Repose Privacy Policy

In short

• Your projects, photos and results live on your device. A photo leaves it only when you tap Create.
• When you tap Create, the photo, your selection and your instructions go through Repose's service to OpenAI, which makes the image. OpenAI does not train on it and deletes its copy within 30 days. Repose's recovery copy is deleted within seven days.
• Repose gives you a private account with no name, email address or password. You can delete it in Settings at any time.
• Apple handles payments. Repose never sees your card.
• Crash reports, masked session recordings and usage analytics help fix and improve the app. Session recording and usage analytics each have an off switch in Settings › Privacy.
• Repose has no advertising, no tracking across other apps or websites, and sells no data.

What Repose collects, and why

A photo of your home can identify you, and the account identifier, App Attest key and push tokens are tied to your device, so Repose treats all of the above as personal information. Repose does not collect your name, email address, contacts, precise location, advertising identifier or photo library, does not track you across other companies' apps or websites, and does not sell or rent any data. A photo is the only thing you must provide: without one there is nothing to design. Usage analytics and session recording have off switches. Account security and crash and performance reporting are required to operate the service.

Your photos

You bring photos in through Apple's photo picker, which shows Repose only the photos you choose, or through the camera. Apple's on-device image analysis suggests an area to select; that analysis never leaves your device.

Nothing about a photo leaves your device until you tap Create. The first time you tap it, Repose asks your permission on a screen that names OpenAI and explains what is sent; nothing is sent until you choose Continue, and Settings › Privacy can make it ask again. Then the photo, any reference image, the selection mask, your choices and your instructions are sent over an encrypted connection to Repose's service, which forwards them to OpenAI's API to generate the image. Under OpenAI's API data terms, content sent through the API is not used to train or improve OpenAI's models, and OpenAI may keep it for up to 30 days to monitor for abuse, unless the law requires longer. Repose has not enabled OpenAI's zero-retention option.

Repose's service keeps a copy of the photo and the result for up to seven days so an interrupted request can be recovered and the result delivered to your device. Cloudflare's storage lifecycle rule deletes it after that, and deleting your account deletes it immediately.

Results are stored on your device. Saving a design to your photo library asks for add-only permission, which lets Repose add photos and nothing else. Sharing a design uses Apple's share sheet and goes only where you send it.

Your account

Repose creates a private online account for you the first time it runs. It has no name, email address or password. The account is identified by a random identifier and protected by Apple's App Attest, which lets Repose's service check that requests come from a genuine copy of the app on an Apple device without learning who you are. The identifier is pseudonymous rather than anonymous: it does not name you, but it is the same identifier each time your device connects. After you make a purchase, Apple's signed record of that purchase can be used to recover the same account if you reinstall Repose or move to a new device.

The account holds your design balance, your purchase records, the recovery copies described above, your push tokens and up to 30 days of usage analytics awaiting forwarding. Session tokens issued to your device expire after 30 days and are renewed automatically.

You can delete the account at any time in Settings › Account › Delete online account. Deletion is immediate and cannot be undone. It removes your design balance, any recovery copies of your photos, your push tokens and your queued analytics, revokes any subscription record on our side, and records a request for our operator to erase analytics already sent to PostHog. External erasure is a separate process: our operator submits the request and verifies its completion. Repose keeps only a marker that the account existed and the Apple transaction identifiers of your purchases, so the same purchase cannot be credited twice and refunds can still be reconciled. Deleting the account does not cancel an Apple subscription; cancel it in your Apple Account settings. Designs saved on your device are not affected.

Purchases

Purchases and subscriptions are made through Apple and are governed by Apple's terms. Repose receives the transaction details Apple provides, such as product, price, currency, storefront country, dates and transaction identifiers, and Apple's server notifications about renewals, refunds and revocations. Repose never receives your payment details, name or Apple Account email address.

Notifications and Live Activities

If you allow notifications, Repose stores the push token Apple issues for your device so it can tell you when a design is ready. While a design is being created, the app can show a Live Activity; its push token is stored for at most a day. Push tokens are opaque identifiers scoped to this app on this device and change when you reinstall or restore.

Diagnostics and session recording

Crash, error, performance and app-hang reports go to Sentry to help fix technical problems. They include the app version, iOS version and device model, breadcrumbs of screens and sanitised request names, and named diagnostic events. They exclude photos, instructions and your account identifier. Reports include your IP address for network diagnostics. Crash and performance reporting stays on; the session-recording and usage-analytics switches do not disable it.

Session recording is on by default and sends masked recordings of app sessions to Sentry so problems can be reproduced. All text and images are masked before anything leaves your device, the purchase screen is masked entirely, and no network request bodies are captured. Turn it off in Settings › Privacy › Session recording; the switch takes effect immediately.

Usage analytics

Usage analytics are on by default and count the steps you take, such as importing a photo, choosing a tool, creating a design, saving it or opening the purchase screen. Each event carries its name, the tool or product involved, a timestamp and your account identifier. Events never include photos, instructions, text you type or recordings. They are sent to Repose's service, kept there for up to 30 days, and forwarded to PostHog. No analytics library runs inside the app, so no device identifiers or advertising identifiers are collected. Turn analytics off in Settings › Privacy › Usage analytics. Deleting your account removes queued analytics and records a request for separate erasure of events already sent to PostHog.

Where your data goes

Repose's service runs on Cloudflare Workers, with photos in Cloudflare R2 storage, on Cloudflare's global network. Image generation is performed by OpenAI in the United States and other jurisdictions where OpenAI operates. Sentry and PostHog store their data in the United States. Apple processes purchases and notifications under its own privacy policy. Lucent Enterprises Ltd. itself is in Canada.

Your information may therefore be processed in a foreign country, and it may be accessible to the law enforcement and national security authorities of that country. For people in Quebec: your information may be communicated outside Quebec. Each provider acts only on Repose's instructions under a written data processing agreement. For people in the European Economic Area, the United Kingdom and Switzerland: Cloudflare, Sentry and PostHog are certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions; transfers to OpenAI rely on the safeguards in its data processing addendum; and the European Commission recognises Canada as providing adequate protection for organisations covered by Canada's federal privacy law. Write to us for a copy of the safeguards.

Your rights and choices

• Choices in the app: session recording and usage analytics can be turned off in Settings › Privacy; notifications, camera and photo-library access are controlled in iOS Settings; you can delete individual designs, or the whole account, at any time.
• Access and correction: you can ask what data Repose holds about your account and have it corrected. Repose will answer within 30 days.
• Deletion: use Settings › Account › Delete online account, or write to us.
• Withdrawing consent: turn off the relevant switch, deny the permission in iOS Settings, or delete the account. Withdrawing consent stops further collection but does not undo processing that already happened, and a design cannot be created without a photo.
• Portability, restriction and objection: people in the EEA, the UK and Switzerland can also ask for a copy of their data in a portable form, ask Repose to restrict processing, or object to processing based on legitimate interests.
• Complaints: write to us first; Repose acknowledges complaints within 30 days and tells you the outcome. In Canada you may also complain to the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information. In the EEA or Switzerland you may complain to your local supervisory authority, and in the UK to the Information Commissioner's Office.

To make a request, email contact@lucententerprises.com from the device that holds the account, or include your account identifier from Settings › Account, since Repose has no other way to know an account is yours.

Legal bases for people in the EEA, the United Kingdom and Switzerland

Repose processes data to perform the service you asked for (creating designs, keeping your balance, restoring purchases); for its legitimate interests in keeping the service working, secure and free of fraud (diagnostics, App Attest, transaction records, and usage analytics and session recording, each of which you can turn off); with your consent where iOS asks for it (camera, photo library, notifications); and to meet legal obligations such as keeping records of transactions. Repose does not make automated decisions about you that have legal or similarly significant effects.

Security

Everything travels over TLS. Requests are signed with App Attest keys that live in your device's Secure Enclave, photos are stored in a private bucket that only Repose's service can read, access to the service's data is limited to the person named above, and the service keeps the least data it can for the shortest time it can. No method of storage or transmission is perfectly secure; if a breach creates a real risk of harm to you, Repose will tell you and the authorities the law requires, and keeps a record of every incident.

Children

Repose is not directed at children under 13 (or the higher age of consent where you live, 16 in parts of the EU) and does not knowingly collect information from them. If you believe a child has used Repose, write to us and the account will be deleted.

Beta testing through TestFlight

If you use Repose through Apple's TestFlight, Apple's TestFlight terms and privacy notice also apply. Apple collects crash logs and usage data from beta apps and shares them, along with your device model and OS version and any feedback you send from TestFlight, including screenshots, with Lucent Enterprises Ltd.; Apple's terms do not let testers opt out of that collection. Testers who join through the public link stay anonymous to us unless they add their email address to a piece of feedback; testers invited by email are visible by name and email. Repose uses this data only to improve the app and does not share it with anyone else. Purchases made in TestFlight use Apple's sandbox and are not charged.

California

Repose collects the categories described above (photos you choose, a pseudonymous account identifier, purchase records, diagnostics and usage events) and shares them only with the named service providers, which process them for Repose and not for their own purposes. Repose does not track you across other websites or online services, so it does not respond to Do Not Track signals, and no third party collects information about your activity across other sites or apps through Repose. Material changes to this policy are announced in the app and posted here with a new effective date.

This website

reposedesign.com is served by Cloudflare and counts page views in two ways. Cloudflare Web Analytics sets no cookies and does not identify visitors. Google Analytics 4 records page views, scrolls and outbound clicks and sends them to Google, which acts as our service provider; it sets a first-party cookie (_ga) to tell returning browsers apart, except for visitors in the European Economic Area, the United Kingdom and Switzerland, where analytics cookies are off by default and Google receives only cookieless, aggregated signals. Google Analytics does not log or store IP addresses, advertising features are switched off, and event-level data is kept by Google for two months. You can block it with Google's browser opt-out add-on or any content blocker. The site has no accounts, forms or advertising.

Changes

If this policy changes, the new version will be posted at this address with a new effective date, and the app will link to it. Material changes will be announced in the app before they take effect, and earlier versions are available on request.