Privacy Policy

Your photo is personal. We treat it that way.

Effective: September 19, 2026 · Version: 2026-09-19-openai-scan

This policy explains how Shiva Suthapalli, operating TressDNA (“TressDNA,” “we,” “us,” or “our”), handles information when you use the TressDNA mobile app and related services.

1. Who can use TressDNA

TressDNA is for adults aged 18 and over. It is not directed to children or teenagers. Do not create an account or submit a photo if you are under 18. If we learn that an under-18 user provided personal data, contact us and we will take reasonable steps to delete it.

2. Information we handle

Account information

Depending on how you sign in, Firebase Authentication may process your email address, phone number, Google account identifier, Firebase user ID, display name, profile photo URL, authentication tokens, and sign-in security information.

Photos, analysis results, and haircut previews

When you start a scan, the selected or captured photo is compressed on your device and sent through our authenticated Firebase Cloud Function to OpenAI's GPT-5.6 Luna model. It estimates visible face shape, visible hair type and length where clear, and short styling notes. When you request a haircut try-on using a welcome, referral, Premium daily, or rewarded-ad credit, the chosen face photo and the catalog haircut reference are sent through our authenticated service to OpenAI's GPT Image 2 model so it can generate an approximate preview. TressDNA does not use the photo for identity verification, face recognition, health diagnosis, attractiveness scoring, or genetic analysis.

We do not write the source photo or generated haircut preview to our Firebase database or cloud storage. The source photo is not saved by the app. After a successful try-on, the generated preview is saved in the app's private local Library and separated by Firebase user ID. Clearing app data or uninstalling removes the app's copy, but device backups may retain one according to your backup settings. OpenAI states that API data is not used to train its models unless the customer opts in, and that default abuse-monitoring logs may be retained for up to 30 days; the scanner requests are not stored as application state, and the image-edit endpoint does not retain application state. We do not opt in to share face-photo logs or datasets for model improvement.

Preferences and app content

Scan requests also include a pseudonymous safety identifier derived from your Firebase user ID to help OpenAI detect abuse. OpenAI may retain data longer where required by law or for safety review, including review of flagged image inputs. See OpenAI's API data controls for details. Disabling response storage does not eliminate abuse-monitoring retention.

Your selected style collection, favorites, recommendation goals, haircut feedback, scan corrections, latest analysis labels and notes, scan date, onboarding status, legal-consent version, and rewarded-scan credits are saved locally on your device and separated by Firebase user ID. Your selected collection, onboarding and legal-consent status, and latest analysis labels, notes, and scan date are also stored with your account in Firestore so they can be restored after clearing app data or reinstalling the app.

Try-on credits and referrals

Recommendation goals, haircut feedback, and scan corrections stay on this device, separated by Firebase user ID. They adjust your hairstyle rankings locally; corrections do not replace the original account-saved scan. A new scan clears its previous corrections. You can change your preferences and clear feedback in the app.

Try-on credit balances, daily credit claims, invitation codes, referral redemption records, and rewarded-ad credits are stored with your account in Firestore. We use these records to apply daily limits, award credits once, and restore your balance across devices. Copying an invitation does not give TressDNA access to your contacts.

Purchases

Apple or Google processes payment details. TressDNA and RevenueCat receive purchase and entitlement information such as product, subscription status, transaction environment, and a customer identifier based on your Firebase user ID. We do not receive your full card or bank details.

Advertising and device information

Google AdMob may process device identifiers, IP address, general location derived from IP, ad interactions, diagnostic information, and consent choices to deliver and measure rewarded ads. Where required, the app presents Google’s consent form before requesting ads. On iOS, tracking or access to the advertising identifier occurs only if you grant Apple’s App Tracking Transparency permission.

Technical information

Firebase, Google, OpenAI, RevenueCat, Apple, and Google Play may process IP addresses, device and app information, request times, error details, fraud signals, and service logs needed to operate and secure their services. TressDNA does not currently use a separate product-analytics or crash-reporting service.

3. Why we use information

• Provide authentication, face-photo analysis, AI haircut previews, hairstyle recommendations, favorites, purchases, and rewarded scans.
• Maintain subscription entitlements across devices and restore purchases.
• Prevent fraud and abuse, enforce daily analysis and try-on limits, diagnose errors, and protect the service.
• Comply with legal, accounting, store, and payment obligations.
• Deliver and measure ads where you have made the choices required by applicable law.

4. Legal bases for EEA and UK users

Where GDPR or UK GDPR applies, we rely on performance of our contract to provide requested app features; your consent for the specific face-photo processing and for advertising choices where required; our legitimate interests in service security, fraud prevention, and reliability; and legal obligations for transaction and compliance records. You may withdraw consent for future processing, but withdrawal does not make earlier lawful processing unlawful.

5. When information is shared

We share information only as needed with service providers and platforms that help run TressDNA:

• Google Firebase for authentication, Cloud Functions, and Firestore.
• OpenAI API for requested photo analysis and haircut previews.
• Google AdMob and User Messaging Platform for rewarded ads and privacy choices.
• RevenueCat for subscription and purchase-entitlement management.
• Apple App Store and Google Play for distribution, purchases, refunds, and store services.
• Authorities or professional advisers when reasonably necessary to comply with law, protect rights and safety, or handle a legal claim.

We do not sell your face photo or account contact information. Advertising partners may process identifiers for personalized advertising only where permitted and authorized through the available consent and platform controls.

6. Retention

• Source photos and generated previews: not saved in TressDNA’s Firebase Storage or Firestore. Source photos remain on your device according to your device settings. Completed previews are stored in the private local Try-on Library until app data is cleared or the app is uninstalled; device backups may retain a copy. OpenAI may retain API abuse-monitoring logs for up to 30 days by default; scanner requests are not stored as application state, and its image-edit endpoint does not retain application state.
• Account profile: retained while your account is active and deleted through the account-deletion flow, subject to limited backups and records we must keep by law.
• Local preferences and cached results: retained on the device until you delete the account, clear app data, or uninstall the app. Your latest account-saved analysis result remains until account deletion or replacement by a new scan.
• Purchase and fraud records: retained as reasonably needed for entitlements, disputes, tax, accounting, fraud prevention, and legal compliance. Deletion does not cancel an active store subscription.
• Service and request-limit records: retained only as long as reasonably needed for security, abuse prevention, troubleshooting, and cost control, then deleted or de-identified.

7. Your choices and rights

You can choose not to submit a photo. You can change advertising choices from the “Ad privacy choices” entry in Settings when required for your region. Device-level camera, photo, and iOS tracking permissions can be changed in system Settings.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data, and to appeal or complain to a regulator. Email cynodev256@gmail.com to exercise a right. We may need to verify your identity.

8. Account deletion

In the app, open Account → Delete account. This requests deletion of the linked RevenueCat customer, deletes your Firebase account and directly linked TressDNA profile, request-limit, and purchase-entitlement projection records, and clears the account’s local TressDNA preferences. Some transaction, security, or de-identified records may remain where legally permitted or required. Store subscriptions must be cancelled separately through Apple or Google. You can also follow the instructions on our account deletion page.

9. International processing and security

Our service providers may process information in countries other than your own. Where required, they use recognized transfer mechanisms. We use encrypted network connections, authenticated endpoints, restricted secrets, and data minimization, but no system is completely secure.

10. Changes and contact

We may update this policy as the app or law changes. Material changes will receive a new version date and, where appropriate, renewed in-app acceptance. Questions or requests can be sent to cynodev256@gmail.com.