ElanoryaPrivacy Policy
This policy explains how Jewelry AI actually handles your data, described from the systems running in production today. Where something is not settled yet — such as how long deleted data survives in backups — this policy says so plainly instead of stating a period we cannot keep.
Controller and contact details
Jewelry AI is operated under the Elanorya brand. Privacy and data-rights requests are received at privacy@elanorya.com; general support at support@elanorya.com; and security reports at security@elanorya.com. Each mailbox is in service and has been tested for two-way delivery and response. We answer data-rights requests through these channels; a postal address is available on request where a law requires one.
Scope and age approach
This policy covers the mobile app, related APIs, account emails, and published Elanorya web pages. The service is intended for people aged 18 or over and is not directed to children. We do not intend to knowingly create child accounts or collect children’s data for behavioural advertising. If you believe a child’s data is being processed, contact privacy@elanorya.com.
Account, authentication, and session data
We may process your email address, a one-way password hash, email-verification status, account lifecycle status, session-family identifiers, readable device labels, platform type, and security tokens stored only in hashed form. Google or Apple sign-in may provide a provider account identifier and verified email address. Social-login passwords are never provided to us. For Apple sign-in, a refresh token is encrypted on the application server and used only to revoke the Apple authorisation when the account is deleted; it is erased after successful revocation. Your preferred app locale may be stored on your account; choosing automatic language stores no locale and lets each device follow its own settings. If you allow notifications on a device, we also store that device’s push token, platform, time zone, app language, and app version, so that each notification reaches the right device in your language and promotional ones are not sent at night in your time zone. Signing out on that device does not stop notifications: the token stays linked to your account, and the device keeps receiving your notifications, including promotional ones while that option is on. We stop using the token for your account when you turn notifications off for that device under Profile → Preferences → Notifications while signed in; when you use Sign out of all devices, change or reset your password, or close that device’s session from another device, because these actions sign devices out for your security; when another account turns on notifications on that device, which moves the token to that account; when the push service reports that the token no longer works, for example after the app is uninstalled; or once 365 days have passed since the app was last opened on that device while you were signed in. A token that is no longer used is deleted after 30 days unless notifications are turned on again on that device, and every token is erased when you delete your account.
Uploaded content and generation data
We may process product or model images, selected tool and model, category, placement and other settings, editing instructions, input and output files, generation state, provider/model/version data, and technical request identifiers. Images may contain personal data, faces, bodies, or sensitive context. Upload only content for which you have all necessary copyright, privacy, personality, and model-release permissions.
Library, support, and technical records
Collections, favourites, deletion state, and library organisation are linked to your account. If you contact support, we process the message, attachments, and correspondence history. For reliability and security we may retain request ID, method, safe route, response status, duration, app version, and limited platform information. Logs are designed not to contain passwords, one-time codes, access or refresh tokens, API keys, email addresses, or image contents, and they are kept on servers we operate. We also keep event records linked to your account to operate and secure the service, detect errors and abuse, and improve the product: account actions such as sign-up, sign-in, credit movements, creations, purchases and refunds, notification and email delivery, and content reports; and in-app interactions such as opening and backgrounding the app, the screens you view, opening the store and offer screens, starting, cancelling, or failing a purchase, sharing, and answers to notification prompts. These records contain your account identifier, the app version, the platform, and the type of event; they do not contain your email address, your images, or text you write. In-app interactions are sent to our own servers while you are signed in, independently of the consent you give for usage statistics. The reverse proxy in front of our API (Caddy, running on a server we operate) keeps an access record of each request for security, troubleshooting, and abuse prevention: the IP address, the request address (path and query string), the request headers (except authorisation and cookie headers), the response status, and the duration. The record files are rotated by size, and rotated files are deleted automatically after at most 30 days. When the app crashes or hits an unexpected error, a diagnostic report containing the error stack, app version, device model, operating-system version, and a random per-installation identifier is sent to our crash-reporting provider. That report does not include your account identifier, your email address, the images you upload, or your editing instruction.
Credits, purchases, and subscriptions
We process wallet balance, append-only credit entries and lots, product identifiers, store transaction identifiers, purchase and subscription state, entitlements, refunds, chargebacks, and credit reversals. Jewelry AI does not process full payment-card details; payment is handled by Apple App Store or Google Play. RevenueCat links store lifecycle events to a server-generated user identifier. We do not send email as an unnecessary RevenueCat customer attribute.
Why we use data and applicable grounds
Data is used to create and secure accounts, perform the AI operation you request, store and display results, manage libraries and collections, verify purchases and subscription rights, administer credits, prevent duplicate or abusive transactions, provide support, comply with law, establish or defend legal claims, and diagnose crashes and errors in the app. In addition, and only if you give explicit consent, we process usage statistics that are not linked to a person, in order to understand which screens and tools are used and improve the product; if you decline, that processing never starts. Notifications about your own account — an image that is ready, a generation that failed and whose credits were refunded, or credits added after a purchase — are part of the service you asked for and rely on performance of the contract; you can turn them off at any time. Promotional notifications about offers and campaigns are a separate choice: the option is on by default on the notification screen shown when the app first opens, you can switch it off there or at any time later, and no promotional notification is sent if you do not allow notifications at all. To choose which offer to show you in the app, or to send you as a promotional notification, we may use whether you have purchased before, your credit balance, and how recently you used the app. Depending on your location, the legal ground may be performance of a contract, compliance with law, legitimate interests that do not override your rights, or a separate consent for an optional activity. We process event records linked to your account on the basis of legitimate interests, to operate and secure the service and to understand where people get stuck so we can improve the app; they are not used for advertising and are not shared with third parties. We do not sell personal data for third-party behavioural advertising.
AI-provider processing notice
Depending on the tool, required input images, editing instructions, and generation settings may be sent to AI providers to produce the result you requested. Model try-on and image-editing requests are routed through APIMart, an API aggregator that forwards the request to the Google Gemini image model running behind it; upscaling and background-removal requests are sent to Replicate directly. A concise notice is shown again on the final review screen before submission. This transfer is necessary for that feature and is not described as optional marketing consent. Each request carries only what the feature needs. We do not set a no-retention option on any provider call. The route through APIMart used for model try-on and image editing does not expose such a control, and it is not available on the Replicate calls either, so every request follows the default retention behaviour of the provider that receives it, and of any model provider behind it. We have not completed a contractual review of every provider’s data locations, retention behaviour, training settings, subprocessors, and deletion controls, and we do not claim one here. Temporary provider output is copied into controlled object storage before it is treated as delivered.
Other processors and recipients
Apple and Google may process store, payment, subscription, and social-login data; RevenueCat may verify purchases and entitlements; APIMart may receive AI image requests and pass them to the model provider that fulfils them; Resend may deliver verification and password-reset email; Expo may deliver the notifications you allow through its push service in the United States, passing the device’s push token and the notification text to Google Firebase Cloud Messaging for Android devices or to the Apple Push Notification service for Apple devices — a notification contains only text we write and, when it opens a result, that result’s identifier, never your email address, images, or editing instructions; Sentry may process crash and error diagnostics in the European Union (Frankfurt) region; and, only if you give explicit consent, PostHog may process usage statistics that are not linked to a person, also in the European Union (Frankfurt) region — if you decline, no data at all is sent to that provider; application data is held on server infrastructure we operate, in a PostgreSQL database; technical logs are kept on the same infrastructure, on a log server we operate; and uploaded and generated files are stored in Cloudflare object storage hosted in the European Union. Our published web pages are delivered through the Cloudflare edge network, which may process IP addresses, HTTP request metadata, and security telemetry for delivery, security, and abuse prevention, and whose security challenges may set strictly necessary cookies. Neither the app nor the website places analytics or marketing cookies. Authorised advisers or public authorities may receive limited data where legally required. The processors named above are the ones actually in use; if one is added, removed, or replaced, this section is updated.
International transfers
Technology providers are located outside Türkiye, and running the service transfers personal data to them today. Input images, editing instructions, and generation settings are sent to APIMart and to Replicate through their global endpoints, which offer no region selection. Model try-on and image-editing requests reach the Google Gemini image model through APIMart rather than directly, so those transfers involve two recipients outside Türkiye rather than one. Uploaded and generated files are stored in Cloudflare object storage hosted in the European Union. Your email address is sent to Resend for verification and password-reset messages. Store, payment, and subscription data is processed by Apple and Google, and purchase verification by RevenueCat. Published web pages are delivered through the Cloudflare edge network. If you allow notifications, the push token and the notification text are sent to Expo in the United States and, from there, to Google or Apple for delivery. The transfer mechanism applicable to each of these activities, including notification delivery through Expo, has not been finalised; we do not state a completion date and do not claim a safeguard we cannot evidence. Crash and error diagnostics and usage statistics are processed by Sentry and PostHog, hosted in the European Union (Frankfurt). The data is hosted there; however, those providers may access it from outside the European Union (primarily the United States) through their own subprocessors for support, maintenance, and infrastructure. For these two providers the transfer mechanism is, unlike the others, established: signed data processing agreements, the European Union Standard Contractual Clauses, and the providers’ EU-US Data Privacy Framework certification. Usage statistics that are not linked to a person, processed through PostHog, rely on your explicit consent: if you decline, that processing never starts. Promotional notifications rely on the option described above, which is on by default at first launch. You can change both at any time in the app — for usage statistics under Profile → Preferences, for promotional notifications under Profile → Preferences → Notifications. Event records linked to your account, kept on our own servers, rely on legitimate interests rather than consent; to object to them, write to our privacy email address. Apart from these two, no processing relies on your separate choice. If an activity comes to require it, consent will be requested independently from this notice and will explain the recipient, destination, purpose, and consequences of refusal.
Retention, deletion, and restricted records
Active accounts and creations are retained until you delete them or start account deletion, subject to stated retention limits. Normal deletion may first move a creation to a recoverable deleted area. Permanent deletion attempts to remove your unshared input and output assets. Account deletion removes direct identifiers such as email, password hash, social-login ID, and device ID; erases push tokens, notification settings, and notification records; revokes sessions; hides content; and queues user files for purge. Restricted records linked to an internal user ID may remain for legally required financial records, fraud prevention, provider-cost reconciliation, and transaction integrity, and the record of when you switched promotional notifications on or off is kept as evidence of that choice. Those records are not described as anonymous merely because direct identifiers were removed. A creation you delete in the normal way stays in the recoverable area for 30 days and is then removed permanently and automatically; an upload that is never linked to a creation is removed after 24 hours. A deletion request is completed within 30 days at the latest and removal normally begins immediately, but instantaneous or absolute erasure is not guaranteed: a storage-provider outage can delay it, and the queue keeps retrying until it succeeds. Technical logs are kept for at most 30 days and then deleted automatically; reverse-proxy access records are rotated and deleted as described above. Event records linked to your account are part of the technical logs and follow the same periods. We have not fixed a backup-deletion period, and this policy therefore does not state one rather than promising a period we could not keep.
Device permissions and local storage
Photo or file permissions are requested only when you select an image, save a result, or share a file. Camera permission is requested only when you choose to take a photo: the camera opens for a single photo, no video or audio is recorded, and the photo you take is uploaded only for the creation you start, just like a photo chosen from your gallery. Refusal limits only the related feature. Notification permission is requested in context, only after you choose to receive notifications — for example on the screen shown while an image is being prepared; refusing it limits only notifications. Authentication secrets are stored in supported Keychain or Keystore-backed storage. Non-critical settings such as language and appearance may be stored locally. AI-provider secret keys are never included in the mobile bundle.
Security and incident handling
Controls include encrypted transport, strong password hashing, short-lived access tokens, revocable refresh sessions, per-user and per-app isolation, request throttling, verified store webhooks, server-side cost authority, and data-minimised logging. No system can guarantee absolute security. Security reports should be sent to security@elanorya.com without passwords, one-time codes, or payment-card data. We keep a documented incident-response procedure covering the escalation path and, where a regulatory notification duty applies, the 72-hour assessment that duty requires.
Your rights and choices
You can permanently delete creations, close sessions, change supported preferences, and begin account deletion in the app. Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing; obtain information about transfers; receive a portable copy of your data; withdraw a consent prospectively; and complain to your local supervisory authority. You can withdraw the consent given for usage statistics with a single tap under Profile → Preferences; sending stops immediately. Promotional notifications are switched off the same way under Profile → Preferences → Notifications, where the other notification types can also be turned off. You can object to event records linked to your account, which rely on legitimate interests, by writing to our privacy email address; we assess objections within the legal deadline and tell you the outcome. Users in Türkiye hold the rights set out in Article 11 of Law No. 6698, including learning whether their data is processed, requesting correction or erasure, and applying to the Personal Data Protection Board. We do not sell personal data and do not share it for cross-context behavioural advertising. To exercise a right, write to privacy@elanorya.com from your account email, stating which right you are exercising; a portable copy is prepared manually and sent to that address. Requests may require proportionate identity verification, and we ask only for what is reasonably needed to confirm authority — never send your password, a one-time code, an access token, or a full payment-card number. Where the law allows an authorised agent to act for you, we may ask for proof of authority and direct confirmation from the account holder. Requests are answered within the period set by the applicable law; our two-business-day support target is an initial-response goal and does not shorten or replace that period. If a request is refused, the reply explains why and, where required, the appeal or regulator route open to you. No data-protection officer or representative has been appointed at this time; if one is appointed, the name and contact address will be published here.
Changes and contact
A new date and appropriate in-app notice will accompany material policy changes. A new acceptance is requested only when legally required; presentation of a notice, contract acceptance, and optional consent are recorded separately. Privacy requests go to privacy@elanorya.com, security reports to security@elanorya.com, and general support to support@elanorya.com. The target for an initial human support response is two business days; statutory data-rights deadlines remain unchanged.