ManeDraft Privacy Policy

1. Who we are

ManeDraft (the "app") is an Android app that uses AI to create hairstyle previews from your own photos. It is operated by Click AI Limited ("we", "us"). For privacy questions, contact [email protected].

The app is for adults aged 18 and over.

2. Summary

You upload photos of yourself. When you confirm a generation, we send the photos needed for it to a third-party AI image service, only so that it can create the preview (see section 5).
Your photos and generated looks are kept in private storage, never in public storage. There is no public feed.
We do not use your photos for advertising, to build identity or face-recognition databases, or to train our own AI models. We do not sell your photos.
Ads play only when you choose to watch a rewarded ad. Google's ad software is part of the app and collects device data (see section 7).
You can delete individual photos and looks, or your whole account, in the app or at https://manedraft.com/delete-account.

3. Information we collect

Category	What we collect	Source
Account	Your email address if you sign in with email. If you use Google Sign-In: your Google account ID, email address and name (the name pre-fills your display name). A sign-in session for each device.	You; Google
Profile	Display name, birth date, and gender (male or female).	You
Photos	A front photo (required) and, if you add them, left-side, right-side, back and top-view photos. We store a standardized copy with location and other metadata removed, plus smaller previews.	You, via the camera or the Android photo picker
Looks	Generated images, the hairstyle you chose or the description you typed, the views you selected, the status of each generation, credits charged and returned, and favorites.	You; our service
Credits and purchases	Your credit balance and history. Google Play purchase and subscription records: order ID, product, price and currency, dates, status, refunds, and the purchase token (stored encrypted). We never receive your card or other payment details.	Google Play; our service
Rewarded ads	Reward offers you start, Google's verified confirmation of each completed ad (transaction ID, ad unit, time, credits granted), and the ad revenue estimate that the ad software reports for each ad you watch. The estimate never affects your credits.	Google AdMob; the app
Device and notifications	Push notification token, app version, device language, device model, time zone, and whether notifications are allowed. We keep this for up to 5 recent devices.	The app; Firebase
Usage	The days you used the app and your approximate country, which our hosting provider derives from your IP address. Milestones such as completing your profile, your first generation, and your first save or share. When we showed the app-rating prompt (we never see your rating).	The app; our service
Reports and support	Reports you send with "Report this result" (a reason and an optional note), and messages you send us.	You
Consent records	Which version of the Terms, this Privacy Policy and the AI photo processing notice you accepted, and when.	You
Security	When you request a sign-in or account-deletion code, keyed hashes of your email address and IP address (not the addresses themselves), used to limit abuse. Technical request logs.	The app; our service

We do not collect your precise location or your contacts. We only receive the photos you pick, not the rest of your photo library.

4. How we use information

To provide the app. We create and secure your account, store your photos, generate and show your looks, and notify you when a look is ready.
For credits, purchases and subscriptions. We verify purchases with Google Play, add and expire credits, apply refunds and restore purchases.
For rewarded ads. We confirm rewards with Google, add the credits and enforce daily limits.
For the age check. Your birth date is used only to confirm you are 18 or older. It is also shown in your profile.
For hairstyle ordering. Your gender is used only to decide which hairstyles we show first. Every style stays available to everyone.
For safety and fraud prevention. We apply rate limits, prevent repeated sign-up bonuses (see section 9), review reports and enforce our Terms.
To run the service. We produce aggregate statistics (for example daily active users, conversion and revenue), monitor and fix problems, and estimate whether the app may have been uninstalled when all of a user's push tokens stop working.
For support. We use what you send us to answer your requests.

We do not send your name, email address, birth date or gender to the AI image service or to ad networks. We do not use your photos or looks in our marketing without your permission. We do not share them with Click AI Limited's other apps. We currently send only service messages: sign-in and account-deletion codes by email, and generation updates as push notifications.

5. Your photos and the AI image service

Nothing is sent to the AI service until you confirm a generation. Before you add your first photo, the app asks you to agree to this processing, and our server does not start a generation unless that agreement is on record.
We send your photos to the AI service for one purpose only: to create the previews you ask for.
For each view you confirm, our server sends the AI service only what it needs: your front photo, your photo of the matching view if you added one, the hairstyle reference image or your text description (with any style, length or texture options you picked), a view already generated in the same request so that the views match, and our fixed instructions. The photos we send are the standardized copies with location and other metadata removed. We do not send your name, email address, birth date, the gender in your profile or your account ID.
The AI service we currently use is ValueAPI (api.valueapi.ai), with the image model it offers under the name "nano-banana-2". ValueAPI and the operator of the model it uses process each request on their own systems, which may be outside your province, state or country, including in the United States.
ValueAPI and the model operator handle what they receive under their own terms and practices, which we do not control. We cannot tell you how long they keep photos and results, and we cannot promise that they will not use them for their own purposes, such as improving their models.
The generated image comes back to our server and is saved in our private storage.
If you delete a photo or your account, we delete our own copies, but we have no way to recall or delete copies the AI service has already received.
We do not use face recognition. We do not create, store or share face templates, faceprints or other biometric identifiers from your photos, and we do not use your photos to identify you or anyone else. We ask the AI service only to change the hairstyle in the picture, not to identify anyone.

6. Where your photos and looks are kept and who can see them

Photos and looks are stored in private Cloudflare R2 storage, never in public storage, and there are no public links to them. They can only be read through our server, which first checks your session and that the image belongs to you.
A limited number of authorized staff can view a particular user's photos or looks, and only when needed to handle a report, a support request or suspected abuse. Every view is recorded in an audit log.
On your phone, the app keeps a cache of images in its private storage. The cache is cleared when you sign out, switch accounts or delete your account. Images you save to your gallery or share with others are outside our control.

7. Who we share information with

Recipient	What they receive	Why
Cloudflare	All data our service stores, plus IP addresses and request data	Hosting, database, private storage, image standardization and metadata removal, and delivering sign-in and account-deletion code emails
AI image service (ValueAPI and the model operator)	The photos and the hairstyle reference or description for each generation you confirm	Creating your previews (section 5)
Google Play	Your purchases, linked to a random internal account ID (never your email address)	Payments, subscriptions and refunds. Google also notifies our server when a subscription changes.
Google Sign-In	Your sign-in request (we receive your Google account ID, email address and name)	Signing in, if you choose Google
Google AdMob, including Google's consent message (UMP)	Device data collected by the ad software: advertising ID, app set ID, IP address (used for approximate location), ad interactions and diagnostics. For reward checks, also your random internal account ID and a random reward ID.	Showing and measuring rewarded ads, preventing ad fraud, and confirming rewards
Firebase Cloud Messaging (Google)	Push token, app version and device details; each notification's short status text and internal IDs, never your photos	Delivering "your look is ready" notifications
Authorities, courts and others, when required	Only what is required	Complying with a law, a court order or a lawful request from an authority, and protecting the rights and safety of our users, the public and ourselves
A new operator of the app	The information needed to keep the service running	If the app or our business is sold, merged or reorganized. We will tell you before your information becomes subject to a different privacy policy.

Google describes how it uses data from apps that use its services at https://policies.google.com/technologies/partner-sites. Cloudflare's privacy policy is at https://www.cloudflare.com/privacypolicy/.

The app has no attribution or marketing-analytics software.

Selling and sharing. We do not sell your personal information for money, and we never sell or share your photos or looks for advertising. We do let Google's ad software in the app collect the device data listed above so that rewarded ads can be shown and measured. Some U.S. state privacy laws define "sale", "sharing" or "targeted advertising" broadly enough that they may cover this. Section 8 explains how to opt out. The app is for adults only, and we do not knowingly sell or share the personal information of anyone under 18.

8. Ads, notifications and your choices

Rewarded ads play only when you tap "Watch 1 ad to earn N credits". There are no ads while you browse or while a look is being generated.
Google's ad software starts when you open the app (where Google's consent rules allow) and may collect the device data in section 7 even if you never watch an ad.
Where required, Google's consent message appears before ads are shown.
To opt out of the use of your data for personalized ads, you have two options:
- In the app, go to Settings → Ad privacy choices. If Google offers privacy choices for your region, this opens Google's form, where you can review and change them. If it does not, the app tells you so, and you can use the next option.
- In your Android settings, delete your advertising ID (Settings → Privacy → Ads → Delete advertising ID; the path can differ by device). Apps that ask for the ID then receive only zeros, so it can no longer be used to personalize ads. This option is available whatever your region.
You never have to watch an ad to use the app.
We ask for notification permission after your first generation. You can turn notifications off at any time in Android settings.

9. How long we keep information

Data	How long we keep it
Account, profile and consent records	Until you delete your account
Photos	Until you replace or delete them, or delete your account. A replaced photo is deleted once no generation in progress still uses it.
Looks and generation history	Until you delete the look or your account
Sign-in sessions	A session expires after 30 days without use. Records are deleted with your account.
Device and notification data	Until you sign out on that device or delete your account (at most 5 devices per account)
Usage records, reports and ad revenue estimates	Until you delete your account
Purchase and subscription records, ad reward confirmations, generation cost records, staff audit records and the record of a deletion request	Kept after account deletion, linked only to a random internal ID, for as long as we need them for accounting, tax, refunds, fraud prevention and our legal obligations
Sign-up block after account deletion	30 days, stored only as a keyed hash of your email address and Google account ID
Security records of sign-in and deletion code requests (hashes)	About one day. They are deleted automatically.
Technical logs	Our server's request and error logs are kept in Cloudflare's log service for up to 7 days
Backup and recovery copies	We make no separate backups of your photos or looks. Cloudflare's database recovery feature can restore our databases to an earlier point from up to 30 days back, so database records we have deleted can remain in those recovery copies for up to 30 days. We would use them only to recover the service after a failure.
Copies held by the AI image service	Decided by ValueAPI and the model operator under their own terms, which we do not control (section 5)

We may keep aggregate statistics that do not identify you.

10. Deleting your information

To delete one photo or all of them, go to Profile → Photos. To delete a look, open it in My Looks and use its menu.
To delete your account, go to Settings → Delete account in the app, or visit https://manedraft.com/delete-account and confirm with a code we email to you.
Your account is closed immediately. We then delete your photos and personal data from our active systems. Our target is to finish within 24 hours of your request, and the status page shows when deletion is complete. Generations already sent to the AI service finish first and are then deleted, and deletion also waits for any Google Play operation on your account that is still in progress, so in those cases it can take longer.
We keep only the records, the 30-day sign-up block and the short-lived logs and recovery copies described in section 9.
Deleting your account does not refund anything, and any remaining credits are lost. If you have a subscription, the deletion form offers to cancel future renewals for you. If you don't choose that, or if cancellation fails, cancel the subscription in Google Play to avoid further charges.
The full details are at https://manedraft.com/delete-account.

11. Security

All connections to our service use HTTPS.
Private images can only be read through our server after it checks your session and ownership.
Sign-in codes and session tokens are stored only as hashes. Purchase tokens are encrypted.
Our logs are designed to leave out sign-in codes, tokens, full purchase tokens and private image links.
Staff access to user data is restricted and logged.

No method of storing or sending data is completely secure.

12. Children

ManeDraft is only for people aged 18 and over and is not directed to children. You enter your birth date when you set up your profile, and you cannot continue if you are under 18. If we learn that someone under 18 has an account, we will delete it. If you believe a minor is using the app, contact [email protected].

13. Where information is processed

Cloudflare hosts our data. We have asked Cloudflare to keep our main database and our private image storage in its Eastern North America region. Cloudflare treats this as a preference, not a guarantee. Some account data is held at a Cloudflare location near where the account was first used, and requests may be handled anywhere in Cloudflare's global network.

The AI image service and the operator of the model it uses process photos on their own systems. We do not know or control where those systems are (section 5).

Your information may therefore be processed outside your province, state or country, including in the United States. While it is in another country, it is subject to that country's laws, and courts, law enforcement and national security authorities there may be able to access it.

14. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal information, to get a copy of it, to withdraw consent, and to complain to a regulator. You can view your profile in the app and delete your photos, looks and account yourself. For anything else, email [email protected]. We will not treat you differently for exercising your rights.

Privacy contact: [email protected]. Messages to this address reach the person responsible for how we handle personal information.

How requests work

Email [email protected] from the email address of your account and tell us what you are asking for.
We may need to verify that the request comes from you, for example by sending a code to the email address of your account. We use what you send for verification only for that.
We answer within 30 days of receiving your request. If the law allows more time and we need it, we will tell you why, and when to expect our answer, within those 30 days.
We do not charge a fee, unless a request is clearly unfounded or excessive, in which case we will tell you before doing anything.
If we refuse all or part of a request, we will tell you why and how to appeal.

If you live in the United States

Several U.S. states, such as California, have privacy laws that give residents the rights below. We apply them to every user in the United States, whichever state you live in.

Know and access. You can ask what personal information we hold about you, where it came from, what we use it for and who receives it, and you can ask for a copy. Sections 3, 4, 7 and 9 describe the categories of information we collect, why, who receives them and how long we keep them.
Correct. You can ask us to correct personal information that is wrong.
Delete. You can delete your photos, looks and account yourself (section 10), or ask us to do it.
Get a copy you can take elsewhere. You can ask for the personal information you gave us in a commonly used electronic format.
Opt out of sale, sharing and targeted advertising. We do not sell personal information for money. For the ad data described in section 7, use the choices in section 8, or email us if you need help.
Sensitive information. We use sensitive information, such as your photos and your sign-in details, only to provide the service and keep it safe, and not to work out characteristics about you.
No significant automated decisions. We do not use your information to make automated decisions that have legal or similarly significant effects on you.
No discrimination. We will not refuse you the service, charge you a different price or give you a lower quality of service because you used one of these rights.
Authorized agent. Someone you authorize can make a request for you. We will ask for proof of your written permission and may ask you to confirm the request yourself.
Appeal. If we refuse a request, you can appeal by replying to our answer or emailing [email protected] with the subject "Privacy appeal". We answer appeals within 45 days. If you are still not satisfied, you can contact the attorney general or the privacy regulator of your state.

Face photos and biometric laws. Some states have laws about biometric identifiers such as face geometry. As section 5 explains, we do not use face recognition, and we do not create, store or share face templates or any other biometric identifier. The app asks for your agreement before your first photo is added and sent for AI processing.

If you live in Canada

Access and correction. You can ask whether we hold personal information about you, ask for a copy, and ask us to correct it.
Withdrawing consent. You can withdraw your consent at any time, subject to legal or contractual limits. To withdraw consent to AI photo processing, stop confirming generations and delete your photos or your account. To change your ad choices, see section 8. To stop notifications, turn them off in Android settings. Without your photos we cannot create previews, and withdrawing consent does not undo generations that have already been sent.
Processing outside Canada. Your information may be stored and processed outside Canada and outside your province, including in the United States (section 13).
Copy in a technological format (Quebec). If you live in Quebec, you can ask for the personal information you gave us in a structured, commonly used technological format.
Complaints. Please contact us first so we can try to fix the problem. You also have the right to complain to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca) or to the privacy regulator of your province, such as the Commission d'accès à l'information du Québec.

15. Changes to this policy

We will post any changes on this page. For material changes, we will tell you in the app and, where required, ask you to accept the new version.

16. Contact

Click AI Limited · [email protected] · https://manedraft.com