Privacy Policy

AI Headshot Generator for iOS and Android · Last updated 9 September 2026

This policy explains what AI Headshot Generator does with your information. It covers the AI Headshot Generator iOS and Android app published by Hbrothers L.L.C. (doing business as Hbro Studio) and nothing else.

The short version. The app needs an account. You can skip sign-in and we create an anonymous one on the device. There are no ads. To make a headshot we upload the photo you chose to our servers and send it, with a style prompt, to OpenAI. We keep that photo, the generated image, your credit balance and your history on your account until you delete the account in Settings. The app uses Google Firebase and RevenueCat to run that service. We do not sell your photos and we do not use them to train our own models.

Who we are

AI Headshot Generator is published by Hbrothers L.L.C., trading as Hbro Studio. The app is identified on the App Store as AI Headshot Generator (App Store ID 6468952417, bundle identifier com.hbrothers.fashionHelper) and on Google Play as applicationId com.hbrothers.fashion_helper.

Questions about this policy go to info@hbro-studio.com. Our website is https://www.hbro-studio.com. This page is published at https://www.hbro-studio.com/ai-headshot-generator-policy.

What we do not do

• We do not show advertising and we do not work with advertising networks.
• We do not sell or rent personal information, and we never have. We do not “share” personal information for cross-context behavioural advertising as that term is used in the CCPA/CPRA.
• We do not sell your photos, and we do not use your photos or generated headshots to train our own models.
• We do not use the Identifier for Advertisers (IDFA), we do not fingerprint your device for advertising, and we do not drop advertising cookies inside the app.
• We do not ask for your contacts, your location, your health data or your microphone as a product feature. The current camera takes still photos only.

Accounts

You can sign in with Apple or Google, or skip. Skipping still creates an account: Firebase Authentication mints an anonymous user id so your credits, history and free headshot survive an app restart. You can later attach Apple or Google to that same account from Settings.

If you sign in with Apple or Google we receive the identifier those services issue for you. If you share a name or email address with those services, we store that name and email on your user document so the app can show them in Settings. We do not require a name or email to use the app.

On your account we store:

• Your Firebase user id
• Name and email, if the sign-in provider gave them to us
• Whether the account is still anonymous
• Your remaining credit balance
• Whether this account has used the free onboarding headshot
• Generation jobs and finished history (the photo you put in, the headshot that came out, the style name, and any description you typed)

You can delete the account in Settings → Delete account. That permanently removes the Auth record, the user document, generation jobs, history, and the photos stored for that account. It cannot be undone. Unused credits are lost. Deleting the account does not refund App Store or Play purchases, and it does not cancel a subscription in the store — cancel those in Apple or Google settings. We sell credit packs, not a subscription, but if a store subscription were ever attached to the same Apple or Google account, this button would not cancel it.

Photos, prompts and generated headshots

When you tap Generate, the app uploads the photo you chose to Google Cloud Storage under your user id, then asks our Cloud Function to start a job. The worker downloads that photo and, for a built-in style, a style-reference image we already host. It sends those images plus a text prompt to OpenAI’s image API (currently gpt-image-2) to produce the headshot. If you wrote your own description, that text is first rewritten by a small OpenAI language model so the result stays a headshot of you, then used in the same image request.

What leaves your device for a generation:

• The photo you selected (camera, library, or a photo you used before)
• The style you picked, or the description you typed
• Your user id, so the result can be written back to your account

The generated image is stored in Cloud Storage on your account and shown in History. We keep input photos so you can reuse them from Recents without taking the picture again.

OpenAI is our subprocessor for this step. The request is sent over HTTPS. We do not use your photos to train our own models. OpenAI’s handling of API inputs is governed by their API terms: they currently do not use API inputs to train their models, and they may retain requests briefly for abuse monitoring before deletion. OpenAI may refuse a photo that fails their safety checks; when that happens we do not keep a generated result, and a charged credit is refunded.

The app cannot generate a headshot without this step. If you do not want a photo sent to our servers or to OpenAI, do not use Generate.

The free headshot

Your first headshot can be generated without spending a credit. To stop that offer being reused by signing out and creating a new anonymous account, the app stores a random device id in the on-device keystore (iOS Keychain / Android encrypted storage) and sends it with the free job. We record that id in a server-side claim so the same device cannot take the free headshot again.

That claim is not your name, email or photo. Deleting the account removes your photos and user document; the device claim can remain so the free offer stays one-per-device. On iOS the Keychain entry can survive uninstalling the app.

What stays on the device

The following is stored locally, in storage readable only by this app:

• A device id used only for the free-headshot limit, in the platform keystore.
• A flag that you have already seen the home paywall, in SharedPreferences / NSUserDefaults.

Photos you capture sit in a temporary file on the device until they are uploaded. Generated images you save to the system Photos library then belong to you in Photos; we do not get a second copy of that save.

If iCloud Backup or Android backup is turned on, Apple or Google may include this app’s local preferences in the encrypted backup of your device. That is their backup of your phone, not extra collection by us. The device id is configured not to sync through iCloud.

Uninstalling the app removes local files and preferences. It does not delete your cloud account, photos or credits. Use Delete account in Settings for that.

Permissions we ask for, and why

• Camera. To take the photo used as the input for a headshot. Refusing it means you can still pick a photo from the library or from Recents.
• Photo library (read). To let you choose an existing photo. Refusing it means you can still use the camera or a photo already in Recents.
• Photo library (add / save). To save a generated headshot to your gallery when you tap Save. Refusing it means the headshot still exists in the app; you just cannot export it to Photos.
• Microphone. Declared because the capture libraries on iOS can require it. The current camera records still photos only. We do not listen to, record or store microphone input. You can refuse this; taking a still photo still works.
• Notifications. Asked at launch so we can send optional status messages through Firebase Cloud Messaging. You can refuse. The app works fully without notifications.

You can revoke any of these later in iOS Settings or Android settings. The rest of the app keeps working; only the corresponding action stops.

Purchases

Credit packs are sold as in-app purchases through the Apple App Store and Google Play. Payment is handled by Apple or Google. We never see your full card number. We use RevenueCat to verify the purchase and to tell our server how many credits to add. RevenueCat receives your app user id (our Firebase uid), product identifiers, and the store receipt needed to confirm the payment.

We keep a server-side record of each processed purchase event so the same receipt cannot grant credits twice. That record is not your photo.

Restore purchases is on the paywall. It asks Apple or Google to re-deliver purchases already made on that store account. Because these products are consumable credit packs, restore cannot invent credits that were already used.

Apple’s and Google’s handling of payment data is governed by their own privacy policies. RevenueCat’s is at https://www.revenuecat.com/privacy.

Firebase, diagnostics and notifications

The backend for this app is Google Firebase (project hbrothers-fashion-helper), in Google Cloud. We use:

• Authentication — the account described above, including anonymous, Apple and Google sign-in.
• Cloud Firestore — your user document, jobs, history, purchase events and the free-headshot device claim.
• Cloud Storage — the photos you upload and the headshots we generate.
• Cloud Functions — starting a job, generating the image, granting credits after a purchase, and deleting the account.
• Cloud Messaging — optional push notifications. That uses an FCM token for the device.
• Analytics and Crashlytics — a Firebase installation identifier, crash stack traces, device model, OS version, and basic usage events such as the app being opened. We use that to keep the service working and to find crashes. We do not use it to advertise to you.

Google’s processing is governed by Google’s privacy policy: https://policies.google.com/privacy.

Opening this Privacy Policy, Terms of Use, or an App Store / Play listing uses Safari, Chrome or the store app on your device. That is you visiting those pages, not the app uploading your photos.

Things you send on purpose

Two actions leave the app because you chose them. Neither is required to generate a headshot.

• Share. You can share a generated headshot through the system share sheet. The image goes only to the app or person you pick. We do not receive that share.
• Contact support. If you tap Contact, your mail app opens a message addressed to info@hbro-studio.com with the app name and version in the subject. We then receive whatever you write, the email address you send from, and any attachment you add. We use that only to answer you. We keep support mail only as long as needed to handle the request, then delete it.

Legal basis (EEA, UK and Switzerland)

Where the GDPR, UK GDPR or Swiss FADP applies, Hbrothers L.L.C. is the controller of the account, photos, prompts, generated images, purchase records and diagnostic data described in this policy. We rely on:

• Performance of the contract (GDPR Article 6(1)(b)) to create the account, store your photos, generate headshots, keep your history and credit balance, and process a purchase you started.
• Legitimate interests (Article 6(1)(f)) to operate the free-headshot device limit, to keep purchase-event ids so we do not grant the same payment twice, to diagnose crashes, and to answer support email.
• Consent (Article 6(1)(a)) where a platform requires it for notifications, camera or photo-library access. You can withdraw that consent in system settings. Doing so does not delete the photos already on your account; use Delete account for that.

There is no profiling and no automated decision-making that produces legal or similarly significant effects concerning you. The image model produces a picture you asked for; it does not decide anything about you.

How long we keep information

• Account, photos, jobs and history — for as long as the account exists. Deleted when you use Delete account.
• Free-headshot device claim — kept so the offer cannot be reused on that device, including after the account is deleted.
• Purchase event ids — kept long enough to make credit grants idempotent. They are not your photos.
• OpenAI processing — in transit to produce the image; any short retention by OpenAI is for abuse monitoring under their API terms.
• Support email — only as long as needed to handle the request, then deleted.
• On-device flags and the device id — until you delete the app (the iOS Keychain id can survive uninstall).

Your rights

Depending on where you live, you may have the right to access, correct, delete, export, restrict or object to the processing of your personal information, and to complain to your local data protection authority. California residents have equivalent rights under the CCPA/CPRA, including the right to know, to delete, to correct, and not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined there. Residents of Virginia, Colorado, Connecticut, Utah and similar US state privacy laws have comparable rights; the same facts apply.

The practical way to delete what we hold about your use of the app is Settings → Delete account. That is also how we meet App Store guideline 5.1.1(v). If you need a copy of what we hold, or you believe something remains after deletion, write to info@hbro-studio.com and we will respond within the time limits set by applicable law.

You may lodge a complaint with a supervisory authority. In the UK that is the Information Commissioner’s Office (https://ico.org.uk). In the EEA, it is the authority of your country of residence.

Children

AI Headshot Generator is not directed at children. We do not knowingly collect personal information from children under 13 (or under 16 where that is the applicable age). If you believe a child has created an account or sent us personal information, write to info@hbro-studio.com and we will delete it.

Security

On-device data is protected by the iOS or Android app sandbox. Photos and account data in transit use HTTPS. Access to Firestore and Storage is limited by security rules so another user cannot read your files. Cloud Functions use the signed-in user’s token; there is no user-id parameter you can swap to reach someone else’s account. Support email is ordinary email; do not send passwords or identity documents to us.

No method of transmission or storage is perfectly secure. Generate only from photos you are willing to have processed by our servers and by OpenAI.

International users

AI Headshot Generator is offered worldwide through the App Store and Google Play. Our Firebase project and Cloud Functions run on Google Cloud (us-central1). OpenAI and RevenueCat process data in the countries where they operate. If you use the app from the EEA, UK or Switzerland, that is an international transfer. We rely on the contractual safeguards those processors provide (including Standard Contractual Clauses where they apply) together with the fact that the transfer is necessary to generate the headshot you asked for.

If you email us, that message is received at the mailbox for info@hbro-studio.com.

Changes to this policy

If we change how the app handles information, we will update this page and the date at the top. Material changes will be described here rather than made silently.

Contact

Questions about this policy, or about privacy in AI Headshot Generator, go to info@hbro-studio.com.

Hbrothers L.L.C.
Trading as Hbro Studio
info@hbro-studio.com
https://www.hbro-studio.com

© 2026 Hbrothers L.L.C. All rights reserved. AI Headshot Generator for iOS and Android. Terms of Use are Apple’s standard EULA at https://www.apple.com/legal/internet-services/itunes/dev/stdeula/.

‍