Privacy Policy

Last updated: November 8, 2026 · Applies to the Lookstep iPhone app and this website · Contact: zitaystudios@gmail.com

1. Summary

• We use your selfie only to create the makeup look you ask for, and only after you agree.
• Your photo is sent securely to our AI provider, Google (Gemini API, paid service). We don't store your photo.
• We don't store your finished look on our server. It goes straight to your phone, and our server deletes it once it's delivered.
• Google may keep data from the request, including your photo and the result, for up to 55 days only to detect abuse. Google doesn't use it to train its models.
• Lookstep is only for adults 18 and over.
• We do not sell or share your personal information, and we do not use it for advertising. We never use your face to identify you.
• You don't need an account. Purchases are handled by Apple, and we never see your payment details.

2. Information we handle

• Your photo. The selfie you take with the camera or choose from your photo library. It passes through our server to our AI provider and is not written to our storage.
• Your finished look. The image the AI creates. We don't store it on our server. It is sent straight to your phone, and our server deletes it once it's delivered. If delivery fails, the look is returned to you automatically. On your device, the app keeps your photo and your looks inside the app (not in your Photos library) until you delete them.
• Install identifier. A random identifier created when you first open the app. Our server stores only a hashed version, linked to your subscription status and to the number of looks you've created. Our server also gives your install a separate random purchase identifier, which the app sends to Apple when you subscribe, so that Apple's messages about your subscription can be matched to your install. Neither is your name, email or Apple ID.
• Device checks from Apple. We use Apple's App Attest to confirm that requests come from the genuine app, and Apple's DeviceCheck to record, per device, whether the free look was used and whether a refund rule was already applied. DeviceCheck stores two yes/no values at Apple, with no photo and no name. These values stay with Apple even if you delete the app or ask us to delete your data, so that the free look is given only once per device. Only we can change them.
• Subscription records. When you subscribe, renew or tap "Restore Purchases", the app sends us the signed transaction from Apple, and Apple sends our server notifications when your subscription renews, expires, is refunded or is revoked. From these we keep: the original and the latest transaction ID, the product (monthly or yearly), whether it is a test (sandbox) purchase, when the current period ends, whether you are in the free trial, and whether Apple refunded or revoked it. Apple handles payment: we do not receive your name, Apple ID, email address or payment details.
• Look counts. To apply the look limits, we keep, for each look you create as a subscriber, its identifier, the time, whether it was during the free trial and which subscription it belongs to. We keep these for 31 days. A look that fails or isn't delivered is removed and doesn't count.
• Service logs. For each look: an identifier, the occasion you chose, the time, whether it succeeded or the error code, how long it took, the AI model, its estimated cost, and whether it counted toward your limits or was returned. Our logs never contain your photo or your look. Our hosting provider, Cloudflare, may process your IP address in its security logs. We use your IP address only briefly, in memory, to limit abuse.
• App settings on your device. For example, your language and your saved looks. These stay on your device.
• Support ID. A short code that starts with LS-, shown in the app under Settings > Support. It is made one-way from the random purchase identifier, so it can't be turned back into it, and it doesn't reveal your device or who you are. You need it when you contact support, for example about a look that failed or a subscription that doesn't show after "Restore Purchases".
• Emails you send us. We keep them so we can reply.
• Reports you send. If you report a look in the app, we keep the reason you pick from a list and any text you add (if the app offers a text field), with technical details about that look (such as the occasion, the AI model and the app version). A report contains no photo, neither your selfie nor the look, and no IP address. We keep reports for up to 180 days.
• Analytics. We do not use analytics, advertising or tracking tools.

Linked to you, not used for tracking. Your photo and finished look, your subscription records and look counts, the install identifier and the service logs (including which look you chose) are connected on our server through the hashed install identifier. For that reason we treat all of them as data linked to you, and we describe them that way in the App Store privacy label. We use them only to run the app, keep it secure and prevent fraud. We do not use any of it for tracking or advertising, and we do not combine it with data from other companies.

Face data. To check photo quality, the app counts faces and measures brightness and sharpness on your device using Apple's on-device tools. We do not create face templates or biometric identifiers, and we do not use your photo to identify you. The app does not use Face ID, TrueDepth or ARKit face data.

3. How your photo is processed

1. Before your first look, we ask you to confirm that you are 18 or older, that the photo is of you, and that you agree to send it for processing. If you don't agree, no photo is sent and we can't create a look. You can withdraw consent at any time: stop creating looks, and tap "Delete my photos" in Settings to delete the looks on your phone and any copy on our server.
2. Your photo is sent encrypted (HTTPS) to our server.
3. Our server sends it to Google's Gemini API (paid service), which applies the makeup and returns the result. Our server does not save your photo.
4. Our server sends the finished look straight to your phone and deletes it once it's delivered. It doesn't store it.
5. If a look fails or is blocked by a safety filter, nothing is kept and the try doesn't count.

Google processes the request under the Gemini API Additional Terms of Service for Paid Services (effective March 23, 2026). Under those terms, Google doesn't use the request or the result to improve its products. It logs them for a limited time, up to 55 days, only to detect and prevent abuse, keep the service safe and meet legal obligations. Google may store this data temporarily or cache it in any country where Google or its agents have facilities.

4. Why we use your information

• To provide the look you asked for, with your consent to send your photo.
• To check your subscription, apply the look limits and the once-per-device rules, give back a look that failed, prevent fraud and keep the service secure.
• To meet legal obligations, such as keeping purchase records.

If you are in the UK or the European Economic Area, our legal bases are your consent, the performance of our contract with you, our legitimate interests (security and preventing abuse) and legal obligations.

5. Who we share it with

We do not sell your personal information or share it for cross-context behavioral advertising. We share it only with:

• Google (Gemini API), our AI provider, to create your look;
• Cloudflare, which hosts our server (Cloudflare Workers);
• Apple, to process payments and subscriptions and to run App Attest and DeviceCheck. Our own server checks Apple's signed transactions; we don't use any other purchase-verification service;
• Google (Gmail), which hosts our support email inbox, for the emails you send us;
• authorities, when the law requires it.

6. Where it is processed

Your information may be processed in the United States and in other countries where our providers have facilities: Google may store or cache request data in any country where it or its agents have facilities, and Cloudflare runs our server in its data centers around the world. Where required, we rely on appropriate safeguards, such as standard contractual clauses.

7. How long we keep it

• Your photo on our server: not stored.
• Your finished look: not stored on our server. It is deleted once it's delivered to your phone.
• Your request at Google: up to 55 days, only to detect abuse.
• Service logs (no photos): 30 days.
• Reports you send from the app (the reason you pick and any text you add, no photos): up to 180 days.
• Look counts for the limits (no photos): 31 days.
• Hashed install identifier, Support ID, subscription records and fraud-prevention records: while you have an active subscription, and then for up to 2 years after your subscription ends, for accounting and fraud prevention.
• DeviceCheck values at Apple: until we reset them.
• Support emails: up to 12 months after your request is closed.
• Photos and looks on your device: until you delete a look, tap "Delete my photos" in Settings, or delete the app.

8. Your rights

Depending on where you live, you may have the right to know what information we hold about you, to access it, correct it, delete it or get a copy, to object to or restrict its processing, and to withdraw your consent at any time. This includes rights under the GDPR and UK GDPR, US state privacy laws such as California's CCPA/CPRA, Canada's PIPEDA and Australia's Privacy Act.

To make a request, email zitaystudios@gmail.com. We will reply within 30 days, and we won't treat you differently for using your rights. You can also complain to your local data protection authority. See Delete my data.

9. Adults only

Lookstep is only for people 18 and over. It is not directed at children or teenagers, and we do not knowingly collect their information. If you believe someone under 18 has sent us a photo, email us and we will delete what we hold.

10. Security

We use encryption in transit, restricted access and automatic deletion. No method of transmission or storage is completely secure.

11. This website

This website does not use cookies, analytics or trackers. Our hosting provider may keep standard server logs, such as IP addresses, for security.

12. Changes and contact

If we change this policy, we will post the new version here with a new date, and we will tell you in the app if the change is significant. Contact: zitaystudios@gmail.com