Last updated: August 27, 2026
Photos and text prompts. You provide these yourself in the Create tab: you pick a photo from your photo library or camera and you type a prompt. We collect them only at the moment you tap Generate — the app does not scan, index or upload your photo library in the background. They are uploaded to our backend, which forwards them to our third-party AI processing provider, WaveSpeed AI (see Section 3). Before anything is sent, the app shows an in-app notice that names WaveSpeed AI, states what is sent and asks for your consent. If you decline, nothing is sent and AI generation stays switched off. These photos normally show a face, so we also treat them as face data — see Section 5.
Account data. A unique user identifier generated on your device, used to keep your coin balance and generation history attached to your installation. We do not ask for your name, email address or phone number.
Purchase data. Subscription and coin purchase transactions are processed by Apple via StoreKit. We receive transaction identifiers to validate entitlements but never see your payment details.
Analytics. We use Firebase Analytics, collected automatically while you use the app. This includes anonymous device identifiers, session data and feature usage events. No personally identifiable information is collected through analytics.
We use your photos and prompts for exactly one purpose: to produce the AI generation you requested. We use your account data to manage your subscription, coin balance and generation history, and analytics data to understand which features are used and to improve the app. We do not use your photos or prompts for advertising, profiling or any form of marketing, and we do not sell your personal data.
The photos and text prompts you submit in the Create tab are sent to WaveSpeed AI (api.wavespeed.ai), a third-party AI processing provider, via our backend. WaveSpeed AI routes each request to the AI model that generates your result, including models from Alibaba, Google, ByteDance, OpenAI, xAI, KwaiVGI, MiniMax, WaveSpeed's own models and other model providers.
WaveSpeed AI is contractually required to handle your data in accordance with this policy and to provide the same or equal protection for it as described here. It may not retain or use your content for any purpose other than generating your requested result, and may not use it to train its own or any third party's models. We obtain your explicit in-app consent, which identifies WaveSpeed AI by name, before any photo or prompt leaves your device.
Firebase Analytics data is processed by Google under their data processing terms. Apple processes purchase transactions under Apple's privacy policy.
Your photos and prompts are deleted once the generation completes. Generated results are kept so they can appear in your in-app gallery until you delete them. You can delete your account from the app settings, which removes your identifier, generation history and associated data from our servers.
The photos you upload usually show your face, because the app generates a new hairstyle or portrait from them, so we treat them as sensitive data. We do not create, derive or store faceprints, face templates, face geometry, facial landmarks, face embeddings or any other biometric identifier derived from your face. We do not perform face recognition, face matching or identity verification, and we never use your face to identify or authenticate anyone.
Before you submit a photo, the app counts the people in it using Apple's on-device Vision framework so that the generation keeps everyone in the frame; only that number is used, the detection runs entirely on your device and its output is never uploaded or stored. Photos that contain faces are used for one purpose only — to produce the generation you requested — and are never used for advertising, profiling, marketing or to train AI models. They are disclosed to no one except the AI processing provider named in Section 3, WaveSpeed AI, which may not retain or use them for any other purpose.
A submitted photo is stored as a private object in Google Cloud Storage (bucket hairpicker-media-euw1, region europe-west1, EU) and is deleted as soon as your generation finishes. The generated result is kept only so it appears in your in-app gallery, until you delete it or delete your account.
Charisma AI is not intended for children under 4. We do not knowingly collect data from children.
Questions? Contact us at celenajones01@gmail.com.