Privacy Policy

Last updated: 2026-07-16

This Privacy Policy describes how Digital Apps LLC ("we", "us", "our") handles information when you use the CareerPic AI mobile app and the website at careerpicai.com (together, the "Service").

1. Information we collect

• Selfies you upload, used solely to generate your headshot pack.
• Biometric information (facial geometry) derived from your selfie for the duration of the generation job. See Section 4.
• Purchase identifiers — an Apple App Store transaction ID (iOS) or a Stripe checkout session ID (web), used to verify purchases and prevent abuse. Stripe collects your payment details directly; we never see or store your full card number.
• Your email address (web only) — collected by Stripe at checkout and passed to us. We use it to deliver your headshots and to answer support requests.
• A random device/browser identifier we generate ourselves, used to deliver your pack and enforce limits.
• Anonymous, aggregated usage metrics (e.g., which AI model produced an image you saved).
• Network metadata (IP address, user-agent) seen by our backend during ordinary HTTP requests.

2. Information we do not collect

• We do not require your name, address, phone number, or contacts. (Stripe collects your email at checkout so we can send you your pack — see Section 1.)
• We do not access your location.
• We do not sell your photos or any data derived from them.

3. How we use your information

We use your selfie strictly to generate the headshot pack you purchased. We use purchase identifiers to deliver what you bought and to detect abuse. We use aggregated metrics to improve the product.

4. Biometric information

Generating a headshot requires our AI provider to analyze facial geometry in your selfie. This processing is considered "biometric information" under several laws, including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington's HB 1493, and the Washington My Health My Data Act. You consent to this processing on the consent screen before uploading any photo.

• Purpose: solely to generate the headshot pack you requested.
• Retention: your selfie and any derived biometric information are deleted from our servers within 7 days of generation completion — kept briefly so our support team can review the original photo against your results, for quality assurance or to investigate a reported issue, not indefinitely. Generated headshots are retained so you can access and re-download them from your purchase history.
• No sale: we will not sell, lease, trade, or otherwise profit from your biometric information.
• No training: we do not train AI models on your photos.
• Disclosure: we share your selfie only with Fal.ai (Section 6) solely to perform generation.

You may withdraw consent and request immediate deletion at any time by contacting us.

5. Advertising measurement

We measure the performance of our advertising on Meta (Facebook, Instagram).

• On iOS, we ask whether you allow tracking via Apple's App Tracking Transparency prompt. If you allow it, we share a hashed app identifier and the fact of significant events (opened the app, viewed the paywall, purchased) with Meta so a purchase can be matched to an ad. If you deny it, we receive only the coarse, anonymized SKAdNetwork signal Apple sends. Your experience is identical either way. You can change this in iOS Settings → Privacy & Security → Tracking.
• On the web, we use the Meta Pixel and server-side Conversions API to record page views, checkouts, and purchases for ad attribution. When you buy, we also send Meta a SHA-256 hash of your email address, so that your purchase can be matched to the ad you saw and so we can stop showing you ads for something you already own. We send only the hash, never the address itself — Meta compares it against addresses it already holds. We never share your selfie, generated images, or any free-text input. You can limit this with your browser's cookie controls and standard ad-tracking opt-outs.

We do not share your selfie, generated images, or name with advertisers. The hashed email described above is the only personal identifier we share with them.

6. Service providers

• Fal.ai — runs the AI models that produce your headshots. They process selfies under their own terms and do not retain them after generation completes.
• Cloudflare R2 — short-term storage of uploaded selfies and generated headshots, behind expiring URLs.
• Fly.io — hosts our backend API.
• Apple — purchase processing on iOS.
• Stripe — payment processing on the web.
• Vercel — hosts the website.
• Meta — receives conversion events for ad attribution as described above.

7. Children

The Service is not directed to and may not be used by anyone under 13. If you believe a child has provided us information, contact us and we will delete it.

8. Your data rights

Depending on where you live (e.g., California, Washington, EU, UK), you may have rights to access, correct, or delete personal information we hold about you, or to opt out of certain processing. To exercise any right, email us at the address below.

9. Security

We use industry-standard transit encryption (TLS) and short-lived signed URLs for storage. No system is perfect; we cannot guarantee absolute security.

10. Changes

We will post material changes in-app or on the website with a new effective date.

11. Contact

Digital Apps LLC — support@careerpicai.com