Privacy Policy

Effective October 23, 2026

This policy explains what the RawLight app ("RawLight", "the app") collects, why, and what choices you have. RawLight is published by Hasmik Vardanyan ("we", "us"), Armenia. Contact: privacy@rawlight.app.

No accounts. We don't ask for your name, email or phone number to use the app.
Your photos stay on your phone. Editing, RAW developing, carousels, collages and the free on-device tools never upload anything.
AI tools are the exception. When you run one, that photo (and your mask or text prompt, if any) is sent to process it, then deleted.
No ads, no tracking, no selling of data.

1. What stays on your device

Photos and videos you open, your edits, projects, presets and settings are stored only on your iPhone. The app asks for access to your photo library to open photos and to save your exports, and to the camera if you take a photo in the app. Features such as Best shots (photo scoring), face retouch (Smooth, Eyes, Teeth), subject detection and auto crop run on your device with Apple's frameworks; their results are not sent anywhere.

2. Anonymous device ID

On first launch the app creates a random device ID and a random device secret and stores them in your iPhone's Keychain. They are not linked to your name, Apple ID or advertising ID. We use them to keep your AI credit balance and subscription status, to stop others from using your credits, and to apply fair-use limits. You can copy your device ID by long-pressing the version line at the bottom of Settings.

3. AI tools

AI tools (for example Remove object, Expand, Sky replace, Upscale, Heal and Auto retouch) need a server. When you run one:

The app sends the selected photo (resized, usually to at most 2048 pixels), your mask and your text prompt if the tool uses them, and the tool's settings to our server.
Our server passes them to Replicate (Replicate, Inc., USA), which runs the AI model, and sends the result back to the app.
Our server does not store your photos or results. Replicate deletes inputs and results automatically, generally within 24 hours.
We keep a record of each run: the tool, its settings (including any text prompt), the time, whether it succeeded, and the credits it used. This lets us show your credit history, refund failed runs and prevent abuse.

AI processing is used only to give you the result you asked for. We don't use your photos to train models.

4. Purchases and credits

Payments are handled by Apple; we never see your card or Apple ID details. Subscriptions and credit packs are verified through RevenueCat (RevenueCat, Inc., USA), which receives your purchase information and your anonymous device ID. From RevenueCat we receive your subscription status (plan, renewal and expiry dates, trial) and the credit packs you bought. Our server keeps a ledger of credit changes: grants, purchases, AI runs and refunds.

5. Feedback and support

If you send a bug report or idea from Settings, we receive what you write, your rating and importance if you choose them, your email if you give it, screenshots you attach, your device model, iOS version and app version, and, if you include logs, a list of recent in-app events and AI run IDs (never photos). If you email us, we receive your email address and message. We use these only to answer you and improve the app.

6. Services we use

Cloudflare (Cloudflare, Inc., USA): hosts our server, database and this website; processes requests, including IP addresses, to deliver and protect the service.
Replicate: runs AI models for AI tools.
RevenueCat: verifies purchases and subscriptions.
Apple: App Store payments and app distribution, under Apple's own privacy policy.
Google Firebase: the app includes the Firebase core library for app configuration; we don't use Firebase analytics or advertising features.

These providers process data for us under their own terms and privacy policies. Some are in the United States, so your data may be processed outside your country.

7. How long we keep data

Photos and results of AI runs: not kept by us; deleted by Replicate, generally within 24 hours.
Device record, credit ledger and AI run records: while you use the app, and until you ask us to delete them.
Feedback: as long as needed to handle it, and at most 2 years.
Server logs at Cloudflare: kept for a short time for security and debugging.

8. Legal bases

We process data to provide the app and the features you use (performance of our agreement with you), to verify purchases and prevent fraud and abuse (legitimate interests and legal obligations), and to handle feedback you choose to send (your consent, which you can withdraw).

9. Your rights

You can ask us for a copy of the data linked to your device ID, to correct it, or to delete it. Email privacy@rawlight.app with your device ID (see section 2). Deleting your data removes your credit balance and history; it does not cancel a subscription, which you manage in your App Store account settings. Depending on where you live (for example under Armenia's Law on Protection of Personal Data or the EU GDPR), you may also have the right to object to or restrict processing and to complain to your data protection authority.

10. Children

RawLight is not directed at children under 13, and we don't knowingly collect data from them. If you believe a child has sent us data, contact us and we'll delete it.

11. Security

Data is sent over encrypted connections (HTTPS). Your device secret is kept in the iPhone Keychain and stored on our server only as a one-way hash. No system is perfectly secure, but we work to protect your data.

12. Changes

If we change this policy, we'll update this page and the effective date. For significant changes we'll also tell you in the app.

13. Contact

Hasmik Vardanyan, Armenia. Email: privacy@rawlight.app.