Privacy Policy — Timeless
Last updated: 15 August 2026
This Privacy Policy explains how KiroLabs ("we", "us", "our") processes your personal data when you use the Timeless mobile application ("the App"), a photo editing and restoration app that repairs, enhances and transforms your photos using cloud-based AI. We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).
Controller
KiroLabs
Email: labskiro@gmail.com
1. Summary
To edit a photo, the image you select is sent securely to our AI processing provider (fal.ai) and the result is returned to your device. We do not store your photos on our own servers, and we do not use your photos to train AI models. Before anything is sent, the App shows you a disclosure naming exactly what is sent and who receives it, and asks for your permission; you can withdraw that permission at any time in the App under Me → AI processing & data. We use an anonymous ID to manage your edit allowance and purchases — we do not require an account, your name, or your email to use the App. You have full rights over your data (access, deletion, objection, and more — see Section 9).
2. What data we process
| Category | Details |
|---|---|
| Photos you upload | The image you choose to edit, any second image a tool needs (for example a garment or a background reference), and the generated output. These may depict people (including faces). We process them only to perform the edit you request — restore, erase an object, change age, change expression, change hairstyle, apply makeup, generate a headshot, try on clothing, replace a background, or combine images. We do not use them for facial recognition, identification, or any biometric purpose. See Section 4a. |
| The options you choose | The tool you picked and its settings (for example a target age, an expression, a hair colour), and — for the tools that accept free text — the description you type. Sent with the image so the AI can produce what you asked for. |
| Anonymous user identifier | A random ID generated by Firebase Anonymous Authentication. It is not linked to your real identity and lets us track your free/paid edit balance. |
| Purchase & subscription status | Whether you bought a credit pack or subscription, and your remaining balance. Managed via RevenueCat, with payment processed by the Apple App Store (iOS) or Google Play Billing (Android). We never receive your card number. |
| Technical & security data | App version, coarse technical logs, and IP address processed transiently to operate and secure our service and prevent abuse of our AI endpoint. |
| Analytics & diagnostics | The iOS version of the App contains no analytics or crash-reporting SDK and collects no usage or diagnostic data. The Android version may collect aggregated, non-identifying usage and crash data (Firebase Analytics / Crashlytics) to improve stability; it contains no image content and you can opt out in the App settings. |
We do not request access to your photo library, contacts, location, microphone, or camera. Photos are chosen one at a time through the system photo picker, which hands us only the single image you select.
3. How we use your data and legal bases (Art. 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Performing the photo edit you request (sending it to fal.ai and returning the result) | Performance of a contract (Art. 6(1)(b)) — you request the edit — together with your explicit in-app permission before any image is sent |
| Managing your edit balance, purchases and subscription | Performance of a contract (Art. 6(1)(b)) |
| Securing the service, preventing fraud/abuse of our AI endpoint | Legitimate interests (Art. 6(1)(f)) |
| Optional analytics and crash diagnostics (Android only) | Consent (Art. 6(1)(a)) where required, otherwise legitimate interests (Art. 6(1)(f)) |
4. Photo processing — important details
Before the App sends any image for the first time, it shows you a disclosure that names the data being sent and its recipient, and asks you to agree. No image is transmitted unless you have agreed, and you can withdraw your agreement at any time under Me → AI processing & data.
When you tap to generate an edit:
- The image is transmitted securely to fal.ai (Features & Labels, Inc.), our AI inference provider, solely to generate the result you asked for. It is routed through our own backend (Google Cloud Functions), which holds it only in memory for the duration of the request.
- We do not save your original or edited photo on our own servers. The edited image is returned to your device, where you can save it.
- fal.ai stores processing files (inputs and generated outputs) on its infrastructure for a limited period before deletion. Per fal.ai, generated files are guaranteed to be available for a limited time and may be deleted thereafter. fal.ai is contractually bound to process your image only to provide the requested result and (per its policies) does not use your images to train AI models without consent. See fal.ai's privacy policy at fal.ai/privacy.
- You should only upload photos you have the right to use. Please avoid uploading images of other identifiable people without their awareness where required by law.
4a. Face data
Photos you edit with Timeless may show faces. We do not collect face data. We do not create, derive, or store faceprints, facial-geometry templates, face embeddings, or any other biometric identifier, and we never use your photos to identify, recognise, verify, match or track any person. The App uses no face detection, face recognition or face tracking technology of any kind. Where a tool changes how a face looks — Change age, Expression, Hairstyle, Makeup, Headshot, Try on, Restore — the face is processed only as pixels of the image, only for the single edit you asked for, and only for as long as that edit takes. Nothing derived from a face is retained by us, and no face information is shared with anyone other than the AI provider named in Section 5, which processes it solely to return your edited image.
No face information is used for advertising, profiling, or AI model training, and none is sold or disclosed to any other party. Because we never store your images, there is no face-related record on our servers to retain or delete; copies held by fal.ai during processing are deleted as described in Section 4, and the copies on your device are yours to delete at any time from the App's Gallery or by deleting the App.
5. Who we share data with (processors & third parties)
| Provider | Purpose | Policy |
|---|---|---|
| fal.ai (Features & Labels, Inc.) | AI photo processing — the only third party that receives your images | fal.ai/privacy |
| Google Firebase (Google Ireland / LLC) | Anonymous auth, secure backend functions, database for your balance, remote configuration, optional analytics/crash reporting (Android only) | firebase.google.com/support/privacy |
| RevenueCat, Inc. | Purchase & subscription management | revenuecat.com/privacy |
| Apple Inc. (App Store / StoreKit) | Payment processing for iOS purchases and subscriptions | apple.com/legal/privacy |
| Google Play Billing (Google) | Payment processing for Android purchases and subscriptions | policies.google.com/privacy |
Each provider acts as our processor under a data processing agreement and may use the data only to provide its service to us, under protections equivalent to those described in this policy. We do not sell your personal data, and we do not share it with advertisers or data brokers.
6. International data transfers
Some providers above (including fal.ai and RevenueCat) are based in the United States and may process data on servers outside the European Economic Area. Where data is transferred outside the EEA, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses and/or the providers' certification under applicable data-transfer frameworks.
7. Data retention
- Photos: not stored by us. Processing copies held by fal.ai are retained only for the limited period described in Section 4, then deleted. Copies on your own device remain until you delete them from the App's Gallery, delete them from your photo library, or uninstall the App.
- Anonymous ID, balance & purchase status: retained while you use the App, and as needed to honor your purchases and meet legal/accounting obligations.
- Technical logs: retained for a limited period for security and operational purposes.
- Your AI processing permission: stored on your device only, and cleared when you withdraw it or uninstall the App.
8. Security
Your image is transmitted over encrypted connections (TLS) and is processed by an endpoint that requires authentication, so it cannot be called anonymously from outside the App. Our AI provider API keys are held server-side in a secrets store and are never included in the App.
9. Your rights under the GDPR
You have the right to: access your data; rectify inaccurate data; request erasure; restrict or object to processing; data portability; and withdraw consent at any time (without affecting prior processing). To exercise these rights, contact us at labskiro@gmail.com.
Because we identify users only by an anonymous ID with no name or email, we may be unable to locate your specific records without additional information from you (Art. 11 GDPR); we may ask you to provide details (such as your anonymous ID, shown in the App settings, or a purchase receipt) to help us locate the relevant data.
If you are in the EEA/UK, you also have the right to lodge a complaint with your local data protection supervisory authority.
10. Children
The App is not directed to children. You must be at least 18 years old, or the age of majority in your jurisdiction, to use the App (our AI provider likewise requires users to be 18+). We do not knowingly process data from children.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, where changes are material, provide additional notice in the App.
12. Contact
Questions about this policy or your data? Contact:
labskiro@gmail.com — KiroLabs.
© 2026 KiroLabs. This document is provided for transparency and does not constitute legal advice.