Privacy Policy

RelicLab LLC ("we", "us", or "our") operates the Aura Portrait iOS application ("Aura Portrait" or the "App"). We respect your privacy. This policy explains what we collect, why, how we share it, and how you can control it.

Face Data

What face data we collect. When you set up your Portrait Profile, you choose 10 selfies from your device's photo library and upload them to Aura Portrait. These photos contain your face and are used as face data to train your private Portrait Profile — an AI model that learns your facial features so it can generate portraits that look like you. Each account has one Portrait Profile at a time. We do not perform separate face detection, face recognition, faceprint extraction, or face geometry mapping outside of this AI model training process. We do not use Apple's Vision framework or any facial recognition API on your photos.

How face data is used. Your uploaded selfies are used exclusively to train your private Portrait Profile. That Portrait Profile is used solely to generate portraits at your request, in the themes you select inside the App. Your face data is never used to train any shared, foundational, or other users' models. We do not use your face data for advertising, analytics, profiling, identity verification, or any purpose other than generating portraits you have requested.

How face data is shared. To train and run your private model, your uploaded selfies are transmitted to fal.ai (https://fal.ai), our third-party AI infrastructure provider. fal.ai hosts the AI training and inference compute. No other third party receives your face data. fal.ai stores and processes the data solely on our behalf and is contractually bound by its own privacy policy (https://fal.ai/privacy-policy). Source photos in transit and at rest are also stored on Supabase (https://supabase.com), our hosting provider, for the duration described below.

User permission for face data sharing. Before any selfies are uploaded, the App asks you to explicitly consent to: (a) sharing your photos with our AI provider (fal.ai) for the purpose of training your private Portrait Profile, and (b) the retention and deletion terms below. No face data leaves your device until you tap an explicit consent confirmation. Confirming the upload constitutes your explicit permission for this data sharing.

How long face data is retained. Source selfies are automatically deleted from our storage and from fal.ai's training inputs within 30 days of upload. Your trained Portrait Profile is retained on fal.ai for as long as your account is active so you can continue to generate portraits without retraining. Generated portraits are stored to be delivered to you in the App. You can request immediate deletion of your Portrait Profile and all associated face data at any time using the in-app "Delete Account" option (Account → Delete Account), or by emailing [email protected]. Account deletion in the app wipes all data immediately.

Where face data is stored. Source selfies are stored on Supabase storage (encrypted at rest, US-based). Trained Portrait Profiles and inference compute run on fal.ai's infrastructure. All transit uses HTTPS/TLS encryption.

Other Information We Collect

Generated portraits. The AI portraits we generate from your Portrait Profile are stored so you can access them in the App.

Account data. If you make a purchase, we receive a transaction record from Apple via RevenueCat. We do not see your credit card number.

Device identifier. We generate a random per-install identifier on your device to track your monthly usage, deliver push notifications, and credit any pack top-up purchases. It is not linked to your real-world identity.

Push notification token. If you grant push notification permission, we store your Apple Push Notification (APNs) token associated with your device identifier so we can notify you when training completes.

Content reports. If you submit a content report inside the App, we collect the report details, your device identifier, and the pack the report relates to.

Device data. Standard analytics — device model, OS version, app version, crash logs — used to improve the App.

What We Don't Collect

We do not collect your name, email, phone number, contacts, location, microphone, or browsing history. We do not sell your data, ever. We do not share your face data or any other personal data with advertising networks, data brokers, or any third party other than the service providers listed below, who process data solely on our behalf.

Third-Party Service Providers

We use the following third-party providers to deliver Aura Portrait. Each is bound by its own privacy policy and processes your data solely on our behalf:

• fal.ai (fal.ai) — Hosts AI model training and inference. Receives your uploaded selfies (face data) and generates portraits. Privacy policy: https://fal.ai/privacy-policy
• Supabase Inc. (supabase.com) — Hosts our backend storage for source selfies (encrypted at rest). Privacy policy: https://supabase.com/privacy
• Vercel, Inc. (vercel.com) — Hosts our backend API. Privacy policy: https://vercel.com/legal/privacy-policy
• Upstash, Inc. (upstash.com) — Hosts our Redis database for device identifiers, push tokens, and usage counters. Does not receive face data. Privacy policy: https://upstash.com/trust/privacy.pdf
• RevenueCat, Inc. (revenuecat.com) — Manages subscriptions and in-app purchases. Does not receive face data. Privacy policy: https://www.revenuecat.com/privacy
• Apple, Inc. (apple.com) — Processes payments and delivers push notifications. Does not receive face data. Privacy policy: https://www.apple.com/legal/privacy/

How Long We Keep Your Data

Source selfies (face data) are automatically deleted within 30 days of upload. Your Portrait Profile and generated portraits remain in your account until you delete them or close your account. Device identifiers and usage data are stored for the life of your install; monthly usage counters auto-expire after 35 days. Content reports are retained as needed to investigate and act on them.

Your Rights

You can delete your account and all associated data — including your Portrait Profile, source selfies, and generated portraits — directly from inside the App: Account → Delete Account. Account deletion wipes everything immediately. You can also email [email protected] to request deletion or a copy of your data.

Children

Aura Portrait is not intended for users under 13. We do not knowingly collect data from children. If you believe a child has used the App, please contact us so we can delete the data.

Security

We use industry-standard security measures including HTTPS/TLS for all data transmission and access-controlled, encrypted storage. No system is perfectly secure; you acknowledge this risk when using the App.

Changes to This Policy

We may update this policy. Material changes will be reflected in the "Last updated" date and communicated in-app. Continued use of the App after changes constitutes acceptance.

Contact

Questions? Reach us at [email protected].

RelicLab LLC
Reno, Nevada, USA