Privacy Policy
Last updated: October 15, 2026
1. Who we are
Makeup Master is made and operated by Li Solutions, Estonia. We are the data controller for personal data processed through the Makeup Master app and the website makeupmaster.app (the "Service"). You can reach us at support [at] makeupmaster [dot] app.
This policy explains what we collect, why, who we share it with, how long we keep it, and your rights. It applies to the app on iOS and Android and to the website. The app stores of Apple and Google, and the other providers named below, have their own policies for what they do as independent controllers.
In short: your photos are processed to create the makeup preview you asked for and are not kept on our servers. The app has no accounts and does not collect your name, email, contacts or precise location. We do not sell personal data. We identify your device by a hashed identifier to run the free tier and prevent abuse, and, with your permission on iOS, by your device's advertising identifier to measure where installs come from.
2. What we collect
2.1 Photos and generated images
- Selfies you take or pick from your gallery, and reference photos you pick or paste, are sent to our servers when you request a generation.
- Generated images are created by our AI provider from your photo and your choice of style, then sent back to your device.
Photos are processed in memory on our servers and by our AI provider for the time it takes to generate the image (up to a few minutes) and are then discarded. We never write them to storage, never look at them, never use them to train AI models, and never use them to identify you. The built-in example selfie is rendered on your device and is never sent anywhere.
On your device, the app keeps your selfies, reference photos and generated looks in its own library so you can view them again. They stay on your device until you delete them, clear local data in Settings, or uninstall the app. If you save a look to your photo gallery, that copy is stored by your device outside the app.
We do not perform facial recognition, do not create face templates or other biometric identifiers, and do not compare faces across photos or users. A photo is edited, not matched.
2.2 Device identifier
To run the free tier without accounts, the app derives a device key: a salted SHA-256 hash of a stable device identifier (the Android SSAID, or a random UUID stored in the iOS Keychain). The raw identifier never leaves your device. The device key is sent with every generation request and stored on our servers with:
- your free-credit balance and how each credit was granted (initial, invite, promo);
- the number of generation attempts today (for the daily limit);
- your invite code, the code you redeemed, and how many invite rewards you have received;
- how many times we have asked you to rate the app.
The device key survives reinstalling the app. It cannot be used to identify you by name, but it is personal data under GDPR because it singles out your device.
2.3 Subscription data
Subscriptions are handled by Apple or Google through our subscription provider, RevenueCat. We receive an anonymous app user id generated by RevenueCat and subscription status: which product, whether active, renewal and expiry dates, trial status and billing problems. We store the subscription status keyed by this id on our servers to verify that a request from a subscriber is entitled to unlimited generations. We never receive your name, payment card, billing address or store account details; Apple or Google keep those. The anonymous id is sent to our servers with generation requests and is separate from the device key.
2.4 Usage analytics and advertising identifier
The app reports events (for example: onboarding step viewed, selfie set, style selected, generation started, completed or failed with an error type, result saved or shared, paywall opened, purchase completed, setting changed, data cleared) and screens viewed, through Google Analytics for Firebase. Events carry the style, category and mode involved, never the photo. The app also reports a small set of user properties: plan (guest, trial, paid, churned), credits left, preferred mode, daily-look settings, theme and language. Firebase adds device model, OS version, app version, language, country derived from IP address, session timing and a random app-instance id.
The app also collects your device's advertising identifier (Google Advertising ID on Android; IDFA on iOS, only if you allow tracking when the app asks) and shares it with our analytics and attribution providers. We use it to measure which campaigns, invite links and ads bring people to the app and to report installs and purchases back to the platform that showed the ad. We do not use it to build advertising profiles of you or to show you ads inside the app. You can reset or delete the identifier in your device settings at any time, and on iOS you can decline or withdraw tracking permission in Settings, in which case attribution falls back to non-identifying, best-effort matching.
Our subscription provider forwards purchase and renewal events (product and price, no personal details) to the same analytics property so we can see revenue by feature.
2.5 Crash and diagnostic data
Through Firebase Crashlytics we receive crash reports and non-fatal errors: stack traces, device model, OS version, app version, free memory and disk, whether the device is rooted or jailbroken, the time of the crash, and a Crashlytics installation id. Crash reports never contain your photos.
2.6 Install attribution (Airbridge)
The "invite a friend" feature and our marketing measurement use Airbridge (AB180 Inc.) to work out where an install came from. When you tap an invite link or an ad, Airbridge records the click with the link, your IP address, user agent and time; when the app is first opened, the Airbridge SDK in the app reports the install with device information (model, OS version, language, timezone, IP address, an Airbridge-generated device id and, where available, the advertising identifier described in 2.4) and matches it to the click. On Android the Play Install Referrer is also used. Airbridge also receives the same product events as our analytics so we can measure whether invited or acquired users go on to use the app. Airbridge does not receive your photos.
2.7 Push notifications
If you allow notifications, the app registers a push token with Firebase Cloud Messaging and subscribes it to a general topic so we can send occasional announcements. The daily-look reminder is scheduled locally on your device and does not need a token. We do not store push tokens on our own servers.
2.8 App integrity
To keep our servers from being called by anything other than the genuine app, every request carries an integrity token issued by Google Play Integrity (Android) or Apple App Attest / DeviceCheck (iOS). Those services receive device and app signals defined by Google and Apple, and we receive only a pass/fail result.
2.9 Settings and local data
Your preferences (language, theme, preferred mode, daily-look style and time, favourites, notification settings) are stored on your device. Some are reported to analytics as user properties, as described in 2.4. Your library of photos and looks is stored on your device only (2.1).
2.10 Website
makeupmaster.app is hosted on Cloudflare. Cloudflare processes visitors' IP addresses and request logs to serve and protect the site. The site uses Google Analytics, loaded through Cloudflare, to count visits and page views, but only if you allow it in the cookie notice. Your choice is stored in a cookie on your device, and you can change it at any time under "Cookie settings" at the bottom of every page. If you decline, no analytics cookies are set. The invite link pages on the site redirect to the app stores and pass the invite code along; they store nothing.
2.11 What we do not collect
We do not collect your name, email address, phone number, contacts, precise location, browsing history, payment details, or the contents of your device's photo gallery beyond the photos you choose. There are no accounts and no passwords.
3. Why we process data and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Generate the makeup previews you request | Photos, style choice, device key, subscription id | Performance of a contract (Art. 6(1)(b)) |
| Run the free tier: grant, count and check credits; daily limit; invite rewards; promo codes | Device key, credit ledger, attribution data | Performance of a contract; legitimate interest in preventing abuse (Art. 6(1)(f)) |
| Verify subscriptions and give subscribers unlimited access | Anonymous subscription id, subscription status | Performance of a contract |
| Keep the Service secure and stop automated abuse | Integrity tokens, device key, request logs | Legitimate interest (Art. 6(1)(f)) |
| Understand how the app is used and improve it | Analytics events, screens, user properties, device information | Legitimate interest (Art. 6(1)(f)); consent where your local law requires it |
| Count visits to the website | Pages viewed, referrer, device and browser type, a visitor identifier stored in your browser | Consent (Art. 6(1)(a)), which you can withdraw under "Cookie settings" |
| Find and fix crashes | Crash and diagnostic data | Legitimate interest (Art. 6(1)(f)) |
| Measure where installs come from and whether invite links and campaigns work | Attribution data, advertising identifier | Consent on iOS (tracking permission); legitimate interest on Android (Art. 6(1)(f)), or consent where your local law requires it |
| Send the daily-look reminder and announcements | Push token, notification settings | Consent (your device-level permission), which you can withdraw at any time |
| Ask you to rate the app, at most a few times | Device key, count of prompts, subscription start date | Legitimate interest (Art. 6(1)(f)) |
| Comply with legal obligations and defend legal claims | Any of the above, as needed | Legal obligation (Art. 6(1)(c)); legitimate interest |
Where we rely on legitimate interests, we have assessed that the processing is limited, expected by users of an app like this, and does not override your rights. You can object at any time (Section 8).
4. How your photos are handled, step by step
- You pick a selfie (and, for the reference flow, a reference photo). The app sends the image, your style or mode choice, your device key and your subscription status to our servers, which run in the European Union.
- Our servers check the integrity token, the daily limit and your credits. No image is stored at this point.
- Our servers send the image and a text prompt to our AI provider, a large cloud provider, which generates the makeup image. Under the terms of the service we use, the AI provider does not use these requests to train or improve its models; it may retain them for a limited period solely to detect abuse of its policies.
- The generated image is returned to our servers, which return it to your device and, if you are not a subscriber, deduct one credit. Our servers hold the images in memory only and discard them when the request finishes.
- The result is stored in the app's library on your device.
Our server logs record request metadata (time, outcome, error codes, the device key) but never the image.
5. Who we share data with
We share personal data only with providers that process it for us under contract, and only what each one needs. None of it identifies you by name.
| Provider | What it does for us | What it receives | Where |
|---|---|---|---|
| Google (cloud and Firebase services) | Server hosting, database, analytics, crash reporting, push notifications, app integrity checks | Photos in transit, device key, subscription id, analytics and crash data, advertising identifier, push tokens, integrity signals | EU (servers); analytics and crash services may process in the US and elsewhere |
| Our AI provider (a large cloud provider) | Generates the makeup image | Photos and the generation prompt | Data centres that may be outside the EU |
| RevenueCat, Inc. | Subscription management and verification | Anonymous app user id, purchase receipts from the store, subscription status, the analytics app-instance id | US |
| AB180 Inc. (Airbridge) | Install attribution, related event measurement | Click and install data, device information, advertising identifier, product events | Japan and the United States |
| Apple Inc. / Google LLC (app stores) | Distribution, billing, subscriptions, Play Integrity / App Attest | As set out in their own policies; we receive no payment details | Per their policies |
| Cloudflare, Inc. | Website hosting and protection | Website visitor IP address and request logs | Global network |
Where we run ads for the app, the advertising platform that showed you an ad may receive confirmation that an install or purchase followed, matched through the advertising identifier, so that it can report campaign results to us.
We may also disclose data where the law requires it, to protect our rights or the safety of users, or to a successor if the business is sold or merged, in which case this policy will continue to apply.
We do not sell personal data and do not give any provider the right to use your photos for its own purposes.
6. How long we keep data
| Data | Where | Retention |
|---|---|---|
| Photos and generated images | Our servers and AI provider | Duration of the request only; never stored. The AI provider may retain requests for a limited period for abuse detection under its own terms |
| Photos and generated looks | Your device | Until you delete them, clear local data or uninstall |
| Credit ledger and invite state (device key) | Our database | While the device uses the Service and for 24 months after its last generation, then deleted |
| Daily attempt counter | Our database | 30 days |
| Rate-app prompt counter | Our database | Same as the credit ledger |
| Subscription status cache | Our database | While the subscription is active and for 12 months after it ends |
| Analytics events and user properties | Google Analytics | 14 months, then aggregated |
| Crash reports | Firebase Crashlytics | 90 days |
| Attribution data | Airbridge | As set in our Airbridge account's data retention settings |
| Push token | Firebase Cloud Messaging | Until the app is uninstalled or you revoke notification permission |
| Server logs | Our cloud provider | 30 days |
| Website server logs | Cloudflare | Per Cloudflare's retention |
Where we need to keep something longer to comply with law or resolve a dispute, we keep only what is necessary for that purpose.
7. International transfers
We are based in Estonia and our servers run in the EU. Some of our providers process data in the United States, Japan or other countries. Where personal data leaves the EU/EEA or UK, we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for providers certified under it) or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for details of the safeguards used for a particular provider.
8. Your rights
Depending on where you live, you have the right to access the personal data we hold about you, to correct it, to have it deleted, to receive it in a portable format, to restrict or object to processing, and to withdraw consent where processing is based on consent. Because the app has no accounts and we do not know your name, we recognise your data by your device key. To exercise a right, write to support [at] makeupmaster [dot] app and include the Support ID shown in the app's Settings so we can find the records that belong to your device. We answer within one month.
You can also act directly:
- Delete your photos and looks: delete items in the library, or use "Clear local data" in Settings. Uninstalling the app removes everything stored on the device.
- Notifications: switch off the daily look in Settings, or revoke the app's notification permission in your device settings.
- Analytics and crash reporting: you can object by contacting us.
- Advertising identifier and attribution: on iOS, decline or withdraw tracking permission under Settings > Privacy & Security > Tracking; on Android, reset or delete your advertising id under Settings > Google > Ads.
- Subscription data: manage or cancel your subscription in your App Store or Google Play account.
If you are in the EU/EEA or UK, you can lodge a complaint with your data-protection authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).
9. Children
The Service is not directed to children under 18 and we do not knowingly collect personal data from them. If you believe a child under 18 has used the app, contact us and we will delete the associated server-side records. Do not provide photos of children.
10. Security
We protect personal data with encryption in transit (TLS) for every request, encryption at rest in our database, app integrity checks that keep our servers from being called by modified apps or scripts, access controls that limit who at Li Solutions can reach production systems, and by not storing photos at all, which is the most effective protection for the most sensitive data we touch. No system is perfectly secure, and we cannot guarantee that unauthorised access will never occur; if a breach affects you, we will notify you and the authorities as the law requires.
11. California residents
We do not sell personal information. We collect the following categories of personal information for the business purposes described in Section 3: identifiers (hashed device key, anonymous subscription id, advertising identifier, push token, and IP address, which our service providers receive to serve requests and which we do not store); internet or electronic activity (app usage events, crash data); geolocation at country level derived from IP address; and, transiently, visual information (photos) processed at your request and not retained. We disclose these to the service providers listed in Section 5 for business purposes only. Sharing the advertising identifier with an advertising platform to measure whether an ad led to an install may count as "sharing" under California law; you can opt out by declining tracking permission on iOS or resetting your advertising id on Android, or by contacting us. California residents may exercise the rights to know, delete, correct and to non-discrimination by contacting us as in Section 8. We do not respond to "Do Not Track" signals.
12. Do Not Track
The app does not process browser "Do Not Track" signals. Tracking for attribution is controlled by your device's tracking and advertising-id settings, described in Section 8.
13. Changes to this policy
We may update this policy as the Service changes. For material changes we will notify you in the app or on the website before they take effect. The "Last updated" date shows the current version; earlier versions are available on request.
14. Contact
Li Solutions
Data protection contact: support [at] makeupmaster [dot] app
Website: makeupmaster.app
See also our Terms of Service.