Privacy Policy

GlowTira is developed and operated by Ali Mert Güleç, an independent developer based in Türkiye, who is the data controller for the personal data described here (the “data controller” under Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”) and, where it applies, the EU/UK GDPR).

Contact for any privacy question or request: info@alimertgulec.com.

Users in Türkiye: the Turkish KVKK information notice (Aydınlatma Metni) and explicit consent text (Açık Rıza Metni) are published at glowtira.app/tr/kvkk and glowtira.app/tr/acik-riza and are also available in the app.

• Account data — an anonymous account ID created when you first open the app. No email or phone number is needed. If you add a display name, we store it. If you sign in with Apple (when offered), Apple may share your name and a private-relay email address with us.

• Photos you choose to scan or preview — face, outfit, hand and optional reference photos — and the AI-generated preview images made from them.

• Analysis results — your scores, face shape, measurement ratios, the three suggested improvements and your progress over time.

• Onboarding answers — gender, age range, goals and a self-rated confidence level, used to personalise scoring and advice.

• Conversations with Lumi, the AI coach, and the short notes Lumi keeps to remember your preferences (you can review and delete them in Profile → What Lumi remembers).

• Diary entries — mood, skin notes, products used and any photos you add. Skin notes may reveal information related to your health; we treat them with the same care as sensitive data.

• Subscription status — whether you have Glow+ and when it renews or expires, received from Apple via RevenueCat. We never see your payment card.

• Referral data — your invite code and whether an invite was redeemed.

• Technical and security data — app version, device model and OS, language, time zone, push-notification token, request logs without content, and your IP address, which we use briefly to prevent abuse and rate-limit anonymous requests.

• Product analytics — in-app events such as “scan completed” or “paywall viewed”, linked to your anonymous account ID, used to improve the app.

• Advertising measurement — the Meta (Facebook) SDK records that the app was installed and opened, and events such as completing onboarding, viewing the paywall and subscribing (product and price), so we can tell which of our ads work. If you allow tracking in Apple’s “Allow Tracking” prompt, the SDK may also use your device’s advertising identifier (IDFA); if you decline, it does not, and Meta receives only the limited, aggregated signals Apple permits. You can change this any time in iOS Settings → Privacy & Security → Tracking. Meta never receives your photos, scores, coach conversations or diary.

We do not collect your precise location, contacts, or photos you have not chosen to upload.

• Face photos are used only to produce your scores, suggestions and the previews you ask for. They are never used to identify you, to recognise you in other images, or to build a biometric template, and they are never shared with advertisers or data brokers.

• Because face images can be sensitive, we ask for your explicit consent before any photo leaves your device, and we keep the photo only in your private storage until you delete it or your account.

• The AI services that process your photos do so on our instructions for your request only. We do not permit them to use your photos to train their models.

• To provide the app you asked for — create your account, run scans, generate previews, answer your coach messages, keep your diary and history, and deliver notifications you enabled (performance of our contract with you).

• To process face photos, coach conversations and health-related diary notes with AI, and to transfer them to the service providers listed below (your explicit consent, which you can withdraw at any time).

• To manage subscriptions, apply free-plan limits and referral rewards (performance of contract).

• To keep the service secure, prevent fraud and abuse, fix errors and improve the product with aggregated analytics (our legitimate interests, balanced against your rights).

• To meet legal obligations, respond to lawful requests from authorities and establish or defend legal claims (legal obligation / legitimate interests).

We use a small number of service providers (“processors”) that act only on our instructions:

• Supabase, Inc. — database, file storage, authentication and server functions. Data is hosted on AWS in Ireland (EU, eu-west-1).

• OpenAI, L.L.C. (USA) — scores your photos and writes coach replies and diary insights. Requests go through our own Cloudflare proxy, so OpenAI does not receive your account ID. Under OpenAI’s API terms, API data is not used for training and may be retained for up to 30 days for abuse monitoring, then deleted.

• Features & Labels, Inc. (fal.ai, USA) — generates hairstyle, beard, makeup, nail, glasses, bandana, tattoo and piercing previews from the photo you choose. Results are copied into your private storage.

• Cloudflare, Inc. (global network) — secure proxy between our servers and OpenAI.

• RevenueCat, Inc. (USA) and Apple — subscription purchase, renewal and status. Apple processes payments.

• Apple Push Notification service and Expo (650 Industries, Inc., USA) — deliver push notifications you enabled.

• Meta Platforms, Inc. and Meta Platforms Ireland Ltd. — advertising measurement as described in section 2 (app installs, opens, onboarding, paywall and subscription events). Meta processes this data under its own Data Policy as an independent controller for its advertising services.

We do not sell or rent personal data, and we never share your photos, scores, chats or diary with advertisers, data brokers or anyone for marketing.

Your data is stored in the EU (Ireland) and some of it is processed in the United States by the providers above. When data leaves Türkiye or the EEA/UK, we rely on the safeguards the law provides — standard contractual clauses or KVKK standard contracts where available, and your explicit consent for transfers that need it. You can ask us for details of these safeguards at any time.

• Photos, results, previews, coach conversations, Lumi’s notes and diary entries: until you delete them or delete your account.

• When you delete your account (Profile → Delete account), your photos are removed from storage and your account and all linked records are deleted immediately. Encrypted backups roll over and are fully cleared within 30 days.

• Raw analytics events: 30 days, after which only aggregated, non-identifying counts remain.

• Abuse-prevention counters keyed by IP address: up to 7 days.

• Push tokens: until you sign out, disable notifications or the token stops working.

• Records we must keep by law (for example, correspondence about a legal request): only as long as the law requires.

• Delete everything in one tap: Profile → Delete account.

• Review and delete what Lumi remembers: Profile → What Lumi remembers. Clear a chat from the coach screen.

• Turn notifications and the rescan reminder on or off in Profile → Notifications.

• You may ask us to tell you whether we process your data and for what purpose, to give you a copy, to correct it, to delete it, to restrict or object to certain processing, to port it to another service, and to know which providers receive it. You may withdraw your consent at any time; this does not affect processing done before withdrawal.

• Send requests to info@alimertgulec.com. We may ask you to confirm the request from inside the app so we can verify it is your account. We reply within 30 days, free of charge.

• You also have the right to complain to a data-protection authority — in Türkiye, the Personal Data Protection Authority (KVKK); in the EU/UK, your local supervisory authority.

Data is encrypted in transit (TLS) and at rest. Photos sit in a private storage bucket protected by row-level security so only your account can reach them; files are served through short-lived signed links. AI and payment secrets never ship inside the app, and access to production systems is limited to the developer. If a breach affecting your data ever occurs, we will notify the authority and you as the law requires.

GlowTira is for adults aged 18 and over. The app asks for your age range during onboarding and blocks use under 18. If you believe a minor has used the app, write to info@alimertgulec.com and we will delete the data.

We will update this policy when the app or the law changes. The effective date above will change, and we will tell you in the app about significant changes — and ask for your consent again where the law requires it.

Ali Mert Güleç — info@alimertgulec.com