Privacy Policy

1. Face data we process

Peekaboo accesses the photos you select through the system photo picker, including any faces visible in those photos. Apple’s Vision framework detects face rectangles on your device. The app derives face-center coordinates and records which detected faces you choose to cover or keep visible. It also processes generated images, which may still contain visible faces.

Peekaboo does not use Face ID, TrueDepth, or ARKit face tracking, and does not create facial recognition templates, identity embeddings, or a database identifying people. The app does not extract facial landmarks or a 3D face mesh. A face’s position is used to guide an edit, not to recognize that person across photos.

2. How we use face data

We use photos and face-position information to locate editing regions, show face selections and previews, generate disguises, apply local blur, and check whether a requested face region appears unchanged in the result. AI instructions ask the model to cover children’s faces and leave adults unchanged; the app does not save an age profile or identify the people pictured.

In version 1.0 (15), AI previews start automatically after importing a photo with zero or one detected face, or after you continue from face selection for a photo with multiple faces. The whole selected photo is sent for these previews before you choose a style. Faces you choose to keep visible are still present in that photo. The blur operation itself runs on-device, but choosing blur does not undo an upload already made for AI previews.

Our application uses face data to provide the editing features described here. We do not sell face data or use it for advertising, tracking, identity recognition, or our own model training. Google’s separate safety processing is described below.

3. Sharing and storage of face data

AI requests contain the selected photo, text instructions including normalized face-center coordinates for faces to cover or keep visible, and any additional edit instruction you type. A retry may also include a copy of the photo with the relevant face regions outlined. Requests and results are transmitted over HTTPS.

Google receives this data through the Gemini API to generate previews and edited photos. Our relay is hosted by Vercel: smaller photos, instructions, and generated results pass through that hosting infrastructure. Larger image inputs are uploaded directly to Google’s Files API; the relay forwards their file references and instructions. Our relay application processes requests in memory and does not write photo or face-data payloads to a database, file store, or application logs.

Photos and face data are processed on your device and on Google’s and Vercel’s infrastructure as described above. We do not promise storage in a particular country. Google’s terms allow processing and temporary storage in countries where Google or its agents operate facilities. Hosting providers also process technical request metadata, such as IP addresses, timestamps, and response status, to operate and secure their services.

We use a billing-enabled Gemini API project under Google’s Paid Services terms, which exclude use of prompts and responses for product improvement. We do not opt user photos into optional AI Studio logging, datasets, or data sharing for model improvement. Google separately processes content for safety and policy enforcement; its policy permits authorized human review and training of models specifically for policy enforcement.

If you save or share a result, it goes to your Photos library or the destination you choose. Social-sharing actions may also copy the result to the system clipboard. Any subsequent storage or sharing by your photo-sync service or chosen destination follows that service’s settings and policies.

4. Retention and deletion of face data

On your device: The app holds working photos, face rectangles, face selections, and generated variants in the active editing session. It clears that session when you start over or replace the photo, or when you return after more than 10 minutes in the background. The background rule is checked on return, not by a deletion timer while the app is suspended. Working session state does not survive process termination. The app does not maintain a saved face database or editing history.

Our relay: Photo and face-data payloads are held for request processing, with no persistent photo archive in our relay application.

Google temporary uploads: The app and relay request deletion of Files API uploads after processing, and the app also attempts cleanup after upload or network failures. If deletion cannot complete, Google automatically deletes uploaded files after 48 hours. This expiry applies to uploaded files, not to separate safety logs. See Google’s Files API documentation.

Google safety logs: Google documents 55-day retention of prompts, contextual information, and generated responses for abuse monitoring and required legal or regulatory disclosures. Treat submitted photos and face hints as part of that request context. Deleting a temporary uploaded file does not delete these separate records. See Google’s abuse-monitoring policy.

Saved or shared copies: Your original photo and exported results remain in Photos until you delete them there, subject to your library, backup, and Recently Deleted settings. Copies shared to another service must be deleted through that service. The Instagram clipboard payload expires after five minutes; a copy made for X has no app-defined expiry and can be replaced by copying another item. Resetting Peekaboo does not delete exported or shared copies.

For a privacy or deletion request, contact spooner2802@gmail.com. We will assess the request and coordinate with relevant providers where applicable. We cannot promise immediate removal of provider security records or copies controlled by a sharing destination.