Privacy Policy
Last updated 22 October 2026
Sepira is made by Mehmet Ozay. This page says what the app collects, where your photographs go, how long they are kept and how to delete them. It describes what the app actually does, on iPhone and on Android.
The short version
To repair a photograph the app has to send it to a server — the work cannot be done on the phone. Only the photograph you choose is uploaded. It is stored privately under your account, passed to an image processing provider, and the result is stored with it so it appears in your Library. We do not sell anything, we do not show adverts, we do not track you across apps or websites, and we do not use your photographs to train any model.
Your photographs
What is sent. When you restore, colourise, enhance or animate a picture, the app makes a resized copy of that one photograph (at most 2,400 pixels on its longest side) and uploads it to our server. The copy is a new image file: the original file's metadata, such as its location or camera details, is not included. Nothing else from your photo library is uploaded.
Where it is stored. The uploaded copy and the result are saved as private files in our Google Cloud Storage, in a folder that belongs to your account. Each item in your Library is a short record (the type of treatment, the date, and where the two files are stored) in our database.
Processing. Our server gives fal.ai, the provider that runs the image models, a temporary link to the uploaded copy. The link stops working after 30 minutes. fal.ai processes the image, produces the result on its own servers, and our server downloads the result and stores it in your folder. fal.ai's handling and retention of the image and the result are governed by its own privacy policy and terms. For the animation, the only other thing sent is a fixed instruction that describes the motion; nothing about you is sent with it.
Who can open the files. The files are not public. The app opens them through your account, either directly or with links that expire after one hour. While we move to that system, each new file also has a private download link containing a long random key. That link is stored only in your Library record, which only your account can read, and it stops working as soon as the file is deleted. The app never shares these links; when you share a result, the image itself is shared.
Photographs processed before 20 October 2026 were stored at unlisted web addresses. The addresses were never published, but anyone who had an exact address could open that file without signing in. We are moving these files to private storage. You can delete them at any time from your Library.
How long they are kept. Both the original and the result stay until you delete them. Deleting an item from your Library deletes its record and both files from our servers. If a job fails, our server deletes the uploaded copy and returns the credit. A copy left behind by an interrupted job is never shown or used, and it is deleted with the rest of your data when you use Delete my photos & data. A deleted file can remain in Google Cloud's recovery storage for up to 7 days before it is permanently erased.
We do not look through your photographs, and we do not use them to train models. We send them to fal.ai only so it can carry out the treatment you chose.
On your phone
You choose a photograph with the system photo picker (the iOS photo picker on iPhone, the Android photo picker on Android), which gives the app only the photo you pick. If the photograph has a date, the app reads it on your phone so the saved result can keep the original date. That date stays on your phone and is not uploaded.
The app asks for permission to add to your photo library only when you save a result. If you turn on "Save into a 'Sepira' album", it asks for access to your library so it can create and fill that album. Copies of your results are cached on your phone so your Library opens quickly; this cache is cleared when you delete your data in the app or remove the app.
On Android, saved results go to your Pictures folder, or to a "Sepira" folder inside it when the album setting is on. Android 8 and 9 ask for storage permission the first time you save; newer versions need no permission for this. The app does not read the rest of your photo library.
Your account
The app creates an account for you automatically so your Library and your credits follow you. We do not ask for your name, email address or phone number.
The account is built from one random identifier that the app creates on your phone and stores in your iCloud Keychain. It contains nothing about you. The sign-in name our system uses is made from this identifier; it is not a real email address and nothing is ever sent to it. Because the identifier is kept in the Keychain, your account survives reinstalling the app, and, when iCloud Keychain is turned on, moving to a new phone with the same Apple Account.
On Android, the identifier is stored on the phone and in Google's Block Store, which keeps a copy in your Google Account's backup when backup is turned on. That is how your account survives reinstalling the app and moving to a new phone with the same Google Account. Android may also include the app's settings (language, album choice and the original dates of saved photographs) in your own Google backup. These backups are controlled by you and Google; your photographs and results are not part of them.
Under the account we store: your credit balance, the identifier, the date the account was created, your Library records and photographs, and a record of the credit packs you bought (see Purchases).
Sign in with Apple and the free starting credits
You can use Sepira and buy credits without signing in. The free starting credits are given only after you choose Sign in with Apple, because accounts without it can be created without limit. Sign in with Apple is offered when you have no credits and tap a tool; you can say "Not now". On Android, Sign in with Apple opens Apple's own sign-in page; it works the same way and gives us the same identifier.
When you sign in, Apple gives us an identifier for your Apple Account that is unique to our apps. We do not request your name or email address. The identifier is linked to your existing Sepira account, so your Library and credits stay the same.
The free starting credits are given once per Apple Account. To do that we keep a record that contains only a one-way keyed hash of that Apple identifier and the date the credits were given. It does not contain your account, and the identifier cannot be read back from it. We also keep a record, keyed by the random identifier above, of when this phone's account received free credits.
If the Apple Account you sign in with already has a Sepira account, the app switches to that account and deletes the guest account on this phone, together with its photographs. The app tells you this before it happens.
Purchases
Payment is handled by Apple (App Store) on iPhone and iPad, and by Google (Google Play Billing) on Android, depending on where you installed the app. Apple and Google handle your payment details under their own privacy policies; we never see your card details. There is no subscription. RevenueCat receives the purchase from Apple or Google together with your account's identifier and tells our server which credit pack you bought. Our server then adds the credits and keeps a record of the purchase: the product, the number of credits, the store and its transaction number, and the date. Refunds issued by Apple or Google are recorded the same way and the credits are removed.
So that a purchase is credited only once, we also keep a separate record per transaction number: the product, the number of credits, the date and a one-way hash of the account it was credited to.
If a purchase reaches us without an account it can be matched to, we keep a record of it (product, credits, transaction number, the purchase identifier RevenueCat sent, and the date) so the credits can be given to the right person when they contact us. We keep that record until it is resolved, or delete it on request.
Diagnostics
Firebase Crashlytics reports crashes so failures can be found and fixed. These reports contain the device model, operating system version, app version and where in the code the crash happened. A failed restoration is also recorded there with the tool and the error message, because a job that fails without crashing would otherwise leave no trace. They do not contain your photographs, and we do not attach your account to them. Google keeps Crashlytics reports for 90 days.
Our server keeps technical logs for 30 days: your account's identifier, which tool was used, how long each step took, and any error. They do not contain your photographs.
Usage measurement
Firebase Analytics records how the app is used: that a job started, which of the four tools it was, whether it finished or failed, how many seconds it took, that the credits screen was opened, and how many credits a purchase added. Firebase also records a few things on its own, such as when the app is first opened, sessions, in-app purchases, the device model, the operating system version and the approximate country.
Your photographs, your account identifier, your precise location and anything you type are not part of it. Firebase links these events to a random identifier of its own for each installation. Google keeps event-level data for no longer than 14 months; totals that do not identify anyone may be kept longer.
We do not track you and we do not use an advertising identifier. On iPhone the app ships the version of Firebase Analytics that has advertising support removed and never asks for permission to track. On Android the app removes the advertising ID permission and turns off advertising ID collection, so the Android Advertising ID is not collected. The app contains no advertising software. Nothing is shared with data brokers or advertising networks.
Abuse prevention
Each restoration costs us money at the image provider. To help keep requests from outside the app away, the app sends a token from Firebase App Check with its requests, created with Apple's App Attest on iPhone and iPad, and with Google Play Integrity on Android. It lets our server check that a request comes from a genuine copy of the app on a real device. The token identifies the app, not you. Google processes the Play Integrity check under its own privacy policy.
Our server also counts how many free starting credits are given and how much processing is done each day, as totals, so a flood of requests cannot run up unlimited costs.
To set daily limits per account and per network, our server counts, for each day, how many accounts were created, free credits given, restorations started, photo links requested and deletions made. Each counter is stored under a one-way keyed hash of your account identifier or of your network address (for IPv6, only the first half of the address). The address itself is never stored. These counters are deleted automatically after 3 days.
Who else is involved
- Apple — the App Store, payments, iCloud Keychain, App Attest, Sign in with Apple.
- Google Play — distribution on Android, payments (Google Play Billing), Play Integrity checks, and Block Store and backup of the identifier. Google acts under its own privacy policy.
- Google (Firebase and Google Cloud) — accounts, database, file storage, server functions, app settings, crash reporting, usage measurement and App Check. Our database is in Europe; our file storage and server functions are in the United States.
- fal.ai — image processing. fal.ai is based in the United States and says it processes data in the United States and other countries.
- RevenueCat — credit purchases.
Each one receives only what it needs to do its part. Your data may therefore be processed outside the country you live in.
How long we keep things
| What | How long |
|---|---|
| Your photographs and their results | Until you delete them, or delete your data |
| Uploads from failed jobs | Deleted when the job fails |
| Account, credit balance, purchase records | Until you delete your data |
| Records that free credits were given (per Apple Account hash and per phone account) | Kept after deletion (see below) |
| Per-transaction purchase record | Kept after deletion, so a purchase is never credited twice |
| Daily per-account and per-network counters | 3 days |
| Purchases we could not match to an account | Until resolved, or on request |
| Server logs | 30 days |
| Crash reports | 90 days |
| Usage measurement | Up to 14 months |
| Deleted files in Google's recovery storage | Up to 7 days |
Deleting your data
You can delete any single item in your Library, or everything at once. In Settings, Delete my photos & data deletes, from our servers: every original and result, your Library, your credit balance, your purchase records and your account. If you signed in with Apple, the app asks Apple to confirm once more and then revokes Sepira's Sign in with Apple access (on Android, when Apple's sign-in page returns the token needed for that; you can also remove Sepira yourself at appleid.apple.com under Sign in with Apple). Credits you have not used are lost, including purchased ones, and cannot be brought back. The app also clears its copies on your phone and then starts a new, empty account so it keeps working.
You can also ask for deletion without the app. See Delete your account: write to us with the User ID shown at the bottom of Settings and we delete the same data within 30 days.
What remains after deletion:
- The records of when the free starting credits were given: one keyed by the random identifier, and, if you signed in with Apple, one under a one-way keyed hash of your Apple identifier. They contain nothing else and are kept so the free credits are not given again, also not after signing in again with the same Apple Account. The new account starts with no credits.
- The per-transaction purchase records described under Purchases.
- The identifier itself in your Keychain on your phone (and in iCloud Keychain if it is turned on), or on Android in Block Store and your Google backup, which you control.
- Purchase records held by Apple or Google and RevenueCat under their own terms. The app does not delete the RevenueCat record; write to us and we will delete it.
- Server logs, crash reports and usage measurement, until they expire as listed above.
Children
Sepira is not for children under 13 and we do not knowingly collect their data. If a child's data has reached us, write and it will be removed.
Your rights
You can see your photographs in your Library, delete any of them, and delete your data and account in the app. You can also write to the address below to ask what we hold about you, to have it corrected or deleted, or to object to how it is used, and it will be done. If you are not satisfied with our answer, you can complain to your local data protection authority.
Changes
If this policy changes, the date at the top changes with it. A change that matters will be described on this page.