Sepiane
Privacy Policy
Sepiane is an iOS app that gives you an AI critique of your photographs. This policy explains exactly what we collect, why, where it goes, how long we keep it, and how you delete it. It is written to be read, not to be skimmed past.
The app and this service are operated by César Rosales (Rosales Studio), Buenos Aires, Argentina — the data controller for the purposes of Argentine Law 25.326 and, where it applies, the GDPR. Contact: icesarrosales@icloud.com.
1. What we collect
| Data | Why | When |
|---|---|---|
| Email address, and the name you choose to share | To create and identify your account, and to let you sign back in. | When you sign up with email, Apple or Google. |
| The photos you submit | To produce the critique. The image is uploaded to our storage and sent to our AI provider for analysis. | Each time you ask for a critique. |
| Photo metadata (EXIF) — camera, lens, shutter, aperture, ISO, focal length, capture date | To make the critique specific to how the shot was taken. | Read from the photo you submit, when present. |
| Critique results — scores, written feedback, categories, hashtags | To build your history, streaks and weekly brief. | Each analysis. |
| Credit and purchase records — credits granted, spent and refunded, and the App Store transaction id | To keep your balance correct and to stop a purchase being credited twice. | On purchase and on each critique. |
| Usage events — which features you use (for example "analysis submitted", "store viewed"), the app version, and the time | To understand which parts of the app are used and where people get stuck, so we can improve it. Events never include your photos, scores, text you type, or your location. | While you use the app, on our own servers only. No third-party analytics or advertising SDK is involved. |
| The city you pick for golden-hour times | To compute sunrise and sunset for that place. | Only if you choose a city. Stored on your device. |
We do not use your device location. Sepiane does not request GPS access and does not track where you are. Golden hour is calculated from a city you type in yourself, and that choice never leaves your phone.
We do not run advertising, ad networks, third-party trackers or cross-app tracking, and we do not sell or rent your personal data to anyone, ever.
2. Where your photos go
When you request a critique:
- The photo is uploaded to a private storage bucket on our infrastructure. Access is restricted to your own account.
- A smaller thumbnail is stored so your history loads quickly. Thumbnails live in a bucket that is readable by anyone who has the exact, unguessable URL of that file — they are not listed or searchable, but they are not access-controlled either. Do not submit a photo you would not want reachable by URL.
- Our server creates a short-lived signed link (valid for two minutes) and sends it to OpenAI, which generates the critique. OpenAI processes the image to return the analysis. It does not receive your email, your name or your account id.
- The critique text and scores are stored against your account so you can return to them.
3. How long we keep it
Today we keep your photos, thumbnails and critiques until you delete them or delete your account. There is no automatic expiry yet; we intend to introduce one and will update this policy, and tell you in the app, before it takes effect.
Usage events are kept for up to 12 months and then deleted or aggregated so they no longer identify you.
Credit and purchase records are kept for as long as your account exists, and afterwards only where we are required to retain a record of a transaction.
4. Deleting your data
- One photo: delete the analysis from your history and the stored image and thumbnail go with it.
- Everything: open Settings → Delete account in the app. This permanently deletes your account, your critiques, your credit history, your usage events and every photo and thumbnail we hold. It is immediate and cannot be undone, and any unused credits are forfeited.
If you cannot reach the app, email us and we will delete the account for you.
5. Who processes data on our behalf
- Supabase — database, authentication, file storage, server functions and usage events (hosted in the United States).
- OpenAI — generates the critique from the submitted image.
- Apple — handles every purchase. We never see your card details; we receive only a signed receipt identifying the pack you bought.
Each of these acts under contract and may only use the data to provide its service to us. Because they are outside Argentina and the EEA, transfers rely on the providers' standard contractual terms.
6. Legal bases (GDPR)
- Performance of a contract — creating your account, running critiques, keeping your credit balance correct.
- Legitimate interests — keeping the service secure, preventing purchase fraud or abuse, and understanding how the app is used so we can improve it.
- Legal obligation — retaining transaction records where required.
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, or restrict how we use it, and you can object to processing based on legitimate interests. Write to icesarrosales@icloud.com and we will answer within 30 days. In Argentina you may also complain to the Agencia de Acceso a la Información Pública; in the EEA, to your local supervisory authority.
8. Security
Traffic between the app and our servers is encrypted with TLS. Data is stored in managed infrastructure with row-level access rules that restrict each record to its owner, and originals sit in a private bucket. No system is perfect: if a breach ever affects your data, we will notify you and the relevant authority as the law requires.
9. Children
Sepiane is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will delete it.
10. Changes
If we change this policy we will update the date above and, for anything material — new data collected, a new processor, a shorter retention period — tell you in the app before the change applies.