Privacy Policy
1. General Provisions
This Privacy Policy describes the processing of user data in Home Flip AI and related Ai-sloy services. Black Bears Publishing LLC operates Home Flip AI and is the controller responsible for processing its users’ personal data. Requests concerning personal data processing, user rights and data deletion should be sent to service.aisloy@gmail.com. Data processing by Apple, Google and external websites is governed by their respective privacy policies.
2. Information you provide
We process photos of rooms and products you select, text prompts, product links, project names, generated results and edit history. The app sends selected material for processing, not your entire photo library. Sign in with Apple supplies an account identifier and any name and email Apple shares, including a private relay address. Google sign-in on Android uses Google Firebase Authentication and processes Google and Firebase identifiers, the name, email and profile photo URL supplied, and a short-lived authentication proof to verify sign-in. The profile photo is loaded from Google image CDN; Home Flip stores its URL rather than another server copy of the image. Completed Home Flip account erasure removes that URL, not the Google Account or its photo. Accounts from different providers are not merged by email. The developer may issue a username and password for app store review. When used to sign in, these are sent to our server for verification against hashes in its configuration; the plaintext password is not saved in account data. Successful verification issues an ordinary session for a dedicated account subject to the same data protection and deletion rules. This is a shared review workspace, not a separate account for each reviewer. Support requests include your email and information you choose to send.
3. Technical information and credits
Operating and protecting the service involves account, installation, project and operation identifiers, IP addresses and technical request information, app version, platform, errors and usage events. The server maintains credit balances and records of grants, reservations and usage. When purchases are available, Apple or Google Play handles payment and Home Flip receives product, order, purchase-proof and subscription-status information. Google Play also supplies a purchase token and an indirect identifier linking the purchase to your Home Flip profile for server verification, one-time grants, acknowledgement, restoration, renewals and refunds. We do not receive full payment card details.
4. Purposes and legal bases
We use data to provide requested features, sign-in, saved projects, credit accounting and support, to perform our agreement with you. You control camera, photo library and notification permissions in device settings. Where separate consent is required by law, processing relies on that consent. Necessary security measures, abuse prevention and minimal technical service logs rely on legitimate interests in a reliable service where permitted by law; legally required records are processed to comply with legal obligations. Optional analytics and error reports are described separately in section 6.
5. AI processing and service providers
Photos, prompts and information needed for the selected AI action are sent to OpenAI. The service also uses hosting and storage infrastructure, Apple for sign-in and available purchases, Google Firebase Authentication for Google sign-in on Android, Google image CDN for displaying the profile photo, and Expo Push with Apple/Google services for notifications. Google/Firebase receives sign-in information and technical information about the corresponding requests; room and product photos, AI prompts, projects and credit balances are not sent to Firebase Authentication. Adding sign-in does not enable Firebase Analytics. Providers receive information needed for their function. External processing is governed by provider terms and applicable agreements; this policy does not promise zero retention by providers.
6. Analytics and error reports
Optional usage analytics includes screens, actions, sessions and purchases to improve the app. Optional error reports include errors and operation progress to identify and fix problems. The native app uses AppMetrica (Yandex), while the Home Flip server processes usage events associated with installations, accounts and operations. Photos, prompts, product URLs and server account or room identifiers are not sent to AppMetrica; technical identifiers do not make the remaining information anonymous. Advertising identifier and location collection, automatic purchase tracking and automatic native crash collection are disabled. These legal pages use no JavaScript, analytics cookies or advertising trackers; their hosting server may maintain technical access logs.
6.1. Region and your choices
The service approximately determines the country from a public IP address through Country.is, provided by Line of Flight. The server sends this service only the IP address for country detection, not photos, prompts, credentials or account identifiers. Device coordinates and location permission are not requested. Addresses appear in a bounded short-lived server cache, not consent records. In a confirmed EU/EEA region, the app offers separate choices for usage analytics and error reports; new permissions take effect after server acknowledgement. Rejecting does not limit app features, and you can change your choices in Settings. Collection for both optional purposes is disabled until saved settings have been read. After settings have been read, while determining the country, for an unknown country, following a lookup error, or outside a confirmed EU/EEA region, processing for each purpose is enabled by default without a consent prompt unless a refusal for that purpose is saved. A saved manual refusal for each purpose applies in every region, including after purpose-version changes, app restarts and while offline. Previously transmitted information cannot technically be recalled; this regional rule does not itself determine which law applies to the controller. Necessary sign-in, payment, security and requested-operation records do not depend on these optional permissions.
6.2. Acknowledgement, delivery and withdrawal
The server records choices by purpose, notice and purpose versions, acknowledgement time and the device/owner association; it does not store an IP address in the consent record. Withdrawal in any region stops the app from creating corresponding optional events and clears its own queue of those events. AppMetrica uses a shared internal buffer: delivery is enabled only when both purposes are allowed. With partial choices, permitted events may wait in that buffer; permitted Home Flip server analytics continues separately. Previously lawfully collected records and internal SDK bookkeeping may remain on the device and be sent after both purposes are allowed; withdrawal does not mean complete erasure of the internal buffer. The app does not reconstruct events it did not collect during refusal. Requests to erase information held by us and providers are handled separately from changing these settings.
6.3. Sanitized Android native crashes
After the permitted diagnostic gate opens, the app may record a Java/Kotlin crash: a fixed category, verified compiled-code coordinates and local hashed build, choice, environment and owner provenance. Original exception messages, cause chains, thread/file names, photos, prompts, links, emails and credentials are excluded. At most one sanitized record, up to 8 KiB and seven days, is stored outside device backups. A healthy restart hands it to AppMetrica only with matching context and permitted sending purposes; ownership changes, withdrawal or mismatched versions remove ineligible records. No record is created before the gate opens. This does not promise C++/NDK, ANR, earliest-startup or every OOM coverage. The SDK buffer limits above apply after handoff; hashing does not make these data anonymous.
7. Access and public links
Private project access is restricted through authorization. If you choose to publish a result by link, anyone receiving the link may view the published material and save a copy. Do not publish information that should remain private. Deleting material from our service does not delete copies held by others. We do not sell personal information or use photos or prompts for targeted advertising. Information may be disclosed to meet binding lawful requests or protect rights and safety.
8. Retention and deletion
Our server usage events are retained for 13 calendar months for annual comparisons and app improvement. Settled technical telemetry is retained for 180 days to investigate errors across several releases; unfinished operation records remain until their outcome is resolved. Superseded data-collection choices are retained for 13 months; current choices remain until the owner or device is erased so a saved refusal does not automatically expire. These periods do not set retention by external providers or backup systems. Account, project and file information remains while needed for your selected features, until deletion. Deleting an account revokes access and initiates cleanup of related server projects and files. Acknowledging the request means deletion has started, not that cleanup has finished; completion is recorded separately and the server retries failed cleanup. Necessary payment and minimal protective records follow separate accounting, duplicate-credit prevention, dispute or legal criteria. Backup copies are retired through the backup update cycle. The personal catalog and some materials are stored on your device; room cloud synchronization does not synchronize every file. Use app controls or clear app data on the device to remove local copies.
8.1. Invitations and duplicate-bonus protection
For invitations we retain a random personal code, private account attribution and credit receipts. At an eligible first registration with Apple or Google both participants immediately receive 6 permanent credits each; returning sign-in or registration after completed deletion does not earn another referral bonus. On Android the app may read the invitation delivered by Google Play at installation and its click or installation timestamps to preserve your specific invitation until sign-in; an organic installation alone earns no bonus. This necessary invitation delivery is not advertising tracking or optional analytics. The inviter history does not expose the invitee identity. Deletion acceptance disables the code; final erasure unlinks private associations with the erased account, while the other participant keeps already credited points and minimal credit history. At final erasure we retain a minimal pseudonymous protective record for the lifetime of the referral program: the sign-in provider, a cryptographic HMAC marker of its exact identifier and the date. It contains no raw Apple or Google identifier, name, email, credentials, photos or projects and is not optional analytics. It prevents deletion and new registration from obtaining another bonus. A technical failure leaves final cleanup pending recovery; accepting a request does not mean deletion is complete.
8.2. Protection after Google account deletion
After deletion completes, we remove raw Google and Firebase identifiers. To prevent an old sign-in proof from restoring the erased owner, we retain a minimal pseudonymous record: a cryptographic SHA-256 marker of the Google identifier and a cutoff for acceptable sign-in proofs. It contains no raw identifier, name, email, credentials, photos or projects, is not optional analytics, and remains while this protection mechanism operates. A new sign-in after completed deletion may create a new owner, but does not restore previous data.
8.3. AI-result reports
When you explicitly report a result, we retain the selected reason category, reporter and exact-result identifiers, dates and review status. Authorized operators may inspect that existing AI result for review and safety measures. This action does not open the original uploaded photo, create another result copy or publish the image. Report metadata and the last operator-session hash are retained for up to 180 days; related records are removed earlier following account deletion or session revocation, subject to asynchronous cleanup. Reports are not optional analytics and do not require analytics consent. Submission does not itself automatically block content.
9. Your rights
Depending on applicable law, you may request access and a copy, correction, deletion, restriction or portability, object to processing, and withdraw consent without affecting earlier lawful processing. Email service.aisloy@gmail.com. We may request proportionate verification of your connection to the account to protect it. We respond within the time required by applicable law. You may also complain to the relevant data protection authority. Delete an account in Profile with confirmation; contact us if you cannot sign in.
10. International processing and security
Providers may process information outside your country, where data protection rules may differ. Where mandatory international transfer requirements apply, the legally required grounds and safeguards must be used. We use secure connections and access controls; no transmission or storage can be guaranteed completely secure. Do not upload identification documents, payment details, medical information or photos of people without necessary permissions.
11. Children
The service is for interior visualization and is not intended to collect children’s data. Obtain parent or guardian consent where legally required. Contact us if a child’s data was supplied without required permission. A store age rating is not itself consent to data processing.