Privacy Policy

1. Information we process

We process only the information needed to operate the App, handle payments, provide export history, protect the service, and improve reliability.

• Your uploaded or captured photo, crop settings, AI-generated previews, final JPG files, and technical metadata needed to store and display them.
• An anonymous Firebase or similar App identifier connecting your device session with photo jobs, credits, and history.
• Product identifiers, purchase status, credit balance, transaction metadata from Apple, Google, or RevenueCat, and your RevenueCat app user ID. We do not receive your full payment card number.
• Basic analytics and diagnostics: App launches, screens, photo-flow progress, purchase events, function timing and outcomes, error categories, App version, platform, language, and general technical environment.
• Backend logs, including timestamps, request IDs, IP addresses, error messages, and security metadata.
• A country code estimated from your IP address or network headers when we check whether the service is available in Poland.

2. Photos and facial data

Photos may include your face. We process facial images only to create the result you request. We do not use FotoPobyt to identify you, compare faces, recognize people, perform surveillance, or create biometric templates.

We do not sell your photos, purchase data, or personal information.

3. How we use information

• uploading, cropping, previewing, exporting, saving, and sharing photos;
• generating AI results and displaying export history;
• processing purchases, credits, refunds, and restore requests;
• checking service availability for a country or connection;
• customer support, diagnostics, and reliability improvements;
• preventing fraud, abuse, and unauthorized access;
• meeting legal, tax, accounting, and platform obligations.

4. AI processing

FotoPobyt uses AI services to improve background, centering, lighting, composition, and visual clarity. AI output may contain errors or unexpected changes. You should review the preview and final export before using the file in any official process.

5. Service providers and sharing

We share data only as needed to provide and protect the service. Providers may process data on our behalf:

• Firebase and Google Cloud — authentication, cloud functions, database, analytics, hosting, and security;
• AWS S3 — image storage and retrieval;
• OpenAI — AI image processing;
• RevenueCat — products, transactions, entitlements, and credits;
• Apple App Store and Google Play — payments, purchases, refunds, and store compliance.

6. Sharing you initiate

When you save or share a final JPG through your device share sheet, the destination app or service receives the file under its own terms and privacy policy. We do not control how it handles the file after you share it.

7. Data retention

Photos, previews, exports, and related job records may be retained to provide export history. They are kept until you request deletion or may be routinely deleted 90 days after the last export.

Purchase, accounting, tax, security, and fraud-prevention records may be kept longer when required by law, dispute resolution, or service protection.

8. Data security

We use reasonable technical and organizational safeguards, including encrypted transmission, restricted backend access, secure cloud infrastructure, and signed URLs. No transmission or storage method is completely secure.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or transfer your data, object to processing, or withdraw consent. Email hello@pobytfoto.pl to make a request. We may need to verify that the request relates to the correct user.

Deletion may remove your photo history and unused credits, except for records we must retain for legal, tax, accounting, security, fraud-prevention, or platform reasons.

10. Children

The App is not directed to children under 13 or under the age required by local law. A minor may use the App only with a parent or guardian’s permission. If we learn that a child’s data was collected without required consent, we will take steps to delete it.

11. International transfers and legal bases

We and our providers may process information outside your country of residence. Where required, we use appropriate legal mechanisms for international transfers.

In the EEA, UK, and similar regions, we rely on performance of a contract, consent where required, legitimate interests in reliability, security, and fraud prevention, and legal obligations.

12. Changes and contact

We may update this Policy from time to time. For material changes, we will update the date and provide additional notice in the App or on the website where required.