Privacy policy

In short

• Sfuma edits your photos on your iPhone. You don’t need an account, and the app has no analytics, no ad tracking and no crash-reporting code of its own.
• Your photos, your face and your edits stay on your phone. The one exception is a feedback report you choose to send. Nothing is sent until you press Send, and the screen lists exactly what goes.
• Feedback photos are stored in the United States and deleted within 90 days at the latest. You can delete a report sooner, at any time, in the app.
• Apple handles purchases. We keep only daily totals of purchase events, never who bought.
• We don’t sell your data or use it for advertising.

Who we are

Sfuma is made by NameVerse, Inc., which is the data controller (in Turkish law, the veri sorumlusu) for the data described here. Address: United States (full postal address on request by email). Email: [email protected]. We have not appointed a data protection officer; at our size and with this little processing the law does not require one. Write to the address above about anything on this page.

What stays on your phone

All editing (face detection, skin smoothing, slimming and reshaping, looks) runs on your iPhone. To do that, the app keeps these inside its own storage on the phone:

• A copy of each photo you open or take in Sfuma, plus your edit settings and small thumbnails. Sfuma uses the system photo picker, so it sees only the photos you pick, never your whole library. Deleting an edit from Recent deletes the app’s copy. Your original in Photos is never changed or deleted.
• Names you give to faces. If you label a face (for example “Mom”), the app stores the name together with a numerical description of that face, so it can suggest the same name in your next photo. These descriptions are made and kept only on your phone. They are never sent to us, never included in feedback and never put in recipe codes. Clear a name and its descriptions are deleted.
• Small settings: onboarding done, your saved looks, the date you first opened the app (so the 30-day period works), whether you have unlocked, and a log of network connections (see below).

Like other app data, these files are included in your iPhone backups (iCloud Backup or your computer) if you use them. Deleting the app deletes them from the phone. A few small items are kept in the iPhone’s Keychain, which iOS keeps even after an app is deleted: the first-open date, your unlock status, and (if you ever sent feedback) the random install ID and the keys that let you delete your reports. Erasing the iPhone removes them.

Permissions. Sfuma asks for the camera only when you open the camera, and for “add photos only” access only when you save an export. It does not ask for your location, microphone, contacts, or permission to track you.

Exports. Exported photos have no watermark. By default they are saved without camera details or location. You can choose to keep them on the export screen.

Check it yourself: the network log

Settings → Network activity lists every server the app itself has connected to, and why. If you never send feedback, it stays empty. Apple’s own services (App Store purchases, ratings, iOS crash reports) run inside iOS rather than inside the app, so they do not appear there.

Feedback

“Send feedback” (in the editor’s ⋯ menu and in Settings) is optional. Nothing is sent until you press Send, and that screen lists exactly what goes. With the switches you choose which of these to include:

• The original photo you were editing. Before it leaves your phone we remove its location (GPS), IPTC and XMP blocks, the camera and lens serial numbers, the maker note and the owner name. The camera make and model, capture date, orientation and color profile stay, because we need them to reproduce the problem.
• The edited result, as a JPEG with no camera details and no location.
• Your edit settings. Names you gave to faces are removed.
• Face-detection data: the position of each face and of points around the eyes, brows, nose, lips and face outline, plus body-pose points. These are the numbers the app used for your edit. We use them only to see why a tool landed in the wrong place, never to recognize who someone is.

Every report also carries what you typed (what you were trying to do, how it went, what happened), the area of the app, which tool and face you were on, your device model, iOS version, app version and build, language and region setting, and a random install ID. The install ID is not an account and not your name. It lets the app show you your reports and their status, and it lets us stop floods of reports. Your email address is sent only if you type it, and we use it only to reply about that report.

After you have sent a report, the app checks its status with sfuma.cam when you open it, using the install ID, so it can tell you when a version that addresses it is ready to test. If you answer “did it work?”, your answer and any note are added to the report.

Where it goes. Report text and device details are kept in our database on servers in the United States. Photos and other files are kept in a private storage bucket with our storage provider (Cloudflare R2, United States). Only the people working on Sfuma can open them, using an admin key. We may use an AI assistant (Claude, by Anthropic) to help us read a report and find the cause. When we do, it processes the report on our behalf. People working on a problem may download a report’s files to a work computer to reproduce it, and they delete those copies when the issue is closed.

How long. Photos and other files are deleted automatically within 90 days of the report at the latest. If the report is linked to an issue and that issue is closed first, they are deleted 30 days after it closes. The deletion job runs every hour, and the storage bucket deletes anything older than 90 days as a backstop. The text you wrote and the device details are kept so that we can recognize a problem that comes back. There is no automatic deletion date for them, but you can remove them yourself. We never keep your photo longer than this, and we never add it to our test photos without asking you separately first.

Your control. You can delete a report at any time from “My reports” in the app. Its files are deleted right away, and your text, your email address and the tool details are erased. A short record stays so our issue history adds up: date, app version, device model, iOS version, language, area, outcome and the install ID. Copies in our database backups (which never contain photos) disappear as those backups expire; our longest tier keeps yearly copies for up to 7 years. If you no longer have the app, email us the report number (it looks like R-1042) and we will delete it.

Please only send photos you have the right to share. If other people are in the photo, make sure they are fine with it. Don’t send photos of children unless you are their parent or guardian. To send a report with a photo you must be 18 or older, or have a parent’s or guardian’s permission. If you believe a report contains your photo without your permission, email us and we will delete it.

Legal basis. We use photos and face-detection data only with your explicit consent, which you give on the Send screen when a report includes them, and which you can withdraw at any time by deleting the report. We use the rest of the report on the basis of our legitimate interest in investigating and resolving the problem you reported. Sending a photo or face-detection data to the United States rests on your explicit consent (see “International transfers”).

Purchases

Apple sells the unlock on our behalf through the App Store and handles payment, receipts, renewals, cancellations and refunds. We never see your Apple Account (Apple ID), name or card. Your iPhone checks your unlock with Apple directly. Apple sends our server signed notifications of subscription events (purchase, renewal, cancellation, refund). Our server checks Apple’s signature and keeps only daily totals by product, App Store country and event type. It does not store transaction identifiers or anything that identifies you. The notification’s own ID is kept for 48 hours so a retried notification is not counted twice.

Recipe links

A recipe code (like SF-2400-CCW0) holds your edit settings only, never the photo. In a link, the recipe travels in the part after the “#”. Browsers do not send that part to any server, so the recipe is read only in your browser and the recipient’s. Our server sees only that someone opened /r/. If you share a photo or a code through the share sheet, the app you share it to handles it under its own terms.

Ads

The current version of Sfuma shows no ads and contains no advertising code. We plan to show an occasional ad between edits (after an export or when you return to the app) once your first 30 days are over, unless you have unlocked. Before that update ships, we will update this page and the App Store privacy label. Ads will be non-personalized: no advertising identifier, no “allow tracking” prompt, no ads during editing. Even non-personalized ads come from an ad network that receives your IP address and basic device information to deliver the ad, measure it and prevent fraud. Where the law requires it (for example in the EU and the UK), the app will ask for your choice first.

This website

sfuma.cam runs on our servers in the United States, behind Cloudflare, which protects and delivers the site. Like any website, our servers log each request: your IP address, the address requested (for the app’s status check, this includes the random install ID), the time, the response, and your browser or app version. These logs help us keep the service running and secure, and they are currently kept for up to 2 years. Cloudflare handles the same connection data as our service provider and may set a short-lived security cookie if it needs to tell people apart from bots.

The pages of this site set no cookies of their own; you choose a language through the address (/tr/ for Turkish). The one exception is the recipe page: if a recipe link carries ?lang= in its address, it sets a lang cookie so later recipe pages open in that language. It lasts a year and is needed for something the link asked for, so it doesn’t need a banner. There are no third-party scripts, fonts or embeds.

Who else receives data

• Cloudflare, Inc. (United States): network protection and delivery for sfuma.cam, and storage of feedback files (R2). Acts as our service provider.
• Anthropic, PBC (United States): AI assistant we may use to help read and investigate feedback reports. Acts as our service provider.
• Apple: the App Store, purchases and, if you turn on “Share with App Developers”, crash reports. Apple acts under its own privacy policy.
• Authorities, only if the law requires it, and only for the data we actually hold.

We do not sell personal information or share it for advertising, and we don’t let anyone else use it for their own purposes.

International transfers

NameVerse, Inc. and our servers are in the United States. If you send feedback from Turkey, the EU, the UK or elsewhere, your report is processed in the United States, where data protection law may give you less protection than at home, and US authorities may be able to request access under US law. For feedback that includes a photo or face-detection data, we ask for your explicit consent to this transfer on the Send screen. Our service providers process data in the United States under their data processing terms.

Security

Everything travels over HTTPS. Feedback files sit in a private bucket that only our server can write to and only our admin key can read. Only the phone that sent a report holds the key that lets someone delete it or answer for it from outside our admin tools. No system is completely secure. If you find a vulnerability, please write to [email protected].

Your rights

Depending on where you live (including under the GDPR and UK GDPR, and Turkey’s Law No. 6698), you have the right to:

• ask what data we hold about you and get a copy, including in a portable format;
• have it corrected or deleted, or its use restricted;
• object to processing based on our legitimate interests;
• withdraw consent at any time (deleting the report does this), without affecting what happened before;
• complain to your data protection authority, for example the Turkish Personal Data Protection Authority (KVKK), your EU supervisory authority or the UK ICO.

Because there are no accounts, we can only find your data through a report. In the app you can see and delete your reports yourself. By email, send the report number from “My reports”. We reply within 30 days and don’t charge for it. We don’t make automated decisions about you.

If you are in California or another US state with a privacy law: we don’t sell or share personal information, and we don’t use sensitive information to infer anything about you. You can ask to know, correct or delete what we have through the same email, and we won’t treat you differently for asking.

Children

Sfuma is not made for children under 13 and we don’t knowingly collect data from them. Feedback with a photo needs the sender to be 18 or older, or to have a parent’s or guardian’s permission. If you believe a child has sent us a report, email us and we will delete it.

Changes to this policy

When we change this policy, we update the date at the top. If a change affects what Send feedback sends or where it goes, the app asks for your agreement again before your next report. Older versions are available on request.

Contact

NameVerse, Inc. · United States (full postal address on request by email) · [email protected]

Türkçe metin ve KVKK aydınlatma metni: Gizlilik politikası.