Privacy Policy

Effective [Effective date]

The short version

We don't store your photos or your previews. They are processed in memory and sent straight back to your browser.
Tapping Delete, or closing the tab, removes them from the page immediately. We keep no copy, so nothing can be recovered.
Our AI provider, Google, never uses them for training and keeps them only briefly, solely to detect abuse (section 4).
No account, no advertising trackers, and we never sell your data.

1. Who we are

CutMirror is operated by [Operator legal name], [operator address and country] ("we", "us"). Questions about this policy or your data: privacy@cutmirror.com.

2. What we process

The photo you choose and the looks you pick. Used only to create your previews.
Basic technical data such as IP address, browser type, request time and status. Our hosting provider, Google Cloud, records this in standard request logs to deliver the site and protect it from abuse. The logs never contain your photo and are kept for 30 days.
A free-preview counter. To keep free previews fair and our costs in check, we count how many previews each network uses per day. We store only a keyed one-way hash of your IP address next to a number, never the address itself, and the counter is deleted automatically within about two days.
A security check. Before your first preview, Cloudflare Turnstile checks that you're a person, not a bot. Cloudflare processes technical signals such as your IP address and browser details for this, under its own privacy policy. Most people never see it.

When you pass the security check, we set one strictly necessary cookie. It lasts an hour and contains only a random code and an expiry time, nothing about you. We do not use advertising or analytics cookies. If that changes, we will update this policy and ask where the law requires it.

3. How a preview is made

Your browser resizes and re-encodes the photo. This removes embedded metadata such as GPS location and camera details.
The photo is sent over an encrypted (HTTPS) connection to our server.
Our server passes it to our AI processing provider, Google LLC, through the paid Gemini API, where Google's Nano Banana image model creates the preview.
The preview is returned directly to your browser. Our server holds the photo in memory only while your request runs, usually under a minute, and never writes it to disk, logs or caches it.

4. Storage, deletion and retention

On our side: we do not store photos or previews at all. Your previews exist only in the browser tab where you created them. Tapping "Delete photo and results" removes them from the page immediately, and closing the tab does the same. Because we never kept a copy, there is nothing for us to recover.

At our AI provider: we use Google's paid Gemini API. Under Google's terms for paid services, Google does not use your photo or previews to train or improve its products. Every request turns off Google's conversation storage, previews are accepted only when returned directly rather than hosted as a file, and request logging is switched off for our project. Google does keep a copy of requests for a limited period, solely to detect violations of its usage policies, after which it is deleted. [Before launch: confirm this period with Google, or move to Vertex AI for zero data retention, and update this paragraph.]

Downloads: previews you download are saved on your own device and are under your control.

5. Faces and biometric information

Your photo shows your face. We do not create, collect or store biometric identifiers or templates (such as faceprints or face geometry), and we never use photos to identify anyone. The AI model edits the image to change the hair. Some laws, including those of Illinois, Texas and Washington, regulate biometric data. To respect them, we ask for your consent before any photo is processed, and we destroy photos when the request is complete, as described in section 4. This section is our written retention and destruction policy.

6. How we use information

Only to create your previews, keep the service secure and working, and meet legal obligations. We do not use your photos to train AI models, build profiles or target advertising.

7. Who we share it with

Hosting: Google LLC (Google Cloud Run and Firebase Hosting), which runs our website and server.
Security and domain name service: Cloudflare, Inc. (Turnstile and DNS), as described in section 2.
AI processing: Google LLC (Gemini API), as described in sections 3 and 4.
Payments (if you buy a paid feature): [merchant of record, e.g. Paddle], which handles checkout under its own privacy policy. We never see your full card details.

Each provider may use the data only to provide its service to us. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

8. Your rights

Depending on where you live, including California and other U.S. states, the EU and the UK, you may have the right to access, correct or delete your personal information, to object to or restrict its use, and to opt out of its sale or sharing. Since we don't keep your photos, there is usually nothing stored to access or delete. You can still contact us at privacy@cutmirror.com, and we will respond within the time the law requires. We will never treat you differently for using these rights.

9. Age requirement

CutMirror is for adults aged 18 and over. It is not directed at children, and photos of minors must not be uploaded. If we learn that we have processed information about a child, we will delete it.

10. Where data is processed

Our server runs in the United States (Google Cloud, Iowa), and requests reach it through Google's global network. Google may process the photo in the United States or other countries where it operates. If you use CutMirror from elsewhere, your photo is transferred only to create your preview, with the safeguards described above.

11. AI-generated content

Previews are created by artificial intelligence and are labeled as AI previews. Downloaded images carry a visible "AI-generated preview" label. Please don't present them as real photographs.

12. Security

We protect data in transit with encryption, and we avoid storing photos at all, so there is no photo archive to breach. No system is perfectly secure, but not keeping your photo is the strongest protection we can offer.

13. Changes and contact

If we change this policy, we will post the new version here with a new effective date. For material changes, we will give prominent notice on the site. Contact: privacy@cutmirror.com.