Privacy Policy

1. Who we are

This Privacy Policy applies to the Tonalia app for iPhone and iPad (the “App”), developed by Jesús Cruz Suárez (“we”, “us”), who is responsible for the processing of your personal data. If you have any question or request about your data, write to cruzsuarezjesus@hotmail.com.

By using the App you acknowledge that your information is handled as described here. If you don’t agree, please don’t use the App.

2. What never leaves your device

The most personal parts of Tonalia work entirely on your device. We never receive them:

• Your selfie. It is analyzed with Apple’s on-device frameworks to read the tones of your skin, eyes and hair and find your season. The photo is saved only inside the App’s protected storage on your device so you can try on makeup and colors. It is never uploaded to our servers or to any AI service.
• Face points and makeup try-on. Face points, face shape and every makeup look are calculated and drawn on your device. See Face data for everything the App does with your face.
• Your closet on the free plan. Without Premium, photos of your clothes stay on your device.
• Your makeup bag on the free plan. Without Premium, your products, their colors and their photos stay on your device. The color of each product is always measured on your device.
• “Going shopping?” photos. A photo of a garment in a store is read on your device; at most its type and color (as text) are used by the AI features described below. The photo itself is not uploaded.
• Reminders. Notifications such as “your free trial ends tomorrow” are scheduled locally on your device. We don’t use push notification servers.

The App asks for permission before using the camera, your photo library or notifications. You can change these permissions at any time in Settings › Tonalia.

3. Face data

This section explains everything the App does with your face. Here, “face data” means your selfie and everything the App measures from it.

What face data the App uses

• Your selfie: the photo you take or choose for the color analysis.
• Face position and points: Apple’s Vision framework finds your face in the selfie and the outline of your eyes, brows, lips and jawline, so the App knows where to read colors and where to draw makeup.
• Color measurements: the colors of your skin, eyes, hair and brows, read from the selfie.
• Results calculated from them: your season, undertone, contrast, three color numbers (temperature, value and chroma), your eye and hair color, and a face-shape label such as “oval”.

When you photograph a garment, the App also detects any face in that photo only to cut the person out, so that only the garment is kept.

What we use it for: only to find your colors, show colors and makeup on your own photo, and give you tips for your face shape. We don’t use face data to recognize or identify you, we don’t create a faceprint or any biometric template, we don’t use Face ID or face tracking, and we never use face data for advertising, marketing, tracking or to train AI models. We never sell it.

Where it is stored and for how long

• Your selfie is stored only on your device, in the App’s private storage with iOS data protection. It is never uploaded to our servers or to any third party. It stays there until you retake the analysis (the new selfie replaces it), delete your account or uninstall the App. A selfie you take in the makeup try-on is kept only in memory and is discarded when you leave that screen.
• Face points are calculated in memory each time they are needed and are never saved.
• Color measurements and the face-shape label are saved on your device together with your analysis.
• Your results (season, undertone, contrast, the three color numbers, and eye and hair color) are also saved on our servers at Supabase, linked to your anonymous account, to personalize the App and let you recover it on another device. They are kept while your account exists. The selfie, the face points and the face-shape label are not saved on our servers.
• If you use iCloud Backup, your device’s backup may include the App’s files, including your selfie. That backup is made by iOS and kept by Apple in your own iCloud account; we have no access to it.

Who it is shared with: your selfie, your face points and your color measurements are never shared with anyone, including AI services. Supabase stores the results listed above as our service provider. Only with Premium, when you ask “Ask Tonalia” a question, your undertone, contrast and face-shape label are sent as words, together with your season, to OpenRouter and Google’s Gemini to write the answer, without your account ID (see How the AI features work).

How to delete it: Retake analysis replaces your selfie. Profile › Delete account and data deletes your selfie and color measurements from your device and your results from our servers immediately. Uninstalling the App deletes all face data on your device.

4. Your anonymous account

When you first open the App, it creates an anonymous account identified by a random ID. We don’t ask for your name, email or phone number.

You can optionally save your account with Sign in with Apple to recover it on another device. We don’t request your name or email from Apple; Apple only gives us a stable identifier that is unique to Tonalia.

5. Information we collect and why

Only the following information reaches our servers, linked to your anonymous account ID:

• Your onboarding answers: goal, occasion, age range, style, colors you feel comfortable with, garments, footwear, fit, accessories, things you avoid, climate, eye and hair color, and the App’s language. Why: to personalize your palette, guide, outfits and answers, and to keep them if you change devices.
• Your analysis result: your season, undertone, contrast, three color numbers (temperature, value and chroma), your eye and hair color, and the date. Never the photo, the face points or the face shape (see Face data). Why: same as above.
• Your closet, only with Premium: cropped photos of the clothes you add, and their type, color and details. They are stored in private storage that only your account can access. Why: to create outfits with the clothes you own and sync your closet across devices.
• Your makeup bag, only with Premium: what each product is (for example a lipstick or an eyeshadow palette), the colors of its shades measured on your device, whether it is sheer or clear, its brand and shade name if you have them, and a cropped photo of the product (not of you). They are stored in private storage that only your account can access. Why: to tell you which products are yours, use them in your looks and answers, and keep your makeup bag if you change devices.
• Questions and AI answers, only with Premium: the questions you ask “Ask Tonalia” and the outfits generated for you, kept as a cache so the same request doesn’t have to be processed twice. If you attach a photo of a garment, we keep only a fingerprint of it (a hash) for that cache, never the photo. Why: to give you the answer and to keep the service fast and within fair-use limits.
• Feedback you send: your message, an optional screenshot you choose, and the App version, device model, iOS version, language and season. Never your email or your selfie. Why: to fix problems and improve the App.
• Anonymous usage statistics: which screens of the App you open and which features you use (for example, the onboarding step you reached, the section you opened or whether you subscribed), with the App version, the country set on your device and whether you have Premium. They use a random code created by the App, are not linked to your account and never include your photos, colors, season, what you write, your email or your IP address. Why: to see where the App is confusing and which features to improve.
• Purchases: whether you have an active subscription or purchase, and its history, provided by Apple through RevenueCat. We never see your payment card or Apple ID details. Why: to unlock what you paid for.
• Technical data: like any internet service, our providers process your IP address and basic request data (date, time, device type) to deliver each request, keep the service secure and prevent abuse.

We don’t collect your precise location, contacts, health data, browsing history or any data from other apps.

6. How the AI features work

Some Premium features use artificial intelligence: classifying the clothes you add to your closet, recognizing the makeup you scan, creating outfits and answering your style questions. For these, our server sends to an AI model only what that feature needs:

• to classify a garment: that garment’s cropped photo;
• to recognize a makeup product: the photo you take of it, to read what it is, its brand and shade name, and where its color is. Its color is then measured on your device. The AI provider doesn’t keep the photo; if you add the product to your makeup bag, we store only its crop in your account, as described above;
• to create outfits or answer a question: a text description of your season, your style answers, your closet (types and colors, not photos) and your makeup bag (type, brand, name and color of each product, not photos), and your question; to answer a question, also your undertone, contrast and face-shape label as words (for example “warm”, “high” or “oval”);
• to give you an opinion on a garment you photograph in “Ask Tonalia”: that garment cut out on your device (without the background or any person), its color and your question. It is used only to answer and is not stored.

Your selfie, your face points and the colors measured on your face are never sent to an AI service. The requests go through OpenRouter, which forwards them to the model provider (currently Google’s Gemini). They process the content to return the answer under their own terms. We don’t send your account ID, name or email with these requests, and we don’t use your data to train AI models.

We tell you before you subscribe. The subscription screen says, next to the button, that Premium uses third-party AI and that your selfie stays on your device. The providers are named above and in the Terms of Use. Content is sent only when you use one of these features, such as adding clothes to your closet or scanning a product with Premium, creating outfits or asking a question. If you don’t want it sent, don’t use those features; your palette, makeup and analysis keep working on your device.

AI answers can be imperfect. Color and style recommendations are a guide, not a professional or medical opinion.

7. Who helps us run the App

We share data only with the service providers we need to run Tonalia. They process it on our behalf, under contracts and privacy commitments that protect it:

• Supabase: hosts our database, private file storage and server functions, and manages the anonymous account and Sign in with Apple.
• RevenueCat: manages subscriptions and purchases. It receives your anonymous account ID and your purchase history from Apple.
• OpenRouter and the AI model provider (Google): process the content of AI features, as described above.
• PostHog: receives the anonymous usage statistics described above, on servers in the United States, and is set up to discard your IP address.
• Apple: processes payments through the App Store and, if you use it, Sign in with Apple.

Some illustrations in the App are generated in advance with an image service; no personal data is used for them.

We don’t sell your personal data, we don’t share it for advertising and we don’t transfer it to data brokers. We may disclose information if the law requires it, or to protect the rights and safety of our users.

8. No advertising and no tracking

Tonalia has no advertising and no advertising or tracking SDKs. The only analytics are the anonymous usage statistics described above, which stay with us. We don’t track you across apps or websites owned by other companies, and we don’t link your data with third-party data for advertising. For this reason the App doesn’t show Apple’s “Allow tracking” prompt.

9. Legal bases for processing

If you are in the European Economic Area, the United Kingdom or a place with similar laws, we process your data on these bases:

• Performance of a contract: to provide the App, your account, your purchases and the features you use.
• Consent: for the camera, photo library and notifications, and for content you choose to send us (closet and makeup bag photos, feedback, screenshots). You can withdraw it at any time.
• Performance of a contract also covers sending content to the AI service when you use a Premium AI feature, because that is how the feature works.
• Legitimate interests: to keep the service secure, prevent abuse, enforce fair-use limits and improve the App from the feedback you send and the anonymous usage statistics. You can object by writing to us.
• Legal obligations: to keep purchase records required by tax and accounting laws.

10. How long we keep data and how to delete it

We keep your data while your account exists. You can erase it yourself at any time:

• Delete your account and data: in the App, open your profile (your photo at the top of “My palette”) › Delete account and data. This immediately deletes your account, your answers, your analysis results, your closet and its photos, your makeup bag and its photos, your outfits, cached answers and the feedback linked to your account from our servers, and removes your data from your device.
• Delete a garment: removing it from your closet deletes its photo.
• Delete a product: removing it from your makeup bag deletes it and its photo from your device and your account.
• Usage statistics: they aren’t linked to your account, so we can’t find them to delete them. PostHog keeps them for up to one year.
• Your selfie: it stays only on your device until you retake the analysis, delete your account or uninstall the App (see Face data).
• Uninstall the App: deletes everything stored on your device, including your selfie. If you haven’t deleted your account, the information on our servers is kept so you can recover it with Sign in with Apple; write to us if you want it deleted.

Deleted data may remain for a short time in our providers’ encrypted backups until they are overwritten. Purchase records are kept by Apple and RevenueCat as required by law. Deleting your account does not cancel your subscription: cancel it in Settings › your name › Subscriptions.

You can also ask us to delete your data by writing to cruzsuarezjesus@hotmail.com.

11. Your rights

Depending on where you live, you have the right to access your data, correct it, delete it, receive a portable copy, object to or restrict its processing, and withdraw your consent. Residents of California and other U.S. states have the right to know, delete and correct their data, and to not be discriminated against for exercising these rights. We don’t sell or share personal information as those laws define it.

To exercise any right, write to cruzsuarezjesus@hotmail.com. Because your account is anonymous, we may ask you to also send your request from the App (Profile › Help us improve), so we can find the data linked to your account. We’ll answer within 30 days. You also have the right to lodge a complaint with your local data protection authority.

12. Security

We protect your data with encrypted connections (HTTPS), access rules that only let your account read and write its own data, private file storage, and server-only keys that never ship in the App. On your device, your selfie and data are stored with iOS data protection. No system is 100% secure, but we work to keep your information safe and to collect as little as possible.

13. International transfers

Our providers may process data on servers in countries other than yours, such as the United States. When that happens, we rely on the safeguards they offer, such as the European Commission’s Standard Contractual Clauses, so your data keeps an equivalent level of protection.

14. Children

Tonalia is not directed to children under 13, and we don’t knowingly collect personal data from them. If you are under the age required in your country to consent to the processing of your data, use the App only with the permission of a parent or guardian. If you believe a child has given us personal data, write to cruzsuarezjesus@hotmail.com and we will delete it.

15. Changes to this policy

If we change how the App handles your data, we’ll update this page and the “Last updated” date. If the changes are significant, we’ll let you know in the App before they take effect.

16. Contact

For any question about this policy or your data: cruzsuarezjesus@hotmail.com. You can also send us feedback from the App: Profile › Help us improve.