Repose Privacy Policy

In short

• Your projects, photos and results live on your device. A photo leaves it only when you tap Create.
• When you tap Create, the photo, your selection and your instructions go through Repose's service to OpenAI, which makes the image. OpenAI does not train on it and deletes its copy within 30 days. Repose's recovery copy is deleted within seven days.
• Repose gives you a private account with no name, email address or password. You can delete it in Settings at any time.
• Apple handles payments. Repose never sees your card.
• Crash reports and usage analytics help fix and improve the app. Repose does not record your screen or sessions.
• Repose displays no ads. Apple Ads attribution helps measure how people find Repose. With Usage analytics on, Repose can share limited app and purchase events with Meta for advertising measurement, including Meta's restricted aggregate measurement when tracking is not allowed. The advertising identifier is shared only if you allow Apple's tracking permission. Your photos and instructions are never sent to Meta.

What Repose collects, and why

A photo of your home can identify you, and the account identifier, App Attest key and push tokens are tied to your device, so Repose treats all of the above as personal information. Repose does not collect your name, email address (unless you add one to feedback), contacts, precise location or your full photo library. Advertising identifiers are used only with the permission described below. Repose does not sell or rent your data for money. A photo is the only thing you must provide: without one there is nothing to design. Usage analytics have an off switch.

Your photos

You bring photos in through Apple's photo picker, which shows Repose only the photos you choose, or through the camera. Apple's on-device image analysis suggests an area to select; that analysis never leaves your device.

Nothing about a photo leaves your device until you tap Create. The first time you tap it, Repose asks your permission on a screen that names OpenAI and explains what is sent; nothing is sent until you choose Continue, and Settings › Privacy can make it ask again. Then the photo, any reference image, the selection mask, your choices and your instructions are sent over an encrypted connection to Repose's service, which forwards them to OpenAI's API to generate the image. Under OpenAI's API data terms, content sent through the API is not used to train or improve OpenAI's models, and OpenAI may keep it for up to 30 days to monitor for abuse, unless the law requires longer. Repose has not enabled OpenAI's zero-retention option.

Repose's service keeps a copy of the photo and the result for up to seven days so an interrupted request can be recovered and the result delivered to your device. Cloudflare's storage lifecycle rule deletes it after that, and deleting your account deletes it immediately.

Results are stored on your device. Saving a design to your photo library asks for add-only permission, which lets Repose add photos and nothing else. Sharing a design uses Apple's share sheet and goes only where you send it.

Your account

Repose creates a private online account for you the first time it runs. It has no name, email address or password. The account is identified by a random identifier and protected by Apple's App Attest, which lets Repose's service check that requests come from a genuine copy of the app on an Apple device without learning who you are. The identifier is pseudonymous rather than anonymous: it does not name you, but it is the same identifier each time your device connects. After you make a purchase, Apple's signed record of that purchase can be used to recover the same account if you reinstall Repose or move to a new device.

The account holds your design balance, your purchase records, the recovery copies described above, your push tokens and up to 30 days of design and purchase analytics awaiting forwarding. Session tokens issued to your device expire after 30 days and are renewed automatically.

You can delete the account at any time in Settings › Account › Delete online account. Deletion immediately ends this device's access, resets the app's analytics identity, and removes starter designs, recovery copies of your photos, push tokens, jobs and queued analytics. It also records a request for our operator to erase analytics already sent to PostHog. External erasure is a separate process: our operator submits the request and verifies its completion. Repose keeps an account tombstone, Apple purchase and subscription records, and any paid or complimentary design balance so it can restore purchased entitlements, prevent duplicate credits and reconcile refunds. If StoreKit later verifies the same purchase wallet, Repose can reopen it with those retained entitlements; it does not grant the deleted starter designs again. Deleting the account does not cancel an Apple subscription; cancel it in your Apple Account settings. Designs saved on your device are not affected.

Purchases

Purchases and subscriptions are made through Apple and are governed by Apple's terms. Repose receives the transaction details Apple provides, such as product, price, currency, storefront country, dates and transaction identifiers, and Apple's server notifications about renewals, refunds and revocations. Repose never receives your payment details, name or Apple Account email address.

Notifications and Live Activities

If you allow notifications, Repose stores the push token Apple issues for your device so it can tell you when a design is ready. While a design is being created, the app can show a Live Activity; its push token is stored for at most a day. Push tokens are opaque identifiers scoped to this app on this device and change when you reinstall or restore.

Diagnostics

Crash, error, performance and app-hang reports go to Sentry to help fix technical problems. They include the app version, iOS version and device model, breadcrumbs of screens and sanitised request names, and named diagnostic events. They exclude photos, instructions and your account identifier. Reports include your IP address for network diagnostics. Crash and performance reporting stays on; the usage-analytics switch does not disable it. Feedback you send from Settings also goes to Sentry, with your message, the email address you add (optional) and your account identifier, so we can read and answer it.

Repose does not record your screen or sessions.

Usage analytics

Usage analytics are on by default and count the steps you take, such as opening the app or a screen, importing a photo, choosing a tool, creating a design, saving it or opening the purchase screen. Each event carries its name, the tool or product involved, a timestamp, your account identifier and a session identifier, plus the app version, iOS version, device model, language and time zone. The app sends these events directly to PostHog using PostHog's SDK; PostHog derives an approximate location (country, region, city) from your IP address. Events about designs and purchases are sent by Repose's service, which keeps them for up to 30 days before forwarding them to PostHog and links them to the same session. Events never include photos, instructions, text you type, what you tap on screen, or recordings, and Repose does not use PostHog's session recording. First-party usage analytics do not include the IDFA advertising identifier. Repose creates a random identifier for this installation; this is separate from your account identifier. Turn analytics off in Settings › Privacy › Usage analytics. Deleting your account removes queued analytics and records a request for separate erasure of events already sent to PostHog.

When usage analytics are on, Repose requests a short-lived attribution token from Apple's AdServices framework and sends it through Repose's service to Apple. Apple may return the Repose campaign, ad group, keyword or ad associated with the download, its country and attribution dates. Repose joins those details to its own usage and Apple-verified purchase events to measure advertising results. The token is not saved or sent to PostHog. This does not collect the IDFA, read activity in other apps, or send your events to other advertising networks. Switching usage analytics off stops collection and clears attribution stored on Repose's service. It does not automatically erase events already delivered to PostHog; account deletion starts the erasure process described above.

Meta advertising measurement

Repose asks Apple's tracking permission once, when the welcome screens end. Until you answer, Meta's SDK runs in Meta's restricted mode, as it does if you do not allow tracking. Allowing it is optional and does not change access to design tools. With Usage analytics on, Repose uses Meta's SDK and server API to send app activation, a few steps in the app (finishing the welcome screens, finishing a first design, seeing the subscription offer and starting a purchase) and Apple-verified trial and purchase events. These include a Meta installation identifier, app and device context, product, date, price and currency, and Apple's original transaction number, which links a subscription's trial, first payment and renewals. Meta's SDK also attaches the title of the Repose screen that was open when the event was logged and, if a link opened Repose, that link's address. It can also send Meta sampled information about the app, such as the layout of elements on Repose screens, which Meta uses to improve its advertising systems. If you allow tracking, Repose can also share the advertising identifier and the IP address your device used to connect to Repose's service. If you do not allow tracking, Repose omits that identifier, reports the permission state, and uses Meta's supported restricted processing for aggregate advertising measurement. Even in restricted processing, the SDK still sends some identifiers and device information. Initial reporting can include Apple-verified purchases from the same installation made in the previous seven days, including purchases made before the tracking permission decision. These events use that first permission state and respect later opt-outs and changes to the advertising identifier. Repose does not send photos, generated designs, masks or instructions to Meta.

Turn off Usage analytics in Repose to stop future collection and sharing through this integration. Turning off tracking in iOS Settings instead switches eligible measurement to the restricted path and stops use of the advertising identifier when the app observes the change. The server uses the last permission reported by the app. It learns of a change when the app next connects and reports it. Requests already in flight may complete. Queued server events expire within seven days; retries stop earlier when needed to prevent duplicate reporting. Records of what was sent expire after 30 days. A record of each purchase is kept so that restoring purchases does not report a second purchase to Meta. Turning off Usage analytics removes queued advertising events and installation context when received. It does not erase events already delivered to Meta. Meta's processing and retention are described in Meta's Privacy Policy.

Apple's aggregate advertising attribution is separate from Meta's aggregate measurement. Where configured, Meta's SDK updates Apple's conversion values for app events; Apple sends privacy-limited attribution reports. This does not require an advertising identifier. Repose's separate Apple Ads attribution path does not forward Apple campaign data to Meta.

Where your data goes

Repose's service runs on Cloudflare Workers, with photos in Cloudflare R2 storage, on Cloudflare's global network. Image generation is performed by OpenAI in the United States and other jurisdictions where OpenAI operates. Sentry and PostHog store their data in the United States. Apple processes purchases and notifications under its own privacy policy. If advertising measurement is allowed, Meta receives the data described above and can process it internationally under its own privacy policy. Lucent Enterprises Ltd. itself is in Canada.

Your information may therefore be processed in a foreign country, and it may be accessible to the law enforcement and national security authorities of that country. For people in Quebec: your information may be communicated outside Quebec. Cloudflare, OpenAI, Sentry and PostHog provide services to Repose under their applicable data processing terms. Apple and Meta process data under their own policies, not on Repose's instructions. For people in the European Economic Area, the United Kingdom and Switzerland: Cloudflare, Sentry and PostHog are certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions; transfers to OpenAI rely on the safeguards in its data processing addendum; and the European Commission recognises Canada as providing adequate protection for organisations covered by Canada's federal privacy law. Write to us for a copy of the safeguards.

Your rights and choices

• Choices in the app: usage analytics can be turned off in Settings › Privacy; notifications, camera and photo-library access are controlled in iOS Settings; you can delete individual designs, or the whole account, at any time.
• Access and correction: you can ask what data Repose holds about your account and have it corrected. Repose will answer within 30 days.
• Deletion: use Settings › Account › Delete online account, or write to us.
• Withdrawing consent: turn off the relevant switch, deny the permission in iOS Settings, or delete the account. Withdrawing consent stops further collection but does not undo processing that already happened, and a design cannot be created without a photo.
• Portability, restriction and objection: people in the EEA, the UK and Switzerland can also ask for a copy of their data in a portable form, ask Repose to restrict processing, or object to processing based on legitimate interests.
• Complaints: write to us first; Repose acknowledges complaints within 30 days and tells you the outcome. In Canada you may also complain to the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information. In the EEA or Switzerland you may complain to your local supervisory authority, and in the UK to the Information Commissioner's Office.

To make a request, email contact@lucententerprises.com from the device that holds the account, or include your account identifier from Settings › Account, since Repose has no other way to know an account is yours.

Legal bases for people in the EEA, the United Kingdom and Switzerland

Repose processes data to perform the service you asked for (creating designs, keeping your balance, restoring purchases); for its legitimate interests in keeping the service working, secure and free of fraud (diagnostics, App Attest, transaction records, and usage analytics, which you can turn off); with your consent where iOS asks for it (camera, photo library, notifications and identifiable Meta advertising tracking); and to meet legal obligations such as keeping records of transactions. Repose does not make automated decisions about you that have legal or similarly significant effects.

Security

Everything travels over TLS. Requests are signed with App Attest keys that live in your device's Secure Enclave, photos are stored in a private bucket that only Repose's service can read, access to the service's data is limited to the person named above, and the service keeps the least data it can for the shortest time it can. No method of storage or transmission is perfectly secure; if a breach creates a real risk of harm to you, Repose will tell you and the authorities the law requires, and keeps a record of every incident.

Children

Repose is not directed at children under 13 (or the higher age of consent where you live, 16 in parts of the EU) and does not knowingly collect information from them. If you believe a child has used Repose, write to us and the account will be deleted.

Beta testing through TestFlight

If you use Repose through Apple's TestFlight, Apple's TestFlight terms and privacy notice also apply. Apple collects crash logs and usage data from beta apps and shares them, along with your device model and OS version and any feedback you send from TestFlight, including screenshots, with Lucent Enterprises Ltd.; Apple's terms do not let testers opt out of that collection. Testers who join through the public link stay anonymous to us unless they add their email address to a piece of feedback; testers invited by email are visible by name and email. Repose uses this data only to improve the app and does not share it with anyone else. Purchases made in TestFlight use Apple's sandbox and are not charged.

California

Repose collects the categories described above. Optional sharing with Meta is for cross-company advertising measurement and optimization and may be considered “sharing” under California privacy law. Repose does not sell data for money. Turning off Usage analytics prevents this optional sharing. Denying Apple's tracking permission prevents identifiable advertising tracking and use of the advertising identifier; eligible restricted aggregate measurement can continue while Usage analytics remains on. These choices do not affect access to the design tools. You can contact the Privacy Officer to exercise the rights described above.

This website

reposedesign.com is served by Cloudflare and counts page views in two ways. Cloudflare Web Analytics sets no cookies and does not identify visitors. Google Analytics 4 records page views, scrolls and outbound clicks and sends them to Google, which acts as our service provider; it sets a first-party cookie (_ga) to tell returning browsers apart, except for visitors in the European Economic Area, the United Kingdom and Switzerland, where analytics cookies are off by default and Google receives only cookieless, aggregated signals. Google Analytics does not log or store IP addresses, advertising features are switched off, and event-level data is kept by Google for two months. You can block it with Google's browser opt-out add-on or any content blocker. The site has no accounts, forms or advertising.

Changes

If this policy changes, the new version will be posted at this address with a new effective date, and the app will link to it. Material changes will be announced in the app before they take effect, and earlier versions are available on request.