ManeDraft
Draft — pending company approval
ManeDraft Privacy Policy
1. Who we are
ManeDraft (the "app") is an Android app that uses AI to create hairstyle previews from your own photos. It is operated by Click AI Limited ("we", "us"). For privacy questions, contact support@manedraft.com.
The app is for adults aged 18 and over.
2. Summary
- You upload photos of yourself. When you confirm a generation, we send the photos needed for it to a third-party AI image service, which creates the preview.
- Your photos and generated looks are kept in private storage, never in public storage. There is no public feed.
- We do not use your photos for advertising, to build identity or face-recognition databases, or to train our own AI models. We do not sell your photos.
- Ads play only when you choose to watch a rewarded ad. Google's ad software is part of the app and collects device data (see section 7).
- You can delete individual photos and looks, or your whole account, in the app or at https://manedraft.com/delete-account.
3. Information we collect
| Category | What we collect | Source |
|---|---|---|
| Account | Your email address if you sign in with email. If you use Google Sign-In: your Google account ID, email address and name (the name pre-fills your display name). A sign-in session for each device. | You; Google |
| Profile | Display name, birth date, and gender (male or female). | You |
| Photos | A front photo (required) and, if you add them, left-side, right-side, back and top-view photos. We store a standardized copy with location and other metadata removed, plus smaller previews. | You, via the camera or the Android photo picker |
| Looks | Generated images, the hairstyle you chose or the description you typed, the views you selected, the status of each generation, credits charged and returned, and favorites. | You; our service |
| Credits and purchases | Your credit balance and history. Google Play purchase and subscription records: order ID, product, price and currency, dates, status, refunds, and the purchase token (stored encrypted). We never receive your card or other payment details. | Google Play; our service |
| Rewarded ads | Reward offers you start, Google's verified confirmation of each completed ad (transaction ID, ad unit, time, credits granted), and the ad revenue estimate that the ad software reports for each ad you watch. The estimate never affects your credits. | Google AdMob; the app |
| Device and notifications | Push notification token, app version, device language, device model, time zone, and whether notifications are allowed. We keep this for up to 5 recent devices. | The app; Firebase |
| Usage | The days you used the app and your approximate country, which our hosting provider derives from your IP address. Milestones such as completing your profile, your first generation, and your first save or share. When we showed the app-rating prompt (we never see your rating). | The app; our service |
| Reports and support | Reports you send with "Report this result" (a reason and an optional note), and messages you send us. | You |
| Consent records | Which version of the Terms, this Privacy Policy and the AI photo processing notice you accepted, and when. | You |
| Security | When you request a sign-in code, keyed hashes of your email address and IP address (not the addresses themselves), used to limit abuse. Technical request logs. | The app; our service |
We do not collect your precise location or your contacts. We only receive the photos you pick, not the rest of your photo library.
4. How we use information
- To provide the app. We create and secure your account, store your photos, generate and show your looks, and notify you when a look is ready.
- For credits, purchases and subscriptions. We verify purchases with Google Play, add and expire credits, apply refunds and restore purchases.
- For rewarded ads. We confirm rewards with Google, add the credits and enforce daily limits.
- For the age check. Your birth date is used only to confirm you are 18 or older. It is also shown in your profile.
- For hairstyle ordering. Your gender is used only to decide which hairstyles we show first. Every style stays available to everyone.
- For safety and fraud prevention. We apply rate limits, prevent repeated sign-up bonuses (see section 9), review reports and enforce our Terms.
- To run the service. We produce aggregate statistics (for example daily active users, conversion and revenue), monitor and fix problems, and estimate whether the app may have been uninstalled when all of a user's push tokens stop working.
- For support. We use what you send us to answer your requests.
We do not send your name, email address, birth date or gender to the AI image service or to ad networks. We do not use your photos or looks in our marketing without your permission. We do not share them with Click AI Limited's other apps. We currently send only service messages: sign-in and account-deletion codes by email, and generation updates as push notifications.
5. Your photos and the AI image service
- Nothing is sent to the AI service until you confirm a generation. Before your first photo upload, the app asks you to agree to this processing.
- For each generation, our server sends the AI service only what it needs: your front photo, your photo of the matching view if you added one, the hairstyle reference image or your text description, and our fixed instructions. It does not send your name, email address, birth date or gender.
-
We currently use ValueAPI
[TO CONFIRM WITH PROVIDER: legal entity, address, and relationship to Click AI Limited]with the "nano-banana" image model from Google's Gemini family. ValueAPI passes each request on to the model's operator.[TO CONFIRM WITH PROVIDER: downstream processors and the countries where processing happens] -
How long ValueAPI and its downstream processors keep your photos and results, whether
they use them to train or improve models, and whether they can delete them:
[TO CONFIRM WITH PROVIDER]. - The generated image comes back to our server and is saved in our private storage.
- If you delete a photo or your account, we cannot recall copies the AI service has already received. Their retention is covered in the point above.
- We do not create or store face-recognition templates from your photos, and we do not use your photos to identify you.
6. Where your photos and looks are kept and who can see them
- Photos and looks are stored in private Cloudflare R2 storage, never in public storage, and there are no public links to them. They can only be read through our server, which first checks your session and that the image belongs to you.
- A limited number of authorized staff can view a particular user's photos or looks, and only when needed to handle a report, a support request or suspected abuse. Every view is recorded in an audit log.
- On your phone, the app keeps a cache of images in its private storage. The cache is cleared when you sign out, switch accounts or delete your account. Images you save to your gallery or share with others are outside our control.
7. Who we share information with
| Recipient | What they receive | Why |
|---|---|---|
| Cloudflare | All data our service stores, plus IP addresses and request data | Hosting, database, private storage, image standardization and metadata removal, and delivering sign-in emails |
| AI image service (ValueAPI and the model operator) | The photos and the hairstyle reference or description for each generation you confirm | Creating your previews (section 5) |
| Google Play | Your purchases, linked to a random internal account ID (never your email address) | Payments, subscriptions and refunds. Google also notifies our server when a subscription changes. |
| Google Sign-In | Your sign-in request (we receive your Google account ID, email address and name) | Signing in, if you choose Google |
| Google AdMob, including Google's consent message (UMP) | Device data collected by the ad software: advertising ID, app set ID, IP address (used for approximate location), ad interactions and diagnostics. For reward checks, also your random internal account ID and a random reward ID. | Showing and measuring rewarded ads, preventing ad fraud, and confirming rewards |
| Firebase Cloud Messaging (Google) | Push token, app version and device details; each notification's short status text and internal IDs, never your photos | Delivering "your look is ready" notifications |
| Authorities and others, when required | Only what is required |
Complying with the law, protecting rights and safety, or as part of a merger or
acquisition
[TO CONFIRM WITH COUNSEL]
|
Google describes how it uses data from apps that use its services at https://policies.google.com/technologies/partner-sites. Cloudflare's privacy policy is at https://www.cloudflare.com/privacypolicy/.
The app has no attribution or marketing-analytics software. We do not sell your personal
information.
[TO CONFIRM WITH COUNSEL: whether AdMob advertising counts as a "sale" or "sharing"
under U.S. state privacy laws, and the opt-out wording required.]
8. Ads, notifications and your choices
- Rewarded ads play only when you tap "Watch 1 ad to earn N credits". There are no ads while you browse or while a look is being generated.
- Google's ad software starts when you open the app (where Google's consent rules allow) and may collect the device data in section 7 even if you never watch an ad.
- Where required, Google's consent message appears before ads are shown. You can review your choices at any time in Settings → Ad privacy choices.
- You can reset or delete your advertising ID in your Android settings.
- We ask for notification permission after your first generation. You can turn notifications off at any time in Android settings.
9. How long we keep information
| Data | How long we keep it |
|---|---|
| Account, profile and consent records | Until you delete your account |
| Photos | Until you replace or delete them, or delete your account. A replaced photo is deleted once no generation in progress still uses it. |
| Looks and generation history | Until you delete the look or your account |
| Sign-in sessions | A session expires after 30 days without use. Records are deleted with your account. |
| Device and notification data | Until you sign out on that device or delete your account (at most 5 devices per account) |
| Usage records, reports and ad revenue estimates | Until you delete your account |
| Purchase and subscription records, ad reward confirmations, generation cost records and staff audit records |
Kept after account deletion, linked only to a random internal ID, for accounting,
refunds and fraud prevention, for
[RETENTION PERIOD TO BE SET BY COMPANY]
|
| Sign-up block after account deletion | 30 days, stored only as a keyed hash of your email address and Google account ID |
| Security records of sign-in code requests (hashes) | [TO CONFIRM: SIGN-IN CODE RECORD RETENTION] |
| Technical logs | [TO CONFIRM: LOG RETENTION] |
| Backup and recovery copies | [TO CONFIRM: BACKUP / RECOVERY WINDOW] |
| Copies held by the AI image service | [TO CONFIRM WITH PROVIDER] |
We may keep aggregate statistics that do not identify you.
10. Deleting your information
- To delete one photo or all of them, go to Profile → Photos. To delete a look, open it in My Looks and use its menu.
- To delete your account, go to Settings → Delete account in the app, or visit https://manedraft.com/delete-account and confirm with a code we email to you.
-
Your account is closed immediately. Your photos and personal data are deleted from our
active systems within 24 hours
[SERVICE TARGET — TO BE MEASURED BEFORE PUBLISHING]. Generations already sent to the AI service finish first and are then deleted. - We keep only the records and the 30-day sign-up block described in section 9.
- Deleting your account does not refund anything, and any remaining credits are lost. If you have a subscription, the deletion form offers to cancel future renewals for you. If you don't choose that, or if cancellation fails, cancel the subscription in Google Play to avoid further charges.
- The full details are at https://manedraft.com/delete-account.
11. Security
- All connections to our service use HTTPS.
- Private images can only be read through our server after it checks your session and ownership.
- Sign-in codes and session tokens are stored only as hashes. Purchase tokens are encrypted.
- Our logs are designed to leave out sign-in codes, tokens, full purchase tokens and private image links.
- Staff access to user data is restricted and logged.
No method of storing or sending data is completely secure.
12. Children
ManeDraft is only for people aged 18 and over and is not directed to children. You enter your birth date when you set up your profile, and you cannot continue if you are under 18. If we learn that someone under 18 has an account, we will delete it. If you believe a minor is using the app, contact support@manedraft.com.
13. Where information is processed
Cloudflare hosts our data (storage location:
[TO CONFIRM: DATA STORAGE REGION(S)]), and requests may be handled anywhere
in Cloudflare's global network. The AI image service processes photos in
[TO CONFIRM WITH PROVIDER]. Your information may therefore be processed
outside your province, state or country, including in the United States.
14. Your rights
Depending on where you live, you may have the right to access, correct or delete your personal information, to get a copy of it, to withdraw consent, and to complain to a regulator. You can view your profile in the app and delete your photos, looks and account yourself. For anything else, email support@manedraft.com. We may need to verify your identity first. We will not treat you differently for exercising your rights.
Privacy contact: support@manedraft.com.
[TO CONFIRM WITH COUNSEL: U.S. state privacy rights (for example California) and
response times; Canada (PIPEDA) and Quebec (Law 25) requirements, including the person
in charge of personal information and notice of processing outside Quebec and
Canada.]
15. Changes to this policy
We will post any changes on this page with a new effective date. For material changes, we will tell you in the app and, where required, ask you to accept the new version.
16. Contact
Click AI Limited · support@manedraft.com · https://manedraft.com