Last updated: 15 July 2026
This Privacy Policy explains how AVALANCHE FACTORY SAS (“we”, “us”) handles information in Coiffy, our virtual hairstyle try-on app for iPhone. It is specific to Coiffy.
The data controller is AVALANCHE FACTORY SAS, a société par actions simplifiée registered in France under SIREN 942 151 820, with its registered office at 44 rue Catherine de la Rochefoucauld, 75009 Paris, France.
The short version. Coiffy has no accounts and asks for no personal details. You pick a photo; if the hairstyle you chose needs AI processing, that photo is sent to our servers, transformed, and then deleted automatically — the original the moment your result is ready, the result within one hour. We never train AI models on your photos, never sell them, and never use them for advertising. Coiffy contains no advertising, analytics, or tracking SDKs from other companies, and does not perform facial recognition.
Coiffy processes photos that you choose from your photo library or take with the camera. These photos normally contain your face. We access your photo library only when you ask us to, and we never scan it in the background.
Coiffy uses Apple’s Vision framework to detect where a face and its features are in your photo. This runs entirely on your device, and the result is used only as geometry — to find the hairline, to align and crop the picture, and to build the masks that let us change hair without altering the rest of the image. That geometry is temporary: it exists only while your edit is being rendered, and is never stored or sent anywhere.
We do not create, derive, store, or transmit faceprints, face templates, facial embeddings, or any other biometric identifier. Coiffy does not perform facial recognition. It cannot identify you, and it cannot match you against any other person or database. No face data is ever used to identify anyone.
If you subscribe, the purchase is made through Apple, and your subscription status is managed by RevenueCat. We receive whether a subscription is active — not your payment details. We never see your card number. RevenueCat receives no photos and no image data of any kind.
We record basic, first-party product analytics to our own backend — which feature was used, whether a result succeeded, app version and platform — tied to an anonymous identifier and a per-launch session identifier. These events carry only short text and numeric values. They never contain your photos or any image data. There are no third-party analytics, advertising, attribution, or crash-reporting SDKs in Coiffy.
No name, no email address, no phone number, no address, no contacts, no precise location. Coiffy requires no account: sign-in is anonymous, so your photos are not linked to a real-world identity. Location metadata (EXIF/GPS) in your original photo is not transmitted — images are re-encoded before upload, which drops it.
Information
Purpose
Legal basis (GDPR)
Your photo
To generate the hairstyle or hair-colour result you asked for — nothing else.
Performance of a contract, and your explicit consent for data concerning you.
Subscription status
To unlock paid features and restore purchases.
Performance of a contract.
Usage events
To see which features work, fix failures, and improve the app.
Legitimate interest in operating and improving Coiffy.
We do not use your photos to train AI models. We do not sell your data. We do not use your data for advertising or profiling.
Some effects run entirely on your device. When you choose an effect that needs AI processing, your photo is resized (maximum 1024 pixels), encoded as a JPEG, and sent over an encrypted connection to our backend, which passes it to our AI providers solely to produce your result.
Provider
Receives
Purpose
Convex
Your photo, the effect settings
Our backend and temporary storage
Replicate
Your photo
AI inference — hairstyle and hair colour
fal.ai
Your photo
AI inference — enhancement and animation
RevenueCat
No image data
Subscription management
Apple
No image data
App distribution and payment
These providers act on our instructions, for the sole purpose of performing the transformation you requested. No one else receives your photo. Their own handling of data is additionally governed by their respective terms and privacy policies.
Our backend and AI providers are located in the United States, so if you use an AI effect from the European Economic Area or the United Kingdom, your photo is transferred there for the few seconds it takes to process, under the data protection terms we have in place with each provider. It is deleted immediately afterwards, as described below.
We do not retain your photos. Storage on our servers is strictly temporary, and deletion is automatic and enforced in our code — it is not a manual process and does not depend on anyone remembering to do it.
What
How long it exists on our servers
Your original photo
Deleted immediately once your result has been produced — typically a few seconds, the duration of the processing itself.
The generated result
Deleted within 1 hour. This short window exists only so the app can finish downloading it to your device.
The processing record
Deleted at the same time as the result.
Failed or cancelled requests
Follow the identical deletion path — no exception.
Anything at all
Nothing survives beyond 24 hours, in any circumstance. A background task runs every 15 minutes to enforce this.
Anonymous usage events
Retained while they remain useful for improving the app. They contain no images and no identifying information.
Photos and results you save inside Coiffy are stored on your own device, under your control. They are removed when you delete them in the app or uninstall Coiffy.
If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, erase, restrict, or object to the processing of your personal data, and the right to data portability. If you are in California, you have the right to know what is collected, to request deletion, and to opt out of sale — we do not sell personal information.
In practice, most of these rights are already satisfied by design: we hold no server-side archive of your photos to disclose or delete, and no account or identity is attached to them. If you have a request or a question, contact us at the address below and we will respond. You may also lodge a complaint with your local data protection authority.
Photos are transmitted over encrypted connections (HTTPS/TLS) and are accessible only to the anonymous session that created them. The strongest protection we offer is simply that we do not keep them.
Coiffy is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has provided us with data, contact us and we will address it.
If we change how we handle your data, we will update this page and revise the date at the top. Material changes will be brought to your attention in the app.
Questions or requests about this policy or your data — including any request to exercise the rights described in section 5 — can be sent to contact@avalanchefactory.com. We aim to respond within 30 days.
AVALANCHE FACTORY SAS
44 rue Catherine de la Rochefoucauld
75009 Paris, France
SIREN 942 151 820 — VAT FR20 942 151 820
If you are in the European Economic Area and believe we have not handled your data lawfully, you may lodge a complaint with your local supervisory authority. In France, this is the Commission Nationale de l’Informatique et des Libertés (CNIL).