RateMyPic AI — Privacy Policy

Last updated: 6 August 2026

1. Who we are

RateMyPic AI (the "App") is developed by osi-vibe-code ("we", "us"). This policy explains what data the App handles and why. Questions: osi.vibe.code+ratemypic@gmail.com.

2. Accounts and sign-in (optional)

Rating photos, checking authenticity, improving images, and generating avatars all work without any account. The App never asks for your phone number, address, or a password of ours.

Signing in is required only if you choose to use the referral program (inviting friends with a code to earn free credits). Sign-in uses Sign in with Apple or Sign in with Google — you authenticate with Apple or Google, and we never see or store your password.

• On our server we store only a durable pseudonymous user ID derived from your sign-in provider (in the form provider:subject), your referral code, how many people you referred, and which code you redeemed. We do not store your email address or name on our server.
• On your device we store the display name and email address returned by the sign-in provider, so the App can show who is signed in. Signing out removes them.
• If you use Sign in with Apple with "Hide My Email", we only ever see Apple's relay address, and only on your device.
• You can sign out at any time in Settings. To have your server-side referral record deleted, email us at the address in section 13.

3. Photos you analyze

When you take or select a photo and ask the App to rate it, check whether it is AI-generated, improve it, or generate an avatar from it, that image is transmitted to our backend (Firebase Cloud Functions) and forwarded to our third-party AI provider (OpenRouter, which routes to vision and image models such as Google Gemini) to generate the result.

• We do not store your photos on our servers. The image is processed in memory to produce the response and is not written to any database or file storage by us.
• We do not use your photos to build a profile of you, to recognize your face, or for advertising.
• The AI provider processes the image to return a result and under its terms does not use API image inputs to train its models. We do not control that provider's infrastructure; see their policies for details.
• Your results (scores, verdicts, improved images, generated avatars) are saved locally on your device only, so you can see your history. Uninstalling the App or clearing its data removes them.

4. Abuse-prevention data

To keep the service available and prevent abuse of our paid AI calls, our backend stores a minimal, non-content record for rate limiting:

• A random per-install identifier generated by the App, or your IP address when that identifier is unavailable.
• The date and a count of requests made that day.

This record contains no photo and no personal profile. It is used only to enforce daily usage limits and is retained on a short, rolling basis. We also use Firebase App Check to verify that requests come from a genuine copy of the App.

5. Advertising and tracking

The free version of the App shows ads via Google AdMob. AdMob may collect device and usage signals (such as advertising identifiers, coarse device and app information, and ad interactions) to deliver and measure ads, subject to Google's Privacy Policy. Premium subscribers see no ads.

Advertising identifier (IDFA) on iOS

On iOS the App asks for your permission, through Apple's App Tracking Transparency prompt, before it uses your device's advertising identifier (IDFA). If you allow it, the identifier is used for two things:

• Ad selection. Ads shown in the App can be matched to your interests — for example, if you have used photo editing apps before, you may see an ad for a photo app instead of an unrelated one.
• Attribution. Measuring whether an ad you saw elsewhere led you to install RateMyPic AI, and whether ads shown in the App were effective.

Your photos, ratings, and AI results are never shared with advertisers and are never used to target ads. If you decline the prompt, the App still works exactly the same and still shows ads — they are simply non-personalized. You can change your answer any time in iOS Settings → Privacy & Security → Tracking. The App also uses Apple's SKAdNetwork, which reports install attribution to Apple in a privacy-preserving, aggregated way and does not require the identifier.

Consent in Europe and other regions

Where required (for example under GDPR), the App shows Google's consent form before personalized ads are served, and respects your choice.

Cross-promotion

The App may show promotional cards for our own other apps. These are served from our own backend, and tapping one simply opens the relevant app store page.

6. Purchases

Premium subscriptions and one-time purchases of virtual credits are handled through the Apple App Store / Google Play and our purchase provider (RevenueCat). Payment card details are processed by the app store, not by us. We receive only anonymous purchase status (whether you are a premium user and your remaining credit balance). Credits can also be earned for free by watching a rewarded ad or through the referral program; in both cases only the credit count changes, and no extra personal data is collected.

7. Data stored on your device

Most of what the App knows about you never leaves your phone:

• History. Your photos and results (ratings, authenticity checks, improvement steps, generated avatars) are kept in a local database on the device.
• Preferences. Language, theme, consent choices, and notification settings.
• Notifications. If you allow them, the App schedules reminders locally on your device. No notification data is sent to us, and there is no push server.
• Backup and export. You can export a backup file containing your history and preferences, including the photos in it. That file is created on your device and goes only where you send it (for example iCloud Drive, Files, or another app you choose). We never receive it.
• Sharing. When you share a result card, the image and link are handed to the share sheet and go to whatever app or person you pick. Shared links point to a public page of ours that simply redirects to the app store; it carries no photo and no personal data.

8. Data we do NOT collect

• No password of ours, and no email or name on our servers.
• No stored copies of your photos on our servers.
• No contacts, precise location, or health data.
• No use of your photos or results for advertising.
• No sale of personal data to third parties.

9. Children

The App is not directed to children under 13 (or the minimum age in your country). The App is designed to analyze photo quality, not to rate people, and includes safeguards intended to refuse content involving minors. Do not use the App to upload images of children.

10. Your choices and rights

• Don't want a photo processed? Simply don't submit it — analysis only happens on your action.
• Clear your on-device history at any time from the App, or by uninstalling.
• Manage ad tracking in iOS Settings → Privacy & Security → Tracking, or through your Android advertising settings.
• Sign out at any time in Settings to remove your name and email from the device.
• Request deletion of your server-side referral record, or ask what we hold about you, by emailing us (section 13). Everything else is on your device and under your control.

11. Third-party services

• Firebase (Google) — hosting of backend functions, abuse-prevention storage, and referral records.
• OpenRouter and its underlying model providers (e.g. Google Gemini) — AI photo analysis and image editing.
• Google AdMob — advertising (free tier), including the consent form and, with your permission, the advertising identifier.
• Apple (Sign in with Apple) and Google (Sign in with Google) — optional sign-in for the referral program only.
• RevenueCat — subscription and credit-balance management.
• Apple App Store / Google Play — payments and, on iOS, SKAdNetwork install attribution.

12. Changes

We may update this policy as the App evolves. Material changes will be reflected here with a new "Last updated" date.

13. Contact

osi.vibe.code+ratemypic@gmail.com