Unempty AI Privacy Policy
Summary
A plain-language overview. The sections below say it in full.
| Question | Short answer |
|---|---|
| Who is responsible for my data? | Yury Korneo, a sole trader in Spain, trading as Unempty AI (details above and in the Legal notice). |
| Do I need an account? | No. The web app creates an account in your browser, and the iPhone app creates one on its first launch. Signing in is optional: with your email, or in the iPhone app also with Apple. You can even buy a plan or a credit pack without signing in (Link's checkout asks for your email; the App Store uses your Apple Account). Sign in to keep your rooms, credits and plan if this browser's or this phone's data is lost, or to reach them from another device. |
| What do you collect? | Your photos and what you ask for, the results, an account id, your email if you sign in (or, if you buy on the web without signing in, the email you give at checkout), the user id Apple gives us if you sign in with Apple, your credits, plan and credit packs, usage events without your photos, feedback and reports you choose to send us in the app, and technical logs. |
| Where does my photo go? | To our servers (Supabase, in Ireland) and to Google's Gemini models, which make the result for us as our processor. This is the same in the web app and the iPhone app. That is how the result you ask for is made, so it happens when you start one (§3, §5). Your browser, or the iPhone app, removes location data from the photo before it is sent. |
| Does Google train its AI on my photos? | No. We use Google's paid API, whose terms say Google does not use prompts or results to improve its products. Google keeps a short log to detect abuse. |
| Do you train AI on my photos, or use them in marketing? | No. |
| Who handles my payment? | Web purchases are "Sold through Link". Sold through Link, LLC is the merchant of record: it sells you the plan or credit pack and handles the payment; Unempty AI (Yury Korneo) provides the service. Link handles your payment details under its own privacy policy. In the iPhone app you buy through Apple's App Store: Apple takes the payment under its own terms, and RevenueCat, our processor, tells us what you bought. We never see your card number. |
| How long do you keep my photos? | Photos and results in your rooms stay until you delete the room (in the iPhone app) or your account. An account you never signed in to is deleted, with everything in it, after 12 months without use. A photo you upload but never use is deleted after 24 hours. |
| How do I delete everything? | In the web app: My rooms → Account (the gear) → Delete account. In the iPhone app: My rooms → the gear (Settings) → Delete account. Your account, rooms, photos and results are deleted from our systems within 24 hours. We keep only payment event ids with no link to you and, if you signed in while we offered a sign-in bonus, the one-way code that stopped it being claimed twice (§7). Deleting your account does not cancel a plan bought in the App Store: cancel it with Apple (§8). |
| Cookies or ads? | No cookies of ours, no advertising, no advertising identifier in the iPhone app, no selling of data. |
| Where can I complain? | To us first, and to the Spanish data protection authority (AEPD) or the one where you live. |
1. Who we are
Yury Korneo, a sole trader (autónomo) in Spain trading as Unempty AI, runs the website unempty.app, the web app at app.unempty.app and the Unempty AI app for iPhone. This policy covers all three. He is the controller of the personal data described here, under the EU General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD). In this policy "we" means him.
Write to support@unempty.app about anything in this policy. We have not appointed a data protection officer; the law does not require one for a service like ours.
2. What we collect
We collect only what the Service needs. We never ask for your phone number or your address (Link's checkout may ask for a billing address, under Link's own policy, §4).
| What | Details | Where it comes from |
|---|---|---|
| Account | A random account id, created in your browser on your first visit (in the iPhone app, on its first launch), and the time your account first sent a photo for a result. If you sign in: your email address. The one-time codes we email you. If you sign in with Apple (iPhone app only): the user id Apple gives us for you, and the email address Apple shares with us — your own, or an Apple relay address if you chose to hide your email. We do not ask Apple for your name. | You, your browser or the iPhone app, Apple |
| Email from checkout | Only if you buy a plan or a credit pack without signing in: the email address you type on Link's checkout page, as Link (Stripe) reports it to us. It is not your sign-in and we do not treat it as confirmed: we use it only to send a one-time sign-in code to it right after the purchase and to fill in the "confirm your email" form (so you can keep your plan on every device — the code is the only way it becomes your sign-in), and to find your purchase if you write to support. | Link (Stripe) |
| Sign-in bonus record | Only if you signed in while we offered free credits for signing in (we no longer do): a one-way code (SHA-256 hash) made from your email address, so those credits were given only once per address. It is kept after you delete your account (§7). We make no new ones. | Made on our server |
| Your photos | The photos you choose, take or drop in. Before upload, your browser (or the iPhone app) redraws each photo at up to 2048 pixels and saves it as a new JPEG, which removes its location (GPS) and other camera data. | You |
| What you ask for | The tool, the style and the room type (we suggest it from the photo, you can change it), your notes and your Describe a change instructions. | You; our reading of the photo |
| Results | The images made for you, kept with your rooms. For a free result that carries the watermark (§5), the watermarked copy too, kept beside the clean result. | Made by Google's models for us; the watermarked copy by our servers |
| Job records | For each result: time, tool, style, notes, which model and instruction version we used, cost, duration, the check's scores and any error. | Our servers |
| Credits and plan | Your credit balance and its history (free, plan and pack credits), your plan and the end of its period; the id of the customer record Stripe keeps for you. From Link (Stripe): the plan or credit pack you bought, payment and subscription status, amounts, refunds and the country used for tax. From the App Store, through RevenueCat, for purchases in the iPhone app: the plan or credit pack you bought, its price and currency, the App Store's transaction ids, and renewals, cancellations and refunds. We never receive your card number. | Our servers; Link (Stripe); Apple through RevenueCat |
| Usage events | On unempty.app: a page view — the page's path, the website that linked to it and the ad campaign in its address (utm parameters), with a random id made for that page load and not kept, so visits are counted but no visitor is recognised, even on the next page. In the web app: the app opening (with the ad campaign and website that brought you, when the address carries them), a first result, the plans sheet opening, a like or dislike you give a result (with which result it was and the tool that made it), saving or sharing a result (with which result it was and the tool that made it: as a photo, a before-and-after picture or a video, downloaded or through your phone's share menu, and whether it carried the watermark, the corner mark or the label — never the file), a checkout starting and a purchase, linked to your account id (also when you never signed in) and sent to the analytics service by our servers, not by your browser. In the iPhone app: the same events, except that the app opening carries the link that opened the app (if any) instead of an ad campaign, and a tap to buy a plan or a pack (which one) replaces the checkout starting; the app sends them to our servers with your account id, and our servers forward them — the app has no analytics tool and no analytics identifier of its own. If your browser sends Do Not Track or Global Privacy Control, the page view, the app's own events and the ad campaign are not sent; our servers' records of a first result, a checkout and a purchase still are, with your account id. An iPhone sends no such signal. You can object to all of these events, and we then set your account to opt out and delete your analytics record (§9). Never your photos, results, notes or email. | Your browser or the iPhone app; our servers |
| The ad that brought you | The ad campaign (utm parameters) and the website that linked to the app, from the first app opening that carried them, kept with your account so a purchase can be linked to its ad. | The address you arrived on |
| Technical logs | IP address, browser or app type, time and address of each request, and errors, kept by our hosting providers; your IP address is also used to limit how many new accounts one network can create. | Your browser or the iPhone app, and your network |
| Support | What you write to support@unempty.app and our replies. | You |
| Feedback in the app | Only if you send it: what you write when you tell us why you disliked a result or send us a note from the settings (up to 1,000 characters), which result it is about, and an email address if you choose to add one so we can reply. Never your photo or the result itself. | You |
| Reports (iPhone app) | Only if you send one: which result you reported and the reason you chose from the list ("Room structure changed", "Unrealistic result", "Inappropriate content", "Something else"). | You |
We do not collect your contacts, your location, your photo library (you pick photos yourself), or any health, financial or biometric data.
The iPhone app's permissions. You pick photos with Apple's photo picker, so the app cannot see the rest of your library. The app asks for the camera only to take a photo in the app, reads the phone's motion sensor only to show whether the camera is level (those readings never leave your phone), and asks to add to Photos only to save the pictures you choose — it cannot read your library with that permission. You can say no to any of them and still choose a photo from your library.
What you have to give us. No law obliges you to give us personal data. To make results we need your photos; to sign in we need your email address (or, in the iPhone app, your Apple sign-in), and Link's checkout asks for an email when you buy on the web. Without them we cannot provide those parts of the Service; you can still look around the site and the app without giving anything.
3. Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running your account and rooms, making results, signing you in (by email code or, in the iPhone app, with Apple), keeping your credits and plan | Account, photos, requests, results, job records, credits and plan | Contract (Art. 6(1)(b)): the service you asked for |
| Sending your photo and your requests to Google to make the result, from the web app or the iPhone app | Photos, requests | Contract (Art. 6(1)(b)): the result you ask for cannot be made without it. Google processes them only for us, as our processor (§4), and does not use them to train its models; §5 says what is sent and when |
| Giving the plan or credit pack you bought, refunds, changes of plan | Credits and plan, data from Link or, for the iPhone app, from the App Store through RevenueCat | Contract |
| Helping you keep a purchase made without signing in: sending a sign-in code to the email from checkout right after the purchase, filling in the "confirm your email" form, and finding the purchase if you lose access to the browser | Email from checkout, the Stripe customer id | Contract (Art. 6(1)(b)): the plan or pack you bought |
| Preventing abuse: limits on new accounts and requests, filters on notes, keeping a past sign-in bonus from being claimed twice | Technical logs, IP address, notes, sign-in bonus records made while it was offered | Legitimate interest (Art. 6(1)(f)) in keeping the Service safe and the free credits fair |
| Understanding which steps of the site and app work, which results people like or dislike (to improve the quality of results), and which ad brought a customer | Usage events, the ad that brought you; for a result you liked or disliked, its job record (tool, style, versions, the check's scores — never your photo, result or notes) | Legitimate interest in improving the Service and its results, with first-party events that store nothing extra on your device — no cookies, no analytics identifier in your browser; the app's events (web app and iPhone app) use the account id it already keeps for your sign-in — without your photos and without any advertising profile. If your browser sends Do Not Track or Global Privacy Control, the site's page view, the app's own events and the ad are not sent; our servers' records of a first result, a checkout and a purchase still are, tied to your account id. You can object at any time (§9): we then set your account to opt out, so nothing more is sent for it, and delete your analytics record |
| Answering you | Support | Contract, or legitimate interest when you are not a customer |
| Reading the feedback you send in the app, to fix what went wrong and improve results, and replying to you if you gave an email | Feedback in the app; for a result you wrote about, its job record (tool, style, versions, the check's scores) | Legitimate interest (Art. 6(1)(f)) in supporting you and improving the quality of results. Sending feedback is up to you, and so is adding an email; we use that email only to reply about your feedback |
| Looking into a result you report in the iPhone app, and removing content that breaks the Terms | Reports; the reported result, the photo it was made from and its job record | Legitimate interest (Art. 6(1)(f)) in keeping the Service safe and its results right. Sending a report is up to you |
| Keeping accounts and tax records; answering authorities | The minimum needed | Legal obligation (Art. 6(1)(c)) |
What we never do: train or fine-tune AI models on your photos or results; use your photos or results in our marketing, screenshots or quality tests; sell or rent your data; show advertising; build advertising profiles.
Automated decisions. Two automatic steps affect what you see: we suggest a room type and tool (you can change both), and an automatic check may reject a result (you pay nothing and can try again). Neither has legal or similarly significant effects on you (GDPR Art. 22).
4. Who receives your data
We share data only with the providers below. Those marked "processor" act only on our instructions, under data-processing terms.
| Who | What they receive | Why | Where |
|---|---|---|---|
| Supabase, Inc. (processor) | Everything in §2 except the site's page views and support emails | Database, file storage, sign-in, our server functions | EU — Ireland (AWS eu-west-1). Supabase staff and sub-processors may access data from other countries for support |
| Google LLC — Gemini API (processor) | Your photo; for a Fix, the result you are fixing; the tool, style, room type, your notes and our instructions — the same from the web app and the iPhone app. Not your email or account id | Making the result, reading the photo (room type, scene), checking the structure | The United States and other countries where Google has facilities. On the paid API, Google's terms say it does not use prompts or responses to improve its products, and keeps them for a limited period only to detect abuse |
| Resend (processor) | Your email address and the sign-in email | Sending the sign-in codes | Sent from the EU (Ireland) by a US company |
| PostHog (processor) | Usage events (§2). From the site, the page view goes from your browser straight to PostHog's EU cloud, so PostHog receives your IP address and browser details with the request; we have its "Discard client IP data" setting on, so the IP address is not stored, and the page view carries a random id that is not kept and makes no profile. From the web app and the iPhone app, events with your account id, sent by our servers | Product analytics | PostHog's EU cloud (Germany) |
| RevenueCat, Inc. (processor) | For purchases in the iPhone app: our account id for you and your App Store purchases (the plan or pack, price and currency, the App Store's transaction ids, renewals, cancellations and refunds). Not your photos, your email or any advertising identifier | Checking App Store purchases and telling our servers about them, so you get the plan and credits you bought | United States (Amazon Web Services) |
| Zoho — Zoho Mail (processor) | Emails you send to support@unempty.app, and our replies | Our support mailbox | Zoho's EU data centre |
| Link — Stripe (independent controller) | At checkout you give your details to Link directly. We send Stripe your account email if you are signed in (none if you buy without signing in), our account id for you and the ad that brought you (§2); Stripe sends us the email you typed at checkout when you bought without signing in. Stripe sends us the purchase details in §2 | Sold through Link, LLC is the merchant of record: it sells you the plan or credit pack and handles the payment; Unempty AI (Yury Korneo) provides the service. Stripe also handles taxes, receipts, fraud prevention, refunds and transaction support | Stripe's own policy: link.com/privacy and stripe.com/privacy |
| Apple (under its own privacy policy) | App Store: you buy a plan or a credit pack in the iPhone app through Apple's App Store, with your Apple Account, so Apple has the details of that purchase; Apple tells RevenueCat, and so us, what you bought (above). Sign in with Apple: Apple tells us the user id and the email address in §2. When you delete your account, we send Apple a one-time code from your confirmation so that Apple ends the app's Sign in with Apple access (§8) | Taking the payment for App Store purchases, with their taxes, receipts and refunds; signing you in | Apple's own policy: apple.com/legal/privacy |
We use no advertising or social-media trackers and no data brokers.
We may disclose data when a law, a court or a competent authority requires it, or to protect someone's safety or the Service. If the business is transferred to someone else, your data may go with it under this policy; we will tell you before that happens.
5. How your result is made, and AI marks
When you start a result, the web app or the iPhone app sends your photo, the room type, the style and your notes through our servers to Google's Gemini image models, only to make that result, to read the photo (room type, scene) and to check the result against your photo. Google acts as our processor (§4) and does not use them to train its models; neither do we (§3). We keep the photo and the result as §7 says. This is part of the service you ask for (§3). Neither app shows a separate screen about it: this policy and the Terms of Use are where we tell you, and both apps link to them.
Every image Google's models make carries an invisible SynthID watermark, which says of the image that it was made by AI; we never remove it. Saved results can also carry a visible label (for example "Virtually staged") if you add it. Results saved without a paid plan carry a small "Made with Unempty AI" mark, and every free result after your first carries a visible "Unempty AI" watermark across the picture until you buy a plan or a credit pack (Terms §5.5). These marks describe the image; they do not identify you.
6. International transfers
Your account data, photos and results are stored in the EU (Ireland). Some providers in §4 are in the United States or may access data from there: Google, Netlify, Stripe, RevenueCat, and the US companies behind Supabase, Resend and PostHog. Where a provider is certified under the EU–US Data Privacy Framework, the transfer relies on that framework (an adequacy decision of the European Commission); otherwise it relies on the European Commission's standard contractual clauses in the provider's data-processing terms. You can ask us for details.
7. How long we keep it
| Data | How long |
|---|---|
| Photos and results in your rooms | As long as your account exists, or until you delete the room. Every photo you make a result from is kept in a room. In the iPhone app you can delete a room yourself (its menu → Delete room), which deletes its photos and results. The web app cannot delete a single room yet; write to us and we delete it for you, or delete your account to remove everything |
| An account that was never signed in (no email, no Sign in with Apple) | Deleted automatically, with its rooms, photos, results, job records and credits, after 12 months without any use — no visit to the app from that browser or phone, no result, no upload. The deletion is the same as when you delete the account yourself (§8). An account that ever had a paid plan or bought credits is not deleted this way |
| A photo you uploaded but never used for a result | Deleted automatically 24 hours after upload |
| A sign-in you started but never confirmed (a code was sent to your email and never entered) | The unconfirmed sign-in record with your email is deleted 30 days after the last code we sent to it |
| Job records, credits, plan | As long as your account exists |
| Email from checkout (only if you bought without signing in) | Until you sign in from this browser, or support moves your purchase to your signed-in account (it is deleted then), or you delete the account. An account that bought something is never deleted for inactivity, so the purchase stays findable |
| Payment event records (Stripe's event ids, type, time and outcome; for App Store purchases, RevenueCat's event ids, the product, the App Store transaction id, time and outcome) | Kept after your account is deleted, with no link to you, as the history of payments |
| Sign-in bonus record (the one-way code made from your email, only if you signed in while we offered the bonus) | Kept after your account is deleted, so the bonus can never be claimed twice for one address. It cannot be turned back into your email address |
| Usage events | Deleted with your account; otherwise after 12 months (the site's page views, which are linked to no one, after 12 months) |
| The ad that brought you | As long as your account exists (and in Link's records of the purchase, under Stripe's policy) |
| Technical logs | A short period set by our hosting providers (days to a few weeks) |
| Support emails | Up to two years after the conversation ends, unless we need them longer for a legal claim |
| Feedback you send in the app (and the email you added to it) | Deleted with your account; otherwise 12 months after you sent it |
| Reports you send in the iPhone app | Deleted with your account |
| Data in your browser | See §11 |
| Google's abuse log | A limited period set by Google |
| Purchase records at Link (Stripe) | Kept by Stripe under its own policy, including for its tax duties as the seller |
| App Store purchase records | At RevenueCat: deleted when you delete your account. At Apple: kept by Apple under its own policy |
| Data in the iPhone app | See §11 |
An account that was never signed in lives in one browser, or in the iPhone app on one phone. If you clear that browser's data first, you can no longer reach the account to delete it, and its rooms stay stored until it has gone 12 months without use; then we delete it, as the table above says. Delete the account in the app before you clear your browser if you want them gone sooner. Some browsers clear a site's data by themselves (Safari, after seven days of browsing without a visit to the site). If you bought a plan or credits without signing in and lose the browser's data, write to support@unempty.app from the email you used at checkout: once you sign in with that email, we move the purchase and the rooms to your account. In the iPhone app, a plan bought without signing in is also tied to your Apple Account: if you lose the phone or the app's data, Settings → Restore purchase, on a phone signed in to that Apple Account, brings the plan back. Credit packs and rooms cannot be brought back that way: sign in (with Apple or your email) to keep them.
8. Deleting your account
In the web app, open My rooms → Account (the gear) → Delete account and confirm. In the iPhone app, open My rooms → the gear (Settings) → Delete account and confirm. If you have a plan bought on the web, it is cancelled at once and nothing more is charged; the time left is not refunded (Terms §7.4). A plan bought in the iPhone app is billed by Apple, and deleting your account does not cancel it: cancel it first in Settings → Manage subscription (the app reminds you before you confirm). If you signed in with Apple, Apple asks you to confirm once more, and we then ask Apple to end the app's Sign in with Apple access for your Apple Account; if that step fails, your account is still deleted, and you can remove the app from Sign in with Apple in your Apple Account settings. We then delete your account, rooms, photos, results, job records, credits, the feedback and reports you sent in the app and usage events from our systems within 24 hours (a result still being made is deleted as soon as it finishes), ask RevenueCat to delete its record of you, and clear the account from this browser or the iPhone app. What stays, as §7 says: the ids of payment events, with no link to you, and, if you signed in while we offered a sign-in bonus, the one-way code that stopped it being claimed twice. Copies held in our hosting provider's routine backups are not edited; they disappear when those backups are replaced in the normal cycle. This works for accounts that were never signed in, too. Results you have already saved on your device stay there.
Link (Stripe) keeps its own records of your purchases. You can ask Link to delete your Link data through its privacy centre (link.com/privacy-center); Stripe then also cancels any plan sold to you through Link. Apple keeps its own records of App Store purchases, under Apple's privacy policy.
9. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict its use, to receive it in a portable format, and you can object to uses based on our legitimate interest (such as usage analytics). If you object to usage analytics, we set your account to opt out — from then on our servers send no usage events for it and keep no ad that brought you — and delete your analytics record at the analytics service; the site's page views carry no account, so there is nothing of yours to delete there. Write to support@unempty.app; deleting your account in the app is the quickest way to erase everything. We answer within one month (two more months for complex requests, and we will tell you if so). We may ask you to show that the account is yours; for an account that was never signed in, this may only be possible from the browser or the phone where it lives. Requests are free.
We give these rights to everyone, wherever you live.
You can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or to the data protection authority of the EU country where you live or work. In the United Kingdom: the Information Commissioner's Office (ico.org.uk). We would be glad to try to solve it with you first.
10. Security
- All traffic is encrypted (HTTPS).
- Photos and results sit in private storage. Each account can read only its own data (row-level security in the database).
- The keys to Google, Stripe and the database never reach your browser or the iPhone app; every request goes through our servers with your signed-in session. (The iPhone app's purchases go from the phone to Apple and RevenueCat, §4.)
- Your browser, or the iPhone app, removes location data from photos before upload.
- The iPhone app keeps your sign-in session in the iPhone's Keychain.
- Access to production data is limited to the provider.
- If a breach puts your data at risk, we tell the AEPD within 72 hours and, where the risk to you is high, you without undue delay.
11. Cookies, browser storage and the iPhone app's storage
We set no cookies. The web app keeps a few things in your browser's own storage, to work:
- Local storage: your sign-in session; a short lock so two open tabs do not sign in twice; whether you have seen the introduction; your choices per room and result (label on or off, like or dislike, which "Surprise me" idea comes next); a note of a result being made, so a reload can find it; after you are signed out, your email, only to fill in the sign-in form, for at most 30 days; a note that the account was deleted, for 10 minutes.
- Session storage: where to bring you back after checkout, for at most 2 hours; whether the plans were already shown in this visit, so they open once, until you close the tab.
- IndexedDB: if you go to checkout in the middle of a new room, the prepared photo, so you do not have to choose it again; read once and deleted, and never kept more than 2 hours.
All of it is needed for something you asked the app to do; nothing is stored for analytics or advertising. No analytics identifier is added to your browser: the site's page view uses a random id that exists only while the page is open, and the app's events are tied to the account id the app already keeps for your sign-in session and are sent by our servers — nothing extra is stored for them. With Do Not Track or Global Privacy Control on, the page view, the app's own events and the ad campaign are not sent; our servers' records of a first result, a checkout and a purchase still are (§3), unless you object: we then set your account to opt out and delete your analytics record (§9). You can clear all of it in your browser's settings; an account that was never signed in is then lost (§7) — a purchase made without signing in can be moved to your account by support (§7). Link's checkout page, on Stripe's own site, uses cookies under Stripe's policy.
The iPhone app keeps your sign-in session in the iPhone's Keychain and, in its own storage on the phone: whether you have seen the introduction and the answer you gave to its first question (our servers do not keep it); your choices per result (label on or off, like or dislike); a note of a result being made, so the app can find it again; whether you had a plan and when the app last offered to confirm your email; and copies of our example pictures, so they load faster. Your photos and results are shown from our servers and are not kept in that copy store. Nothing is stored for analytics or advertising, and the app uses no advertising identifier. Deleting your account removes its session, its label choices and the pictures it had loaded from the app.
12. Children
The Service is not meant for children. You must be at least 16 (Terms §2). If we learn that we hold data of someone younger without a parent's or guardian's consent, we delete it; please tell us at support@unempty.app.
13. Changes to this policy
We will publish changes on this page with a new effective date. For an important change (a new provider, a new purpose, a new retention period) we tell signed-in users by email or in the app before it applies.
14. Contact
Yury Korneo, trading as Unempty AI, Spain (NIF and address at the top of this page and in the Legal notice). Email: support@unempty.app.