Privacy Policy – Blish

This policy supplements the general privacy policy at https://optiflowtech.eu/privacy/ with the specific processing activities within the iOS app Blish ("the App"). In the event of a conflict, this app-specific policy prevails for use of the App.

1. Controller

The controller responsible for data processing within the meaning of Art. 4 (7) GDPR is:

2. Overview of Processing Activities

Blish decodes makeup looks from photos and screenshots (colours, liner, finish and how to recreate them), lets you try colours live on your own face (On Me) and looks on a photo of yourself (Styling), and keeps the makeup you own as 3D objects in your Vanity. In doing so, we process the following data:

We collect no real names, no email addresses, no contacts and no advertising identifier (IDFA), and we do not track you across other companies' apps or websites.

3. How the App Works With Your Data

3.1 Decoding a Look

• The photo you choose is analysed on your iPhone. It is saved with the result in the App's storage on your iPhone so you can open the look again; it is never uploaded.
• Before the first decode the App shows what is sent: measured colour values and numeric signals only. Our server compares them with its rules and our product catalog and returns the decoded look and matching products.
• The server keeps the result for 24 hours so the App can fetch it again after a lost connection; then it is deleted. The colour values are not stored beyond that.
• No AI model provider receives your data; the analysis runs on our own rules.

3.2 Face Analysis (Biometric Information)

Only after you agree on a dedicated screen (checkbox and "I agree") does the App analyse the geometry of a face — in photos you decode, for On Me in the live front camera, and in a photo of yourself you style. The geometry exists only in your iPhone's memory during the analysis and is discarded immediately; it is never stored, never sent, never sold or shared. You can withdraw your consent at any time in Settings → Face analysis; the App then works by colour. Details: Biometric Data Policy – Blish.

You confirm that you only analyse photos of yourself or of people who agreed.

3.3 On Me, Styling and Your Colour Profile

• The live try-on uses the front camera and Apple's on-device face tracking. Camera frames are processed in memory and discarded when you leave On Me; nothing is recorded unless you take a photo yourself to share it.
• Styling: the photo of yourself you choose and the face regions found in it stay in your iPhone's memory while you style it and are discarded when you leave Styling or the App goes to the background. The makeup is painted on your iPhone; nothing is sent. The made-up photo leaves your iPhone only if you share or save it.
• Your colour profile (skin depth and undertone estimates, eye colour — from the quiz or a measurement) stays on your iPhone.

3.4 Your Vanity

• Product photos and the 3D objects made from them stay on your iPhone (and in your iCloud/device backup and in exports you create). A photo that shows a face is rejected and not stored.
• To identify a product, only the words read on the packaging (read on your iPhone) or the barcode number are sent to our server. If you confirm which product a barcode belongs to, we store that confirmation with a one-way hash instead of your ID.
• For barcodes outside our catalog we may ask a barcode database (UPCitemdb) about the barcode number only.
• Expiry reminders are local notifications on your iPhone.

3.5 Imports From TikTok and Other Apps

• Photos and videos you share into Blish are handed to the App through a shared container on your iPhone and deleted as soon as the App has imported them. Frames of a video are read on your iPhone; the video file is deleted right after.
• When you share or paste a TikTok link, your iPhone asks TikTok's public oEmbed service for the caption, the creator's name and the cover image — like a browser opening the link. This request goes from your iPhone to TikTok, not through our server.
• Products shown in a video are found on your iPhone: faces are masked before any packaging text is read, and the words are matched against the product catalog stored in the App. Nothing of this is sent to us; analytics only receive counts.

3.6 Stores Near You and Sharing

• The store map asks for your location only when you open it ("while using the App"). The map search runs through Apple Maps; your location is not sent to us.
• Retailer links open the retailer's own website in Safari. These are not paid or affiliate links at this time.
• Share cards and videos are created on your iPhone. By default a card has no photo; you decide whether to include it.

4. Backend Hosting (Cloudflare)

Our backend runs as a Cloudflare Worker. Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

• Cloudflare necessarily processes IP addresses, timestamps and request metadata for delivery and protection against attacks. We do not store IP addresses.
• Our server refuses any request that contains image or face-geometry data.
• Legal basis: Art. 6 (1)(b) and (f) GDPR.
• A data processing agreement including the EU Standard Contractual Clauses is in place. Cloudflare is certified under the EU-U.S. Data Privacy Framework.
• Privacy policy: https://www.cloudflare.com/privacypolicy/

5. Google Firebase

• Firebase Authentication — assigns an anonymous ID per installation; used only to authenticate requests to our backend. No login data.
• Firebase Analytics & Crashlytics — pseudonymous usage events (ids and counts, e.g. "a decode was completed") and crash reports, only in App Store and TestFlight builds. Events never contain images, face data, colours of a face, your colour profile or free text. Not used for advertising; Google's advertising features are switched off.
• Firebase Remote Config — loads app settings (e.g. feature switches). No personal data is sent beyond what the SDK needs to deliver them.
• Legal basis: Art. 6 (1)(b) and (f) GDPR. Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Transfers to the USA are based on the EU-U.S. Data Privacy Framework.
• Firebase privacy information: https://firebase.google.com/support/privacy

6. Subscriptions & Purchases (Apple / RevenueCat)

Blish Pro is sold through the Apple App Store. For purchase validation and restoration we use RevenueCat (RevenueCat, Inc., USA).

• We transmit to RevenueCat the pseudonymous app user ID, the App Store transaction (product ID, purchase and expiration date) and technical metadata (app version, iOS version, device class), plus a few attributes: install date, language, your onboarding answers as fixed ids (e.g. "budget: mid") and where the paywall was shown. Never face-derived data or your colour profile.
• To learn which Apple Search Ads lead to installs, RevenueCat receives Apple's AdServices attribution token. This uses no advertising identifier and no tracking permission.
• Legal basis: Art. 6 (1)(b) GDPR (AdServices: Art. 6 (1)(f) GDPR).
• Privacy policy: https://www.revenuecat.com/privacy
• The payment takes place exclusively between you and Apple. We receive neither your payment data nor your name.

Subscription Details (Transparency Notice for the Paywall)

• Products: Blish Pro Weekly (blish_pro_weekly) and Blish Pro Yearly (blish_pro_yearly).
• Duration: 1 week / 1 year; each renews automatically unless canceled at least 24 hours before the end of the current period.
• Cancellation: at any time in the Apple ID settings on your device.
• Price: as shown on the paywall before purchase.

Terms of use: Terms of Use – Blish.

7. Retention Periods at a Glance

• Photos, saved looks, Vanity, colour profile on your iPhone: until you delete them in the App (one by one, or all at once with Settings → Privacy → Delete all data) or delete the App.
• Link between your sign-in and your app user ID on our server: until you use Delete all data (it is created again when you keep using the App).
• Decode counters: numbers only, no content; kept so that deleting your data cannot reset the weekly allowance.
• Face geometry: only during a single analysis (seconds); never stored.
• Decode results on our server: 24 hours.
• Shared items waiting for the App: deleted when the App imports them; share files are deleted when you close the share screen.
• Consent receipts: kept as evidence of your choices; deleted on request unless we must keep them to prove a consent.
• Barcode confirmations: stored with a one-way hash, not linked to you.
• Firebase Analytics events: 2 months.
• Error logs at Cloudflare: per Cloudflare's standard retention (typically a few days).
• Subscription data at RevenueCat: for the duration of the contractual relationship plus statutory retention periods.

8. Your Rights

Under the GDPR you have the following rights:

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20).
• Objection to processing based on legitimate interests (Art. 21).
• Withdrawal of consent with effect for the future (Art. 7 (3)) — face analysis in Settings → Face analysis; location in the iOS settings.
• Right to lodge a complaint with a supervisory authority (Art. 77), e.g. the Luxembourg Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg, https://cnpd.public.lu.

United States: residents of California and other states with privacy laws can request to know, correct and delete their personal information. We do not sell or share personal information, and we use sensitive personal information (biometric information) only to provide the feature you asked for. For residents of Illinois, Texas, Washington and Colorado, our Biometric Data Policy applies. Blish makes no health-related inferences.

Please direct any requests to: [email protected]

Delete all data in the App (Settings → Privacy) deletes everything on your iPhone — looks, Vanity with its photos, colour profile, answers — and on our server the decode results kept for 24 hours, the cached subscription status and the link between your anonymous sign-in and your app user ID; your anonymous Firebase sign-in is deleted too. Kept: consent receipts (as evidence of your choices) and the decode counters (no content). Your subscription is not affected; you manage it in your Apple Account. It works with or without an active subscription.

For anything else, since we store neither real names nor email addresses, we need your app user ID to identify your data on our server. You can find it in the App's Settings.

9. Children

Blish is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16.

10. Security

All data transfers between the App, our backend and the services named above are encrypted (TLS 1.2+). Credentials are stored exclusively as Cloudflare Worker secrets and never leave the backend.

11. Changes to This Policy

We update this privacy policy whenever processing activities, legal bases or the services we use change. The current version is always available via the link in the App (paywall / settings). We will announce material changes in the App; consent texts carry versions and are asked again when they change.