← Back to Arto AI
Privacy Policy
Last updated: 27 May 2026
Türkçe sürüm →
Arto AI ("we", "us") respects your privacy. This Privacy Policy explains what data we collect when you use the Arto AI iOS application (the "Service"), how we use it, who we share it with, and the rights you have over it.
1. Data we collect
1.1 Information you provide
- Photos you upload. The images you choose to transform — captured with your device camera or picked from your photo library through the system PhotosPicker.
- Prompts & selections. The style, category, country (for World Cup styles), aspect ratio, body type, product category and any text input (e.g. baby name).
- Purchases. If you subscribe to Pro or buy credit packs, the App Store handles payment. We receive an anonymous receipt indicating your entitlement, not your payment details.
1.2 Information collected automatically
- Anonymous device identifier. A randomly generated UUID stored on your device that lets us deliver your credits and Pro status without requiring a sign-up.
- Device & usage info. Device model, OS version, app version, locale, and basic event analytics (e.g. which screens you visit, which styles you generate, paywall views, purchase events). We use the open-source PostHog product analytics platform for this.
- Crash & performance logs. Standard diagnostics via Firebase to help us fix bugs.
- Rate-limit metadata. Request timestamps stored per device to prevent abuse (max 30 generations/hour).
1.3 What we do NOT collect
- Your real name, email, phone number or postal address — unless you explicitly write to us at support@arto.app;
- Your contacts, calendar, microphone, or location;
- Photos from your library that you didn't explicitly select.
2. How we use your data
| Purpose | Data used | Legal basis (GDPR) |
|---|
| Generate the image you requested | Photo, prompt, style | Contract |
| Apply your credits or Pro subscription | Device ID, App Store receipt | Contract |
| Improve the app (analytics) | Anonymous device ID, screen events | Legitimate interest |
| Diagnose crashes | Device info, stack traces | Legitimate interest |
| Prevent abuse & rate-limit | Device ID, request timestamps | Legitimate interest |
3. Third-party AI providers
To generate your images we send the photo and prompt to one of the following providers, depending on the style:
Both providers contractually agree NOT to train their models on the photos we send them.
4. Other processors we use
- Firebase (Google LLC) — anonymous authentication, Cloud Functions (US Central region), Firestore storage, Cloud Storage for user content, App Check device attestation, crash reports;
- RevenueCat (RevenueCat Inc.) — subscription & receipt validation;
- PostHog (PostHog Inc., US Cloud) — product analytics;
- Apple — App Store payments, App Attest verification, push notifications.
5. Data retention
- Uploaded photos: processed in memory by our Cloud Function and discarded immediately after the generation completes — never stored on our servers;
- Generated images: kept on your device only (in the in-app Collection). If you delete the app, they go with it. Generations are also briefly cached in the AI provider's pipeline for their own abuse-prevention windows (typically 30 days);
- Anonymous usage logs: retained up to 24 months for analytics and abuse prevention, then deleted;
- Purchase records: kept as long as required by applicable financial regulation (typically 7 years).
6. International transfers
Some of our processors (Google, OpenAI, Apple, PostHog) may transfer data to the United States. These transfers happen under European Commission Standard Contractual Clauses or equivalent safeguards.
7. Your rights
Depending on where you live (GDPR, CCPA, KVKK in Türkiye, etc.), you may have the right to:
- Access the data we hold about you;
- Request correction or deletion of that data;
- Object to or restrict certain processing;
- Withdraw consent at any time;
- Lodge a complaint with your local data-protection authority.
To exercise any of these rights, email support@arto.app. We respond within 30 days. Because we use anonymous device IDs, please send the request from the device whose data you want us to act on, or include your anonymous device ID (visible in Settings → About).
8. Children
Arto AI is not directed at children under 13 and we do not knowingly collect data from them. If you believe a child has used the app, contact us and we will delete any associated data.
9. Security
We use industry-standard security practices, including TLS-encrypted transport, Firebase App Check device attestation, server-side isolation of API keys (no keys live on the device), and strict Firestore Rules. No system is 100% secure, but we work hard to keep your data safe.
10. Changes to this policy
We may update this Privacy Policy from time to time. When changes are material we will notify you in-app and update the "Last updated" date above.
11. Contact
Data-protection questions or requests? Email support@arto.app.
Data controller: Arto AI, Istanbul, Türkiye.