PRIVACY POLICY
Last Updated: May 19, 2026
AtaForge Inc. ("Company", "we", "us", or "our") operates the MakeupAI mobile application ("App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.
Please read this Privacy Policy carefully. By using MakeupAI, you consent to the practices described in this policy.
1. INFORMATION WE COLLECT
1.1 Personal Information
We collect the following personal information when you create an account:
- Name and email address (provided by your authentication provider)
- Profile picture (if provided through social login)
- Authentication identifier from Google Sign-In or Apple Sign-In (we do not receive or store your password)
1.2 Photos and Images
When you use our makeup simulation and face analysis features, we process:
- Photos you take with the in-app camera
- Photos you choose from your device photo library
Both the original photo and the AI-generated result are stored on our cloud storage so they remain available in the Library tab inside the App. You can delete any saved photo individually, or delete your account to remove all photos within 30 days. These photos are processed to provide our services and are not used for advertising.
1.3 Usage and Device Data
We automatically collect:
- Device information (device type, operating system, app version, language)
- A persistent per-installation device identifier (UUID) used only to support multi-device sign-out
- Push notification token, if you grant notification permission
- App usage statistics (e.g., number of makeups generated, face analyses performed)
- Crash reports and performance data
- Advertising identifier (IDFA on iOS / Google Advertising ID on Android) - only when ads are shown to non-subscribed users. You can limit or reset this identifier in your device settings.
1.4 AI Analysis Data
When you use our AI features, we collect and store:
- Face analysis results (face shape, skin tone, skin type, undertone, eye shape, eye color, lip shape)
- Skin health metrics (acne, dryness, oiliness, wrinkles, dark circles, pores, pigmentation, texture, hydration scores)
- Detected skin concerns and personalized recommendations
1.5 Subscription Data
If you start a free trial or paid subscription:
- Subscription status, expiration date, and product identifier (received from RevenueCat)
- Trial usage counters (number of makeups and analyses used)
We do not collect or store your credit card information. All payments are processed by Apple App Store or Google Play directly.
2. HOW WE USE YOUR INFORMATION
We use your information to:
- Generate AI-powered makeup simulations on the photos you submit
- Provide AI face and skin analysis with personalized recommendations
- Display your saved makeups and analyses in the Library tab
- Manage your account, free trial, and subscription
- Send push notifications you have opted in to
- Show advertisements to users who are not on a paid plan
- Improve our AI prompts, app performance, and detect abuse
- Send service-related and transactional emails
- Respond to your inquiries and support requests
We do not use your photos or face analysis data for advertising targeting.
3. DATA STORAGE AND SECURITY
3.1 Where Your Data Is Stored
- Photos and thumbnails are stored on Cloudflare R2 object storage.
- Account information, analyses, subscription state, and saved photo metadata are stored in a PostgreSQL database hosted on Railway.
- Session and limit caches are stored temporarily in Redis hosted on Railway.
3.2 Security Measures
We implement appropriate technical and organizational measures to protect your data, including:
- HTTPS / TLS encryption for all data in transit
- Encryption at rest for stored photos and database records
- JWT-based session authentication with short-lived access tokens and rotating refresh tokens scoped to each device
- Strict access controls on our backend infrastructure
- Regular security reviews of the application and dependencies
No system is 100% secure. We cannot guarantee absolute security but we take reasonable steps to protect your data.
4. DATA SHARING AND DISCLOSURE
We do not sell your personal information. We share data only with the third-party processors listed below, only to the extent required to provide our services, and only under contractual confidentiality.
4.1 Service Providers
See Section 5 for the full list of service providers and what data each receives.
4.2 Legal Requirements
We may disclose your information if required by law or in response to valid legal requests from public authorities.
4.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. You will be notified before this happens.
5. THIRD-PARTY SERVICES
Our App integrates with the following service providers. Each has its own privacy policy governing how it processes your information.
- OpenAI - AI makeup generation and face analysis. Receives the photo you submit and the prompt context (occasion, scope, custom text). Per OpenAI's API Terms, this data is not used to train OpenAI's models.
- Cloudflare R2 - Photo and thumbnail storage.
- Railway - Backend hosting (Node.js API, PostgreSQL database, Redis cache).
- RevenueCat - Subscription management. Receives your in-app purchase events, subscription status, and an anonymized identifier.
- Google Sign-In - Authentication. Receives your name, email, and profile picture from your Google account when you sign in.
- Apple Sign-In - Authentication. Receives your name and email (or relay email if you choose) from your Apple ID.
- Google AdMob - Advertising for non-subscribed users. May collect your device advertising identifier (IDFA / GAID), basic device information, and ad interaction events. You can limit ad tracking from your device settings.
- Expo Push Notifications - Push notification delivery. Receives a device-scoped push token and the notification title and body.
- Yandex Mail (SMTP) - Transactional and admin notification emails. Receives the recipient email address.
Privacy policies of these providers:
- OpenAI: https://openai.com/policies/privacy-policy
- Cloudflare: https://www.cloudflare.com/privacypolicy/
- Railway: https://railway.com/legal/privacy
- RevenueCat: https://www.revenuecat.com/privacy/
- Google (Sign-In, AdMob): https://policies.google.com/privacy
- Apple Sign-In: https://www.apple.com/legal/privacy/data/en/sign-in-with-apple/
- Expo: https://expo.dev/privacy
- Yandex: https://yandex.com/legal/confidential/
6. YOUR RIGHTS AND CHOICES
6.1 Access and Portability
You can view your account information, saved makeups, and face analyses inside the App at any time. To request a portable export, contact us at hello@ataforge.com.
6.2 Correction
You can update your account information through the App settings.
6.3 Deletion
You can request deletion of your account and associated data by:
- Using the "Delete Account" option in the App's Profile screen (recommended - immediate)
- Contacting us at hello@ataforge.com with the subject line "Privacy Request"
Once deleted, your photos, analyses, refresh tokens, and account record are removed from our active systems within 24 hours, and from all backups within 30 days.
6.4 Opt-Out
You can opt out of:
- Push notifications - through device settings or the App's Notifications screen
- Personalized ads - through your device's "Limit Ad Tracking" (iOS) or "Reset Advertising ID" (Android) settings
- Marketing communications - through the App settings
7. DATA RETENTION
We retain your data for as long as your account is active or as needed to provide services.
- Active account: data retained until you delete it
- After account deletion: personal data removed within 30 days (including backups)
- Anonymized aggregate metrics may be retained indefinitely as they cannot be linked back to you
- Legal hold: where required by law, we may retain specific data longer
8. CHILDREN'S PRIVACY
MakeupAI is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it immediately. If you believe a child has provided us with personal information, please contact us at hello@ataforge.com.
9. INTERNATIONAL DATA TRANSFERS
Your information may be transferred to and processed in countries other than your country of residence (including the United States and the European Union, where our service providers operate). When we transfer data internationally, we use appropriate safeguards such as Standard Contractual Clauses to protect your information in accordance with this Privacy Policy.
10. CALIFORNIA PRIVACY RIGHTS (CCPA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose
- Request deletion of your personal information
- Opt-out of the sale of personal information (we do not sell your data)
- Non-discrimination for exercising your privacy rights
- Limit use of sensitive personal information (face/biometric-related data)
To exercise these rights, contact us at hello@ataforge.com with the subject line "CCPA Request".
11. EUROPEAN PRIVACY RIGHTS (GDPR)
If you are in the European Economic Area or the United Kingdom, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing of your data
- Data portability
- Object to processing
- Withdraw consent at any time
- Lodge a complaint with your local data protection authority
Legal basis for processing:
- Consent - for processing photos for makeup simulation and face analysis
- Contract performance - for providing the App services and managing your subscription
- Legitimate interests - for security, fraud prevention, and improving the App
- Legal obligation - where applicable
12. SECURITY OF FACE / BIOMETRIC DATA
We treat face photos and analysis results with extra care:
- Photos are transmitted to OpenAI only for the duration of the analysis or makeup generation request
- Per OpenAI's API Terms, your photos are not used to train OpenAI's models
- We do not perform biometric identification (we do not match your face against any database of known persons)
- The face analysis output is metadata (e.g., "oval face shape", "warm undertone") and is treated as personal information, not as a biometric template
- You can delete any face analysis record from the App at any time
13. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time. We will notify you of any changes by:
- Posting the new Privacy Policy in the App
- Updating the "Last Updated" date
- Sending an in-app notice or email for significant changes
You are encouraged to review this Privacy Policy periodically.
14. CONTACT US
If you have questions about this Privacy Policy or our data practices, please contact us:
AtaForge Inc.
Email: hello@ataforge.com
Website: https://ataforge.com
For data protection inquiries or to exercise your privacy rights, please email us at hello@ataforge.com with the subject line "Privacy Request". We respond within 30 days.
15. CONSENT
By using MakeupAI, you consent to the collection and use of your information as described in this Privacy Policy.