Privacy Policy

EFFECTIVE DATE: 8 SEPTEMBER 2026
LAST UPDATED: 8 SEPTEMBER 2026

1. Introduction

Mistly is built on a single principle: a photo stays yours, and nothing leaves your phone until you ask for it.

This Privacy Policy explains what is and is not processed when you use the Mistly mobile application (the "App"), the limited role of the providers we rely on, and the rights available to you. It has been prepared to comply with the European Union General Data Protection Regulation (GDPR), the UK GDPR, Turkish Law No. 6698 on the Protection of Personal Data (KVKK), the California Consumer Privacy Act (CCPA/CPRA), and the applicable Apple App Store and Google Play requirements. The App is developed and published by Berkay Atik (the "Developer", "we"), trading as Mindnull Studio.

2. Our Privacy Model in Brief

Mistly applies a look to a photo you already have. You pick the photo; the App sends it away only when you run an AI Look, publish to Explore, or set a profile photo — and each of those is something you do on purpose.

No registration is required. There is no username and no password. To operate the App we rely on a small number of external providers, each described below:

• Google Firebase Authentication — gives your installation a random, anonymous identity so purchases and credits stay attached to it.
• Google Cloud Functions — our own server code, and the only thing that talks to the AI providers. It holds every key; the App ships none.
• Google Cloud Firestore and Cloud Storage — hold your credit balance, your Explore posts and your profile. The App has no direct access to either: the security rules deny every client read and write, and our server is the only writer.
• fal.ai and OpenAI — perform the image editing itself when you run an AI Look.
• Google Cloud Vision — checks a picture for unsafe content before it can appear publicly on Explore.
• Google Firebase App Check — confirms the request came from a genuine copy of the App.
• RevenueCat — validates your purchases and keeps your Premium and credit balance in sync.
• Apple — processes payments and, if you choose it, Sign in with Apple.

We show no advertising. We use no analytics SDK, no advertising SDK and no cross-app tracking, and the App never asks for tracking permission because it never tracks you.

3. Information Stored Only on Your Device

The following is created locally and is never uploaded to us:

• Your photos. When you pick a photo, your operating system's picker gives the App that one file. The App never reads your photo library as a whole.
• Your in-app gallery. The looks you have produced are written into the App's own directory on your device.
• Your saved looks. A bookmark is stored as a short identifier pointing at a look definition inside the App — nothing about the photo it was used on.
• Your profile photo. Held locally first and treated as the source of truth there. A copy reaches our storage only if you sign in and publish to Explore.
• Your preferences. Language, appearance, the haptics switch and onboarding state.

Uninstalling the App deletes this local data from your device.

3.1 The camera

Earlier versions of Mistly offered a camera with live filters. That feature has been removed. The camera now does one thing: it takes a source photograph for an AI Look or a collage, in place of picking one from your library. There is no live filtering, no continuous capture and no recording. Nothing the camera sees is uploaded unless you then run a look on the photograph you took.

4. What Leaves Your Device, and Only When You Act

We operate no server of our own beyond the Cloud Functions described here, and use no analytics or tracking software development kit. The only data that leaves your device is what a feature you deliberately used requires.

4.1 Anonymous identity (Firebase Authentication)

When you enter the App an anonymous Firebase session is created. It is not an account: no name, no e-mail address, no password, and you cannot sign in to it from anywhere else. It exists so that credits, purchases and your own posts stay attached to your installation.

If you later choose Sign in with Apple or Sign in with Google from Settings, that anonymous identity is linked to the credential rather than replaced, so nothing you already have is stranded. Signing in is optional; it is required only to publish to Explore. Buying or restoring Premium never requires it.

Wherever our server records something about an account, it stores a SHA-256 hash of the identifier rather than the identifier itself.

Legal basis (GDPR): performance of a contract and our legitimate interest in operating and securing the App.

4.2 Running an AI Look

When you run an AI Look, the photograph you selected is encoded as a JPEG and sent to our Cloud Function, which forwards it to whichever provider serves that look:

Our server holds the API keys; the App ships none, which is why a request cannot be made without it. A record of the request is written under a hashed key so the same request is never charged twice, and your credit balance is reduced only after a provider returns a result.

Before your first AI upload the App shows a separate consent dialogue naming these providers and explaining what is sent. You can decline and keep using everything that runs on your device.

Legal basis (GDPR): your consent, given in that dialogue.

4.3 Publishing to Explore

Explore is a public wall. Nothing appears on it unless you publish it.

When you publish, the image and a post record reach our storage, together with the pseudonymous handle shown on your profile. Before the post can be seen by anyone else it is checked automatically by Google Cloud Vision SafeSearch. Comments you write, accounts you block, and reports you make are stored the same way, keyed to the hash of your identifier.

Explore posts are deleted automatically 24 hours after publication — the post record, both images and every comment on it. Explore is a place you look at today, not an archive.

Legal basis (GDPR): performance of a contract for the feature you asked for, and our legitimate interest in keeping the wall safe and lawful.

4.4 Purchases, Premium and credits

Payments are processed by Apple. We never see your card number, billing address or Apple Account details.

RevenueCat validates the purchase and keeps your entitlement in sync, receiving the store's transaction and receipt information along with an app-specific identifier. Our server asks RevenueCat what you are entitled to before it grants credits or unlocks Premium.

Legal basis (GDPR): performance of a contract.

4.5 Device integrity (App Check)

To keep paid AI capacity from being drained by automated abuse, each server request carries a Firebase App Check token, produced by Apple's App Attest or DeviceCheck on iOS and by Play Integrity on Android. Apple and Google process this to confirm the request came from a genuine installation. It does not identify you.

Legal basis (GDPR): our legitimate interest in preventing abuse.

4.6 Rating a result

After a finished look the App may show a quiet thumbs-up or thumbs-down. If you tap one, the rating and the look that produced it are recorded so we can tell which looks work. Nothing about the photograph is sent with it. Tapping is optional and never required.

Legal basis (GDPR): legitimate interest in improving the looks we offer.

5. Notifications

When an AI Look finishes while you are elsewhere, the App raises a local notification — scheduled on your device by the App itself. There is no push server, no device token is created, and nothing about the notification reaches us or anyone else.

6. What We Do Not Collect

To be explicit, Mistly contains no analytics SDK, no advertising SDK and no crash-reporting SDK. We do not collect:

• your photo library, or any index, fingerprint or analysis of it;
• your name, e-mail address, telephone number or contacts, except the address Apple or Google gives us if you choose to sign in;
• your location;
• your browsing or app usage history;
• your microphone, calendar or health data;
• an advertising identifier used for cross-app tracking.

We do not build a profile of you, we show no advertising, and we do not sell or share personal data in the sense of the CCPA/CPRA.

7. The Mistly Website

The website on which you are reading this policy is served through Cloudflare Pages, a Cloudflare, Inc. service. Like any web server, it may automatically record standard technical request data such as IP address and browser information for security and operational purposes. This concerns the website only and is separate from the App.

8. Permissions

Mistly requests only the access it needs:

• Photos. The system picker grants the App only the file you select. The App does not request access to your whole library.
• Saving to Photos. Requested when you export a finished look or collage, so it can be written to your library.
• Camera. Requested only if you choose to take the source photograph in the App instead of picking one. See 3.1.
• Notifications. Requested so a finished look can tell you it is ready.
• Network. Used to sign in anonymously, run AI Looks, validate purchases, load Explore, and confirm device integrity.

9. Data Retention

10. Data Security

Everything described above travels over encrypted connections (HTTPS/TLS).

The App has no direct access to our database or storage at all. The security rules deny every client read and write; our server code is the only writer, and it is the only thing holding an API key. A copy of the App cannot reach another person's data because it cannot reach any data.

Identifiers are hashed wherever they are recorded, and App Check keeps requests from installations we cannot verify out of the system entirely.

No system is perfectly secure. We keep the amount of data we hold as close to nothing as the App allows, which is the strongest protection we can offer.

11. International Data Transfers

We operate from the Republic of Türkiye. Our providers — Google LLC, Cloudflare, Inc., Apple Inc., RevenueCat, Inc., OpenAI, L.L.C. and fal.ai — are global companies and may process the limited data described above outside your country, including in the United States. These transfers are carried out under the European Commission's Standard Contractual Clauses (SCCs) and equivalent mechanisms offered by the relevant providers.

12. Your Rights Under the GDPR (EU/EEA and UK)

You have the rights of access, rectification, erasure, restriction of processing, data portability, objection, not to be subject to a decision based solely on automated processing, and to lodge a complaint with a supervisory authority.

Settings → Delete account removes your account and the data attached to it: your Explore profile, handle and avatar, and the records keyed to your identifier. Uninstalling the App deletes everything held on your device.

For anything else, write to support@mindnullstudio.com. Because the only thing identifying you is an anonymous identifier, please send your request from the App where possible, or tell us your Explore handle — we may otherwise have no way of establishing which records are yours. We respond within 30 days.

You may exercise your rights in respect of payment records through Apple, and in respect of a linked account through Apple or Google.

13. Your Rights Under the KVKK (Türkiye)

Under Law No. 6698 you have the right to learn whether your personal data is processed, to request information where it has been processed, to learn the purpose of processing and whether the data is used in accordance with that purpose, to request rectification, erasure or destruction where the data is incomplete or incorrectly processed, to object to a result arising against you solely from automated analysis, and to claim compensation for damage suffered as a result of unlawful processing. These requests are met in the manner described in section 12. You may write to support@mindnullstudio.com.

14. California Privacy Rights (CCPA/CPRA)

We do not sell your personal information and we do not share it for cross-context behavioural advertising. There is no advertising in Mistly. The anonymous identifier, your purchase records and anything you publish are used only to operate the App; they are not sold.

15. Children

Mistly is a general audience application and is not directed to children under 13 (or the minimum age required in your country). Because Explore carries content published by other people, we do not knowingly permit use by children under this age and do not knowingly collect their data. If you believe a child is using the App in a way that concerns you, please contact us and we will act without delay.

16. Third-Party Services

• Google (Firebase Authentication, Cloud Functions, Firestore, Cloud Storage, App Check, Cloud Vision) — identity, our server, storage, safety checks — Privacy Policy.
• fal.ai — image generation — Privacy Policy.
• OpenAI — image generation — Privacy Policy.
• RevenueCat, Inc. — purchase and subscription status — Privacy Policy.
• Apple Inc. — payment processing, Sign in with Apple, App Attest — Privacy Policy.
• Cloudflare Pages — serves this website only — Privacy Policy.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make a significant change we will update the "Last Updated" date above and publish the revised policy at this address. Continuing to use the App after changes take effect constitutes acceptance.

What changed in this version (8 September 2026)

• The camera section was corrected. Earlier versions of this policy described a camera with live filters. That feature has been removed from the App; the camera is now only a way to take a source photograph. See 3.1.
• The AI processing chain is now named provider by provider, with what each one receives (4.2).
• Explore is described as it now works: comments, blocking, reporting, and automatic deletion of every post after 24 hours (4.3, 9).
• Premium and credit packs are described (4.4).
• Device integrity through App Check was added (4.5).
• The rating prompt shown after a finished look was added (4.6).
• Retention is now stated per category, in a table (9).
• Section 10 records that the App has no direct database or storage access of any kind.

18. Contact

Developer: Berkay Atik
E-mail: support@mindnullstudio.com
Application: Mistly