Privacy Policy

Welcome to Cara. We are committed to protecting your privacy and ensuring transparency in how we collect, use, and safeguard your personal information. This Privacy Policy describes our practices regarding data collection and usage when you use the Cara mobile application (the "App").

By downloading, installing, accessing, or using the Cara application, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with any part of this Privacy Policy, please do not use the App.

1. Information We Collect

1.1 Personal Information

We may collect the following types of personal information when you use the App:

• Account Information: If you create an account, we may collect your email address, username, and authentication credentials.
• Profile Information: Any information you choose to provide in your user profile, including profile pictures and preferences.
• Payment Information: When you make in-app purchases or subscribe to premium features, payment information is processed through Apple's App Store. We do not directly collect, store, or process credit card information.
• Communications: When you contact us for customer support, feedback, or inquiries, we collect the information you provide, including email addresses and message content.

1.2 Usage and Device Information

We automatically collect certain information about your device and how you interact with the App:

• Device Information: Device model, operating system version, unique device identifiers (a randomly generated UUID, not your Apple IDFA), device settings, and mobile network information.
• Usage Data: Information about how you use the App, including features accessed, time spent on different screens, session duration, frequency of use, and interaction patterns.
• Log Data: Technical information such as IP addresses, browser type, access times, pages viewed, crash reports, and system activity.
• Location Information: With your permission, we may collect approximate location data based on your IP address or precise location data from your device's GPS.

1.3 User-Generated Content and Images

Cara is an AI-powered photo application with two primary features:

• Prompt-Based AI Image Generation: When you enter text prompts with optional image attachments, we process this data to generate AI-created images for you.
• Conversational AI Agent: When you interact with our conversational AI agent, upload images, and provide instructions for modifications, we process these inputs to deliver customized results and enable continuous refinement.

We do not use your images or prompts to train or improve our AI models. Google processes your data under its Cloud Data Processing terms, which prohibit using customer data for model training.

1.4 Face Data and Biometric Information

What face data does the App collect?

The App allows users to voluntarily upload photos, which may include images containing human faces. When you upload a photo containing a face, the photo is transmitted as a standard image file. The App does not use any face detection, face recognition, or facial feature extraction technology. No biometric identifiers or biometric information (such as facial geometry, faceprints, or facial feature vectors) are created, collected, or stored by the App.

How is face data used?

Photos containing faces are used solely for the purpose of AI image generation and modification as requested by you. For example, you may upload a photo of yourself to create an AI-generated image in a particular style. The photo is processed as a whole image — the App does not isolate, analyze, or extract facial features separately from the rest of the image.

Is face data shared with third parties?

Yes. Photos you upload (which may contain faces) are transmitted to our server and then forwarded to Google's Gemini AI API (Google LLC) for AI processing. Google processes these images solely to generate the AI output you requested. Google does not use your images to train its AI models and processes the data under its Cloud Data Processing terms.

Where is face data stored?

Your uploaded photos are temporarily processed on our servers and by Google's Gemini API to generate the requested results. Original uploaded photos are not permanently stored on our servers after processing is complete. Generated result images may be temporarily stored on our servers for you to access through the App's gallery feature.

How long is face data retained?

Uploaded photos containing faces are retained only for the duration of the AI processing session. Once the AI-generated result is returned to you, the original uploaded photo is not retained on our servers. Google's processing is transient and subject to Google's data processing policies. You may delete your generated images and account data at any time through the App's settings.

No biometric analysis is performed.

To be explicit: the App does not perform any of the following:

• Face detection or recognition
• Facial feature extraction or measurement
• Creation of facial geometry maps or faceprints
• Biometric identification or authentication
• Age estimation, emotion detection, or any other facial analysis
• Comparison of facial features across images or users

1.5 Cookies and Tracking Technologies

We use cookies, pixels, software development kits (SDKs), and similar tracking technologies to:

• Authenticate users and prevent fraudulent use of accounts
• Remember your preferences and settings
• Analyze usage patterns and improve App performance
• Deliver personalized content and experiences
• Measure the effectiveness of our marketing campaigns

2. How We Use Your Information

We use the collected information for the following purposes:

2.1 To Provide and Improve Our Services

• Process your requests and generate AI-powered images based on your prompts and uploaded photos by transmitting them to Google's Gemini AI API
• Enable the conversational AI agent functionality and facilitate image modifications
• Maintain, operate, and improve the App's features and functionality
• Develop new features, products, and services
• Personalize your experience and provide customized recommendations

2.2 To Process Transactions

• Process in-app purchases and manage subscriptions
• Send transaction confirmations and receipts
• Handle billing and payment-related inquiries

2.3 To Communicate With You

• Respond to your inquiries, comments, and customer support requests
• Send important notices about changes to our services, policies, or terms
• Provide technical support and troubleshooting assistance
• Send promotional communications, newsletters, and marketing materials (with your consent where required)

2.4 For Security and Compliance

• Detect, prevent, and address technical issues, fraud, and security vulnerabilities
• Protect the rights, property, and safety of our users and the public
• Enforce our Terms of Service and other policies
• Comply with legal obligations, court orders, and regulatory requirements
• To maintain a safe environment, we may use automated systems and, in limited cases, human review to detect and prevent misuse, such as sexually explicit, violent, or otherwise harmful content.

2.5 For Analytics and Research

• Analyze usage trends and user behavior to understand how the App is being used
• Conduct research and development to improve AI technologies
• Generate aggregated, anonymized statistics and insights
• Measure and analyze the effectiveness of our marketing campaigns

3. How We Share Your Information

We do not sell your personal information to third parties and do not share your personal information with third parties for their own marketing purposes. However, we may share your information in the following circumstances:

3.1 Service Providers and Business Partners

We engage trusted third-party service providers to perform functions on our behalf:

Service Provider	Data Shared	Purpose
Google LLC — Gemini AI API	User-uploaded images (which may contain faces) and text prompts	AI image generation and modification. Google processes data under its Cloud Data Processing terms and does not use your data for model training.
Adapty Inc. — Subscription Management	Device identifier (UUID), purchase/subscription events, device metadata (model, OS version, locale)	In-app subscription management, purchase receipt validation, and subscription analytics.
Apple Inc. — App Store	Payment and transaction information	Payment processing for in-app purchases and subscriptions.
Google LLC — Google Fonts	IP address (via HTTP request on first font load)	Font file delivery for App typography. No user-generated content is shared.

These service providers have access to your information only to perform specific tasks on our behalf and are obligated to protect your information and use it only for the purposes we specify.

3.2 Legal Requirements and Protection

We may disclose your information if required to do so by law or if we believe such action is necessary to:

• Comply with legal obligations, including court orders, subpoenas, or government requests
• Protect and defend our rights, property, or safety, or that of our users or the public
• Investigate, prevent, or take action regarding illegal activities, suspected fraud, or violations of our Terms of Service
• Enforce our agreements and policies
• Respond to claims that content violates the rights of third parties

3.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice in the App before your information is transferred and becomes subject to a different privacy policy.

3.4 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing, such as when you choose to share your AI-generated content on social media platforms or with other users.

3.5 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you with third parties for analytics, research, marketing, or other purposes.

4. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account Information: Retained while your account is active and for a reasonable period thereafter to comply with legal obligations and resolve disputes.
• Uploaded Images (including photos with faces): Retained only for the duration of the AI processing session. Not permanently stored after processing is complete.
• Generated Images: Temporarily stored on our servers for access through the App's gallery. You may delete them at any time.
• Conversation History: Retained for up to 7 days on our servers to enable continuous editing sessions. Deleted automatically thereafter.
• Usage and Analytics Data: Typically retained for up to 24 months, unless needed for longer periods for legitimate business purposes.
• Transaction Records: Retained for the period required by applicable tax and financial regulations.

When we no longer need your information, we will securely delete or anonymize it in accordance with our data retention policies and applicable laws.

5. Data Security

We implement appropriate technical, administrative, and physical security measures designed to protect your information from unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit using industry-standard SSL/TLS protocols
• Encryption of sensitive data at rest
• Regular security assessments and vulnerability testing
• Access controls and authentication mechanisms
• Employee training on data protection and privacy practices
• Secure data centers with physical access controls
• Regular monitoring and logging of system activities

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information using commercially acceptable means, we cannot guarantee its absolute security.

6. Your Rights and Choices

Depending on your jurisdiction, you may have certain rights regarding your personal information:

6.1 Access and Portability

You have the right to access the personal information we hold about you and, in some cases, to receive a copy in a portable format.

6.2 Correction and Update

You can update or correct your account information at any time through the App's settings or by contacting us directly.

6.3 Deletion

You have the right to request deletion of your personal information. You can delete your account through the App settings, which will permanently remove all your data including generated images, conversation history, and credits.

6.4 Objection and Restriction

You may object to certain uses of your information or request that we restrict processing of your data in specific circumstances.

6.5 Withdraw Consent

Where we rely on your consent to process your information, you have the right to withdraw that consent at any time.

6.6 Opt-Out of Marketing Communications

You can opt out of receiving promotional emails by following the unsubscribe instructions in those emails.

6.7 Exercising Your Rights

To exercise any of these rights, please contact us using the contact information provided in Section 13.

7. User Consent and In-App Disclosure

Before you can use the App's AI features for the first time, the App presents an in-app consent screen that clearly discloses:

• What data is sent: Your uploaded photos (which may contain faces) and text prompts
• Who receives the data: Our server and Google's Gemini AI API (Google LLC)
• How the data is used: Solely for generating AI images as requested by you
• What is NOT done: No biometric analysis, no face recognition, no AI model training with your data

You must explicitly agree to this data processing by tapping "Agree & Continue" before any of your data is transmitted. If you do not consent, you will not be able to use the App's AI features. You may withdraw your consent at any time by deleting your account.

8. Children's Privacy

You must be at least 13 years old (or the applicable age of digital consent in your jurisdiction) to use the App. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately using the contact information in Section 13.

9. International Data Transfers

Your information may be transferred to, stored, and processed in countries other than your country of residence, including the United States (where Google LLC is headquartered). When we transfer your information internationally, we take appropriate safeguards to ensure protection in accordance with this Privacy Policy and applicable laws.

10. Third-Party Links and Services

The App may contain links to third-party websites or services not owned or controlled by us. This Privacy Policy applies only to the App. We encourage you to read the privacy policies of every third-party service that collects personal information.

11. California Privacy Rights

If you are a California resident, you have additional rights under the CCPA/CPRA including the right to know, right to delete, and right to opt-out of sale (we do not sell your data). To exercise these rights, contact us using the information in Section 13.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and provide notice through the App. Your continued use of the App after changes are made constitutes acceptance of the updated Privacy Policy.