Privacy Policy
Last updated ·
This policy covers personal information processed through Cueluma and this website. The responsible provider is the developer identified on Cueluma’s App Store listing. For privacy questions or rights requests, contact supports@cueluma.app. Processing depends on the features you actually use; a guest-account or subscription service is relevant only in versions that enable it.
Camera, photos, and permissions
Camera preview, capture, person detection, and scene alignment operate on your device. Person detection locates people for framing; it is not used to establish who someone is or build a facial-identity database. Images can nevertheless contain identifiable faces, bystanders, documents, or sensitive surroundings.
Captured photos are stored in the app’s local album. Copies you choose to save to the device photo library are managed separately and may be synced by services you enable, such as iCloud Photos. Deleting an app-album image does not delete its separate Photos copy. Cueluma does not upload the entire library for AI analysis. The current camera features do not request contacts, microphone, or precise GPS access. Visible landmarks or image content can still reveal a location. Manage camera and photo access in system settings; denying a permission limits the corresponding feature.
Images sent for optional AI processing
When you request AI guidance, selected scene images, person crops or annotated reference images, framing coordinates, prompts, and related settings are transmitted to OpenRouter and the model provider to analyze composition or generate a pose reference. The configured Google models use Google’s AI services. Images may include other people and sensitive details, so choose your scene carefully and obtain necessary permissions.
The experimental version can send requests directly using an OpenRouter API key you supply, stored in the device Keychain. Versions using Cueluma’s AI server transmit the request through that server. The applicable provider and sharing should be disclosed before upload; separate permission is required where applicable. Decline or stop AI requests to avoid further AI uploads. This policy does not itself grant permission or recall information already processed.
Account, purchase, and technical data
When the account service is used, it processes a guest or user identifier, authentication/session records, and activity timestamps to provide access and protect the service. Subscription features process product and transaction-related identifiers, purchase status, entitlement and expiry information, and purchase-event records through Apple and RevenueCat to verify and restore access. We do not receive full card numbers.
Our servers and hosting providers can process IP addresses, request times, requested paths, response status, and error or security records to deliver content and prevent abuse. Email support receives your address, message, and attachments you choose to send. Do not send passwords, API keys, payment-card details, or identity documents by ordinary email.
Why we process information
We use requested images and settings to deliver AI guidance; identifiers and purchase records to provide access and entitlements; technical records to operate, troubleshoot, and protect the service; and correspondence to answer requests. Where the GDPR or similar law applies, the bases are performance of a contract for requested services, consent for optional processing where required, legitimate interests in proportionate security and support, and compliance with legal obligations. Where local law does not recognize legitimate interests as a basis, we use an available lawful basis instead. We do not use photography guidance to make decisions with legal or similarly significant effects about you.
Recipients and third-party services
OpenRouter routes AI requests and the selected model provider, currently Google for the configured Google models, processes their content. RevenueCat verifies subscription entitlements when that service is enabled; Apple handles App Store purchases and the Apple services you choose. Cloudflare delivers and protects this website and processes associated connection data. Support email is handled by the mail provider used for our support address.
We may disclose necessary information to service providers acting for us, where legally required, to protect rights and safety, or as part of a lawful business transfer with appropriate notice and protections. Providers acting on our behalf must be subject to appropriate confidentiality, security, and data-protection obligations. Their own roles and policies can also apply to services they independently provide. See the policy links below.
AI retention and model training
Cueluma does not run a model-training pipeline using your photos. This is not a promise that every external AI endpoint has zero retention or excludes training. OpenRouter and model-provider handling depends on the endpoint, account privacy settings, and applicable service terms. If you use your own API key, your provider-account settings also apply. Review those policies before submitting sensitive images; contact us for the processing details of the version you use.
Storage and retention
On-device photos remain until you delete them, subject to app storage and your device or cloud-photo settings. AI images and results are handled in working memory. Server versions temporarily cache the analysis plan and framing settings to complete a multi-step request; the current server does not put the original image in that session cache. Temporary sessions expire and are cleared after the generation attempt. This does not mean all network, backup, or provider copies are immediately erased.
Account and entitlement records are kept while needed to provide access, restore purchases, prevent fraud, or meet legal recordkeeping requirements. Technical records are retained according to security and troubleshooting needs; support correspondence according to the request, follow-up, and legal requirements. Retention is determined by purpose, sensitivity, account status, legal duties, and dispute needs. Contact us for applicable periods and deletion; no universal fixed deletion period is promised for all providers and backups.
International processing and security
OpenRouter, Google, Apple, RevenueCat, and Cloudflare operate internationally, including in the United States. Information may be processed outside your country, where protection laws can differ. Transfers must meet applicable legal requirements, using a valid transfer mechanism and safeguards where required. Contact us to learn the recipients, locations, and safeguards applicable to your service. This notice is not consent to an international transfer; any legally required separate notice or consent must be provided before the transfer.
We use measures such as encrypted network connections, restricted access, and protection of credentials appropriate to the service. No system provides absolute security. If a breach requires notice under applicable law, we will notify affected people and authorities as required.
Your choices and privacy rights
You can stop AI uploads, revoke device permissions, delete local photos, and contact supports@cueluma.app to request access, correction, deletion, a copy or portability, restriction, objection, or withdrawal of consent where your law provides those rights. Withdrawal does not invalidate earlier lawful processing. We may request proportionate information to verify a request, but do not send identity documents unless a secure method is arranged. We will respond within the deadline required by applicable law and explain any lawful refusal or retention exception.
Uninstalling does not necessarily erase server, provider, or purchase records, and a privacy request does not cancel an Apple subscription. You can complain to your local data-protection authority and exercise rights without unlawful discrimination. California residents may have rights to know, correct, and delete personal information and to use an authorized agent, subject to the law’s applicability and exceptions.
Website storage, advertising, and tracking
This legal website uses no advertising cookies, analytics scripts, third-party fonts, or tracking pixels. It reads browser language preferences to select a translation automatically and does not read or write browser local storage. Cloudflare can still process technical connection data to serve and secure the site. Cueluma does not sell personal information or share it for cross-context behavioral advertising, and the current app does not include an advertising-tracking SDK.
Children and sensitive images
Cueluma is not directed to children under 13, or a higher minimum age required locally. Do not knowingly submit a child’s personal information without the legally required guardian authorization. Some laws treat children’s images and biometric or other sensitive information as specially protected. A guardian who believes a child’s data has been submitted can contact supports@cueluma.app so we can investigate and take appropriate deletion or other protective steps.
Policy updates and contact
We will update this page when our practices change and provide additional notice or obtain new consent before materially different processing where required. Translations are provided for accessibility; no language version takes away protections available under your local law. For support, complaints, provider details, or any privacy request, email supports@cueluma.app.