Privacy Policy
Last updated: 30 August 2026
In one sentence
it does not connect to the network.
Your photos, your saved looks and the products you add exist only on your own phone.
Why this is more than a promise
Most privacy policies open with “we care about your privacy” and then list what they collect. Ours is a different situation, and it is one you can verify:
On Android, an app without that permission cannot reach the network at the operating-system level. This is not “we promise not to send anything”; it is “it cannot”. Anyone can download the package, unpack the manifest and confirm it for themselves.
iOS has no equivalent permission mechanism, but the code likewise contains no network calls of any kind.
The permissions we ask for, and why
Camera
The camera feed is processed entirely on your device: face-landmark detection (MediaPipe, running locally) and makeup rendering (your device's GPU). It never leaves the phone. Nothing is recorded or saved unless you press the shutter yourself.
Add to photo library (add-only)
On iOS this is the “add-only” permission — it allows writing and forbids reading. We cannot see any other photo in your library.
Android 10 and above needs no permission at all. Android 9 and below requires the storage permission because of an OS limitation, and the manifest restricts it to exactly those older versions (maxSdkVersion="28").
The permissions we do not ask for
| Permission | Why we don't need it |
|---|---|
| Read photo library | Importing goes through the system picker (PHPicker on iOS, Photo Picker on Android) — it runs in the system process, and we receive only the picture you selected |
| Network | See above |
| Location, contacts, microphone, device identifiers | Irrelevant to what this app does |
Where your data lives
| Data | Where it is kept | Who can see it |
|---|---|---|
| Looks you save (rendered image + original frame) | The app sandbox on your device | Only you |
| Products you add (brand, name, colour) | The app sandbox on your device | Only you |
| Interface language, whether you've seen a tip | Local preferences on your device | Only you |
“account data” to export or erase — because there was never an account.
Third parties
The only third-party components the app uses are:
- MediaPipe (open source, Google): face-landmark detection, running
- AndroidX / CameraX (Google's official Android libraries): wrappers around
system capabilities
Neither collects nor uploads data.
Payment
Purchases are completed through the App Store or Google Play. Payment details are handled by Apple or Google; we never see your payment method, card number or billing address. All we receive from the system is a single yes-or-no answer: whether this device has unlocked the full version.
Children
This app is not directed at children under 13, and it collects no age information.
Changes
If we ever introduce a networked feature (for example the product catalogue planned for a later release), we will:
- Say so prominently inside the app, and **leave it switched off until you
agree to it**
- Update this policy and note the revision date
Contact
developer@metaimax.com
Appendix: how to verify the claims above
For reviewers, or anyone who would rather check for themselves.
# Android: unpack the build and list the permissions the manifest declares
aapt dump permissions app-release.apk
# iOS: search the source for networking APIs
grep -rn "URLSession\|CFNetwork" ios/Sources/in android/app/build.gradle.kts and ios/Podfile.
PHPickerViewController (iOS) and ActivityResultContracts.PickVisualMedia (Android). Both are system pickers and require no photo-library permission.