Privacy Policy
This Privacy Policy explains how Graffy (the “App”) collects, uses and shares information. Graffy is developed by Sefa Acar, trading as Acar Studio (“we”, “us”). We are the data controller for the personal data described here. Contact: aacarsefa@gmail.com.
In short: Graffy has no email or password accounts. We do not use advertising, analytics or tracking SDKs, we do not track you across other apps or websites, and we do not sell your data. Photos you pick for AI features are sent to our AI provider to create your image. Anything you post to the Feed is public. You can delete all of your data in the App at any time.
1. Information we collect and why
Device identifier
On first launch the App creates a random secret and stores it in your device's Keychain. It identifies your account instead of an email or password. We store only a one-way hash of it on our servers. It is not your Apple advertising identifier and it is not linked to your Apple ID. Purpose: to sign you in and keep your account secure.
Profile information
Your username, and optionally a display name, an Instagram handle, a TikTok handle and a profile picture (avatar). Your profile, including these handles and your avatar, is visible to other users. Purpose: to run your public profile and the community features.
Photos you upload
When you pick a photo for an AI edit or for “Rate My Graffiti”, the App uploads only that photo. It is kept in private storage and can only be opened through temporary signed links that expire after one hour. Before your first upload the App asks you to confirm that you have the rights to the photo and the consent of anyone shown in it. Graffy never reads your photo library beyond the photos you choose. Purpose: to provide the feature you requested.
AI generations
When you generate an image, we store your prompt, the style and options you selected, and the resulting image. Generated images and avatars are stored at random, unguessable web addresses; anyone who has the link can view the image. Purpose: to create your images, show your history and let you share them.
Feed and community activity
Posts you publish, your likes, the accounts you follow and that follow you, reports you submit (including the reason) and the users you block. Posts, likes and follower lists are public to other users. Reports and blocks are not shown to the person you report or block. Purpose: to operate the Feed, moderate content and keep the community safe.
Drawings and on-device data
Drawings made with Graffy's drawing tools are saved only on your device. A drawing is uploaded only if you choose to submit it, for example to a challenge. Camera images used by Try AR are processed on your device and are not uploaded. Motion sensor data used in onboarding stays on your device.
Purchases
Subscriptions are processed by Apple. We do not receive your name, card number or billing address. We receive information about your subscription status (for example, the product, purchase date, renewal and expiry) through Apple and our subscription provider Adapty, linked to an app account identifier. Purpose: to unlock Pro features and handle restores.
Push notifications
If you allow notifications, we use OneSignal to deliver them. OneSignal receives a push token for your device and an app account identifier so that we can send you notifications such as new likes or followers. You can turn notifications off at any time in your iPhone's Settings. Purpose: to send the notifications you allowed.
Technical data
Our hosting provider Cloudflare processes technical data such as your IP address and request information when the App talks to our servers, to deliver the service and protect it from abuse. We do not build profiles from this data.
Support emails
If you email us, we use your email address and message to answer you.
2. Legal bases (EEA and UK users)
- Performance of a contract: to provide the App, your account, AI features, the Feed and your subscription.
- Legitimate interests: to keep the service secure, moderate content, prevent abuse and enforce our Terms.
- Consent: for push notifications and for uploading photos to our AI provider. You can withdraw consent at any time.
- Legal obligation: where we must keep or disclose data by law.
3. Who we share data with
We share data only with service providers that help us run the App, under contracts that limit their use of the data:
| Provider | What they receive | Why |
|---|---|---|
| Cloudflare, Inc. | All data stored by the App, technical request data | Hosting, database, file storage, security |
| fal.ai (Features & Labels, Inc.) | Your prompt, options and temporary links to the photos you picked | Running AI image models |
| Model providers reached through fal.ai (for example OpenRouter and Google for “Rate My Graffiti”) | The photo and instructions needed for the request | Analysing images |
| Apple | Purchase information | Payments and subscriptions |
| Adapty | Subscription status and an app account identifier | Subscription management |
| OneSignal | Push token and an app account identifier | Push notifications |
Other users see what you make public: your profile, posts, likes and follows. We may also disclose information if required by law, to protect the safety of users or others, or as part of a merger or sale of the App, in which case this Policy will continue to apply.
We do not sell or rent your personal data, and we do not share it for cross-context behavioral advertising.
4. International transfers
Our providers may process data in the United States and other countries. Where data from the EEA or UK is transferred, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.
5. How long we keep data
- Your account, profile, posts, creations, photos and community activity are kept until you delete them or delete your data in the App.
- Signed links to private photos expire after one hour.
- After you delete your data, it is removed from our live systems immediately and from backups within 30 days.
- If an account was banned for violating our Terms, we keep a hashed device identifier to prevent the ban from being bypassed. Results of past challenges may remain with your name removed.
- Our AI and service providers keep data according to their own retention policies.
6. Deleting your data
Open Graffy, go to Settings, tap Delete My Data and confirm. This permanently deletes your profile, avatar, posts, creations, generation history, uploaded photos, likes, follows, reports, blocks and ratings from our servers. You can also email us to request deletion. Deleting your data does not cancel a subscription; manage subscriptions in your Apple ID settings.
7. Your rights
Depending on where you live (for example under the GDPR, UK GDPR or US state privacy laws such as the CCPA), you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. You can edit your profile and delete your data directly in the App. For any other request, email aacarsefa@gmail.com. We will respond within 30 days and will not discriminate against you for exercising your rights. You also have the right to complain to your local data protection authority.
8. Children
Graffy is not directed to children under 13, and you must be at least 13 years old to use it (or the minimum age of digital consent in your country, if higher). We do not knowingly collect personal data from children under that age. If you believe a child has provided us data, contact us and we will delete it.
9. Security
Data is encrypted in transit. We store only a hash of your device secret, keep uploaded photos in private storage and limit admin access. No system is perfectly secure, but we work to protect your data.
10. Changes to this Policy
We may update this Policy from time to time. We will post the new version on this page with a new effective date and, for significant changes, notify you in the App.
11. Contact
Sefa Acar (Acar Studio)
Email: aacarsefa@gmail.com