or IP addresses. They are kept by Cloudflare for up to 7 days.

When something goes wrong, such as a provider failing or the daily spending limit being reached, our team gets an alert with counts and error codes only, never personal data.

Legal basis: our legitimate interest in running, fixing and protecting the service and controlling its cost.

Where you heard about Balaya

We want to know which of our social media accounts bring people to Balaya. We do this without advertising IDs, third-party tracking tools, fingerprinting or your clipboard.

• Google Play link: if you install Balaya on Android through one of our links, Google Play tells the app which of our accounts, and which look, the link came from. The app reads this once, on first launch.
• “How did you hear about us?”: an optional quiz question with fixed answers.

This goes to our server, which records it with the pseudonymous code and your platform (iPhone or Android) in Cloudflare’s analytics storage, where it is kept for 3 months. It also goes to RevenueCat with your app ID, so we can see which accounts lead to purchases.

Legal basis: our legitimate interest in understanding which of our posts work. You can skip the question.

Reports about a result

If you use “Report this result”, we receive the reason you picked, the code of that look request and the pseudonymous code made from your app ID. The app doesn’t send the image. We keep reports until you ask us to delete them, or until you tap “Delete my photos”.

Legal basis: our legitimate interest in fixing bad results and meeting app store rules for AI content.

This website and our short links

Cloudflare hosts balaya.app and processes your IP address and browser details to deliver pages and block attacks. Cloudflare Web Analytics also counts page visits and page speed for us, without cookies and without storing your IP address. There is no advertising on this site.

We use Google Analytics to see how people use this site: the pages they open, the sections they reach, the questions they open, the language they pick and whether they tap a store button. Google Analytics sets cookies (_ga and _ga_…, up to 13 months) and receives your IP address, which Google uses to estimate your country and city and doesn’t store, plus your browser and device type. In the EU, the EEA, the UK, Switzerland and Türkiye it starts only after you tap “Allow”. Elsewhere it runs unless you turn it off. Either way, “Cookie settings” at the bottom of every page changes your choice, which your browser remembers. Google signals and ad personalisation are off, and Google keeps this data for 14 months.

Legal basis: your consent where the law requires it; otherwise our legitimate interest in improving the site.

The lang cookie remembers the language you pick, for one year. It’s needed for the site to work as you asked and isn’t used for tracking. On your first visit, we use your browser language (or, if that doesn’t match one of ours, your country) only to choose the page language; it isn’t stored.

The download links on this site and in our social profiles send you to the App Store or Google Play based on your device. Some of our short links also count the click: we record the account and look in the link, the type of device (iPhone, Android or other) and the country, which Cloudflare works out from your IP address. We don’t record your IP address, browser details, the page you came from, or set a cookie.

If you arrive through a link with a campaign tag, for example from one of our posts, the store buttons pass that tag on to the App Store or Google Play, so we can see which posts lead to downloads. Nothing about you is added to it.

Legal basis: our legitimate interest in running the website and measuring which links work.

Emails to us

If you email us, we use your address and your message to answer you. If you send an order ID from Apple or Google, we use it only to find your purchase.

Legal basis: our legitimate interest in answering you, or our contract with you when it’s about a purchase.

Service providers

Besides the AI providers, these companies process data for us:

We don’t sell your personal information, and we don’t share it for advertising. We only give it to others if the law requires it, to protect people’s safety or our rights, or as part of a sale or merger of our business, in which case this policy keeps applying to it.

How long we keep data

• Your photos: not stored by us; held in memory only while your request runs. AI providers may keep a request for a limited time under their terms (see AI providers).
• Hair analysis and looks: not stored by us; only on your phone.
• Photo fingerprints from the safety check: deleted once unused for 30 days (removed the next time a check is saved), and at most 32 kept.
• Look requests (no images): 30 days. Older ones are removed the next time you request a look.
• Request times for rate limits: 60 seconds.
• Purchase event IDs: 90 days. Older ones are removed when the next purchase event arrives.
• Plan, store country, look counts and balance, and the under-18 answer: for as long as you might use Balaya or restore a purchase.
• Server logs: up to 7 days in Cloudflare’s logs.
• Website statistics: 14 months in Google Analytics.
• Where you heard about Balaya: 3 months on our side; at RevenueCat, as long as RevenueCat keeps your purchase record.
• Reports: until you ask us to delete them.
• Emails: as long as needed to help you.
• Purchase records: as long as needed for your purchases and for tax and accounting rules.

Your choices and rights

Delete my photos

In Profile, “Delete my photos” removes your selfie, your hair profile and any reference photo from your phone. It also deletes from our server your look requests, photo fingerprints, request times, purchase event IDs and reports.

It keeps your plan and your look balance, so you don’t lose what you paid for, and the under-18 answer, which a new hair analysis replaces. It doesn’t remove the server logs or the record of where you heard about Balaya; those are deleted at the end of the periods above. Deleting the app removes everything that was stored on your phone.

Requests by email

To access your data, correct it, delete what “Delete my photos” keeps, or use any other right below, email privacy@balaya.app. Because Balaya has no accounts, we may ask for details that let us find your data, such as an Apple or Google order ID. We answer within one month, or sooner where the law requires.

EU, EEA, UK and Switzerland

You have the right to access your data, to have it corrected or deleted, to restrict how we use it, to get a copy in a portable format, to object to uses based on our legitimate interests, and to withdraw your consent at any time. You can also complain to your local data protection authority.

The safety check and the under-18 answer are automated. They only decide whether a look can be made from a photo. If you think one was wrong, email us and a person will look at it.

California and other US states

In the last 12 months we collected these categories of personal information, for the purposes and periods described above:

• Identifiers: the app ID, the pseudonymous code made from it, device check tokens, and IP address (used, not stored).
• Commercial information: purchases and plans.
• Internet or other electronic activity: server logs, where you heard about Balaya, short link clicks and website statistics.
• Audio, electronic, visual or similar information: the photos you send, processed only to make the result.
• Inferences: the hair profile, which stays on your phone, and the under-18 answer.

We collect them from you, your device, Apple, Google and RevenueCat. We don’t sell or share personal information for cross-context behavioural advertising, and we haven’t done so in the last 12 months. We don’t use photos to identify anyone, and we don’t use sensitive personal information to infer characteristics about you.

You can ask to know, correct and delete your personal information, and you can use an authorised agent. We won’t treat you differently for using these rights. Residents of other US states with privacy laws have similar rights and can use them the same way.

International transfers

We are based in the United States. Our providers process data in the United States, the European Union and other countries.

When data from the EU, EEA, UK or Switzerland goes to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum and Swiss amendments), or on the provider’s certification under the EU–US Data Privacy Framework and its UK and Swiss extensions. Email us for more detail.

Children

Balaya is for adults aged 18 and over. Don’t use it if you are under 18, and don’t upload photos of anyone under 18.

If the hair analysis says the person in the photo may be under 18, looks can’t be made for that copy of the app. The safety check also refuses photos that appear to show a child. If you believe a child has sent us personal data, email us and we’ll delete it.

Security

Data sent between the app, this website and our server is encrypted in transit. Our server identifies you only by a pseudonymous code in logs and reports, keeps provider keys out of the app, and limits who on our team can reach the data.

Changes to this policy

If we change this policy, we’ll update this page and its date. If a change matters for how we use your photos, such as a new AI provider, we’ll update the list above before it starts, and tell you in the app about important changes.

Contact

privacy@balaya.app · 4Studios LLC, United States