Privacy Policy

The information we process depends on how you use Velora:

• Selected images and choices: a selfie or hand photo, your selected hairstyle, hair color, makeup, brow, nail or accessory options, and your requested response language.
• AI results: a generated image, or face shape observations, estimated facial proportions, apparent skin undertone, confidence values and beauty recommendations.
• Account information: an automatically assigned guest account identifier and authentication credentials; if you sign in, your email address and information returned by the sign-in method you choose.
• Purchase information: customer and transaction identifiers, products, purchase and renewal events, subscription status and entitlement information supplied by the store and RevenueCat. We do not receive your full payment card number.
• Technical and activity information: IP address, request time, device and app information, screen views, app events, authentication events, error information and processing metadata.
• Support correspondence: your email address, messages and any attachments you choose to send us.

You do not have to send a photo simply to read this website. A photo and internet connection are necessary to generate a personalized preview or analysis. Account and technical identifiers are needed to authenticate requests and protect the service.

Velora uses the system camera or photo picker when you choose to take or select a photo. Selecting a photo prepares it in the app; requesting generation or analysis sends it for online processing. We do not scan your entire photo library or continuously record your camera.

Before forwarding an image to the AI service, our server resizes and re-encodes it as JPEG, removing embedded metadata such as EXIF location information. Visible information in the image itself, including people or details in the background, remains part of the submitted photo.

Saving a generated image to your photo library requires the relevant system permission. Sharing opens your device’s sharing interface and sends the image to the destination you choose. Your photo library, cloud photo backup and sharing destinations have their own storage and privacy settings.

You can change camera and photo permissions in your device settings. Denying a permission can prevent the related feature from working. Use your own photos, or obtain the permission of everyone whose personal information appears in a photo, including permission for external AI processing. Avoid submitting identity documents, intimate images or unrelated sensitive information.

When you request a result, Velora transmits the selected photo and the instructions needed to create that result to our application server. The server sends the image and instructions to OpenRouter, which routes the request to an AI model provider. The current configuration uses Google image and analysis models and may use an OpenAI analysis model as a fallback. The provider serving a particular model can vary.

For face insights, the model estimates the outline and proportions of the visible face and may describe its shape, jawline and apparent undertone. These are photo-based estimates for beauty inspiration. Velora does not use this feature to identify you, verify your identity, compare you against an identity database or make eligibility, employment, credit or other decisions with legal or similarly significant effects.

External processing has separate data practices. Our server’s temporary processing does not mean every external provider immediately deletes all data. OpenRouter and model providers may process or retain inputs, outputs and metadata under their applicable policies, including for security, abuse prevention, legal obligations or, for some providers and settings, model improvement. Velora does not promise that every request is subject to zero data retention or excluded from provider training.

Read OpenRouter’s Privacy Policy and its provider data policies for more information. Contact us if you need information about the processing of a particular request. If you do not want your photo sent to external AI services, do not request an AI preview or face analysis.

We do not maintain a training dataset of your photos or generated images in Velora’s application database. We do not claim that this statement controls a separate provider’s data handling.

The app creates a guest account so that requests can be authenticated even without an email sign-in. A guest identifier is pseudonymous: it is not the same as collecting no personal information.

If you choose an available email or third-party sign-in option, we process the information required to create and maintain your account, such as your email, provider identifier and authentication information. Sign-in providers may return a name or other basic profile information within the permissions you grant. Authentication tokens and guest refresh credentials are stored using device secure storage; app settings are stored locally.

Account deletion is available for signed-in accounts through the app’s account settings. Guest users and anyone who cannot access the app can contact support@nexdev.codes. We may ask for reasonable information to locate the relevant record and verify authority to act. Do not email a password or authentication token.

The mobile app uses Google Analytics for Firebase to understand app usage, screen views, sign-in events and product interactions. Analytics collection is enabled in the current app. Events may be associated with an app instance or account identifier; some sign-in paths also associate the account email address with analytics. These records should not be understood as anonymous.

RevenueCat manages purchase entitlements and receives customer identifiers and subscription information. The app also supplies a signed-in user’s email address, collects device identifiers through the purchase SDK and enables Apple AdServices attribution token collection on iOS to understand acquisition and purchases.

Our AI endpoints log processing metadata such as the chosen category and options, model, processing duration, response language, and face shape and confidence for an analysis. The photo and full generated image are not deliberately written into these application log entries. Error and infrastructure logs may contain additional technical request information.

This website does not include an analytics or advertising SDK. It uses browser storage for your theme preference. In-app display mode is passed in the page URL. Hosting infrastructure still processes ordinary connection information, including your IP address and requested URL.

• Provide requested features: authenticate requests, process selected photos, produce and return previews or insights, and manage account access.
• Manage purchases: confirm entitlements, restore access and handle billing-related support.
• Operate and protect Velora: limit abusive traffic, investigate errors, secure accounts and maintain reliable service.
• Understand and improve the product: evaluate usage, feature performance and purchase attribution.
• Respond and comply: answer support and rights requests, resolve disputes and meet legal obligations.

Where the GDPR or similar law applies, the legal basis for core functionality and account or purchase administration is performance of the service agreement; for necessary security and troubleshooting, our legitimate interest in operating a secure, reliable service; and for required legal records, compliance with legal obligations. Where consent is required for analytics, device access, attribution or particular image processing, consent is the applicable basis. A camera permission or acceptance of Terms is not blanket consent to every use of personal information.

You may object to processing based on legitimate interests and withdraw any consent you have given by contacting us. Withdrawal does not affect processing that was lawful before it was withdrawn. Device permissions can also be revoked in device settings. The current app does not provide a separate analytics opt-out switch; contact us about available objections or deletion requests.

Information is disclosed as needed to these categories of recipients:

• OpenRouter and the AI provider serving your request: selected images, generation instructions and AI processing metadata, as explained above.
• Application hosting and infrastructure: our PocketBase-based account service hosted on Fly.io, and website hosting infrastructure, which process account records, requests and technical logs.
• Google Analytics for Firebase: mobile usage, technical and account-associated analytics information. See Firebase privacy information and Google’s Privacy Policy.
• RevenueCat and the app store: account identifiers, device or attribution information and purchase records. See RevenueCat’s Privacy Policy and Apple’s Privacy Policy.
• Sign-in and communication providers: information needed to authenticate your chosen sign-in method or deliver email and support.
• Recipients you choose: people or services to whom you share results.

We may disclose relevant records when legally required, to protect people or the Service, or in connection with a business transfer subject to applicable data protection requirements. We do not publish your selected photos or generated images in a public Velora gallery. A provider’s own uses of information are governed by its applicable terms and legal role.

• Photo and result processing: our current preview and analysis endpoints process images and complete results in request memory, without writing them to a user content database or permanent image store. The app holds the current studio photo and result only in temporary memory. Clearing or replacing the photo can remove the current result; use Save or Share to keep a copy. This is not a guarantee of immediate physical memory erasure.
• Saved or shared copies: a copy you save to Photos or send elsewhere remains there until you or that service delete it. Removing Velora or deleting a Velora account does not remove those copies.
• Accounts: account records remain while the account is maintained, until deletion is requested or another applicable deletion process removes them. Simply uninstalling does not delete the server account. Signing out or deleting an account may create a fresh guest session if you continue using the app.
• Logs, analytics and support: retention depends on what is needed for security, investigating issues, handling the request, service improvement and legal obligations, as well as the relevant provider’s settings and policies. There is no single fixed retention period covering all of these records.
• Purchase records: store and RevenueCat records may remain as needed to validate entitlements, prevent fraud, process refunds and meet financial or legal requirements.
• External AI services: their retention is separate from our in-memory processing and depends on the provider and applicable settings described in the AI section.

Deleting your account removes the account record through the app’s account service. It does not automatically erase all independent provider records, billing records, technical logs or copies you shared. Contact us for a broader deletion request, including assistance with relevant processors. Information subject to a lawful retention requirement may be kept for that purpose and restricted accordingly.

Deletion does not cancel an App Store subscription. Cancel it separately in your store account to stop future renewals. See deletion help and cancellation terms.

Velora uses encrypted connections for its production application requests, authenticated access and limits intended to reduce misuse. Authentication information on the device uses secure storage where supported. These controls reduce risk but cannot guarantee that any system or transmission is completely secure.

Protect your device and sign-in credentials. Contact us if you suspect unauthorized access. Do not send sensitive images or account secrets with a support request unless specifically necessary and agreed.

Velora is not directed to children under 13. You must also satisfy any higher minimum age or parental authorization requirement that applies where you live. Do not submit a child’s photo without the lawful authority and permissions needed for its processing.

If you believe a child has provided personal information contrary to these requirements, contact us so that we can investigate and address the information we control, including deletion where required.

Depending on where you live and the applicable law, you may have rights to access or obtain a copy of your personal information; correct it; request deletion; restrict or object to processing; obtain portability; withdraw consent; and appeal a decision about a rights request. These rights have legal conditions and exceptions.

You may object to processing based on legitimate interests, including relevant analytics or attribution processing, by emailing support@nexdev.codes. Tell us what you are requesting and, where possible, the email or account identifier associated with the app. We will take reasonable steps to verify a request without asking for more information than necessary and respond within the period required by applicable law.

You can also revoke camera or photo permissions, delete exported images yourself, manage your store subscription and use the in-app account deletion option. The app’s current interface does not offer a separate control that disables all analytics or attribution collection.

You may complain to your local data protection authority. For the EEA, see the list of national supervisory authorities; in the UK, contact the Information Commissioner’s Office; in Türkiye, consult the Personal Data Protection Authority. You do not need to contact us first to exercise a right to complain.

Velora’s infrastructure and service providers may process information outside your country, including in the United States and other countries where hosting or AI providers operate. The serving provider and location can vary; we do not promise that all requests remain in a particular country or region.

International transfers are subject to the protections required by applicable law. You can contact us for information about the recipients, locations and transfer safeguards applicable to your information, and to request a copy of relevant safeguards where available. This policy does not represent that every provider has the same transfer arrangement or that a particular contractual safeguard has been verified for every request.

We may revise this policy when the Service or its data practices change. The date above identifies the latest version. For material changes, we will provide additional notice where required and seek consent before new processing where the law requires it. Continuing to use Velora does not waive your privacy rights.

For privacy questions, account deletion assistance or a rights request, email support@nexdev.codes with the subject “Velora privacy request”. Include only the details needed to identify your request. You can also use our Support page.