Privacy Policy
- Hairify is a free, ad-supported Android app published by EXO Studio. You can use it without creating an account.
- To change your hairstyle, the photo you select or capture is sent over an encrypted connection to our servers and our AI provider to generate the restyled image. The AI changes the hair and keeps your face. We do not use your photos to identify you, build profiles, or train general AI models, and we never sell them.
- We show ads through Google AdMob, which may use your Android Advertising ID. In the EU/UK we ask for your consent first; in the US you can opt out. The app works the same either way.
- We use Google Firebase (Analytics, Crashlytics, Remote Config, and Cloud Messaging) to understand how the app is used, fix crashes, configure features, and send notifications. Firebase does not receive your photos.
- We use AppMetrica (analytics and install attribution), the Meta (Facebook) SDK, and the TikTok Business SDK to measure app installs, in-app events, and the performance of our ad campaigns. None of these services receive your photos.
- You can delete all on-device data by uninstalling the app, or email us to delete anything stored on our servers.
- About This Policy
- Information We Collect
- How We Use Information
- Third-Party Services
- Advertising & Tracking
- Data Sharing & Disclosure
- Data Retention
- Data Security
- International Transfers
- Your Rights
- Children's Privacy
- Your Data & Deletion
- Push Notifications
- Permissions We Request
- On-Device Storage
- Changes to This Policy
- Contact Us
1. About This Policy
This Privacy Policy explains how EXO Studio ("EXO Studio", "we", "us", or "our") collects, uses, and shares information when you use the Hairify: AI Hair Changer mobile application ("Hairify" or the "App"). EXO Studio is the data controller responsible for your information under applicable data-protection laws, including the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).
This Policy applies to the Hairify Android app distributed through Google Play and is incorporated into our Terms of Service. By using the App, you acknowledge this Policy. If you do not agree, please do not use the App.
2. Information We Collect
Hairify is designed to collect as little as possible. You do not need to create an account, and we do not ask for your name, email, phone number, or postal address to use the App.
2.1 Information you provide
| Data | Details |
|---|---|
| Your photo | The photo you select from your device, or capture with the camera, in order to restyle your hair. This image is uploaded over an encrypted connection to our servers and our AI provider to generate the restyled result, and the result is returned to your device. Your photo usually contains your face; the AI changes the hairstyle or hair color and preserves your facial appearance. We process the image only to create your result — we do not use it to recognize or identify you, and we do not build a biometric profile of you. Your photo is not shared with our analytics or advertising providers. |
| Learning & style preferences | Choices you make during the first-time setup and in Settings (for example, your language, and the options you tap in the intro survey). These are stored on your device. |
| Reports & support | If you use the in-app "Report" action to flag a generated image, we receive the image you chose to report so we can review it. If you email us, we receive the message and any details you choose to send. |
2.2 Information collected automatically
The App includes Google Firebase, Google AdMob (with its mediation partners), AppMetrica, the Meta (Facebook) SDK, and the TikTok Business SDK, which collect certain information automatically to help us run, improve, and monetize the App. This does not include your photos.
| Data | Purpose & source |
|---|---|
| App-instance identifier & usage/event data | Collected by Firebase Analytics to understand which screens and features are used (for example, opening a style, generating a result, taps). Tied to a Firebase-generated app-instance ID, not to your name. See Section 4.2. |
| Device & diagnostic information | Device model, operating-system version, language, coarse region (derived from IP), app version, and — if the App crashes — a crash stack trace and device state, collected by Firebase Analytics and Firebase Crashlytics to keep the App stable. See Section 4.2. |
| Configuration data | Firebase Remote Config fetches feature settings for your app instance and sends basic device/app metadata to deliver the right configuration. See Section 4.2. |
| Push registration token | Firebase Cloud Messaging assigns a device registration token used to deliver notifications you enable. See Sections 4.3 and 13. |
| Advertising ID (Android) | Used by Google AdMob to show and measure ads. See Section 5. You can reset or delete this identifier in your device settings. |
| Approximate, non-precise data for ads | Ad networks may receive a coarse/truncated IP address and ad-interaction data to serve and measure advertising. We do not collect your precise location. |
| Basic technical data | To deliver the App, our servers process standard request data (such as device type and operating-system version sent with network requests) needed to return your result and keep the service secure. |
2.3 Information we do not collect
We do not collect your precise location, contacts, your entire photo library (only the single photo you choose), health data, or financial/payment information. The App has no login, so we hold no passwords or social-login profiles. We access the camera or a photo only when you choose to use those features. We do not use your photos for analytics or advertising.
3. How We Use Information
| Purpose | Data used | GDPR legal basis |
|---|---|---|
| Generate your restyled image (change hairstyle / hair color with AI) | The photo you provide | Performance of a contract / our legitimate interest in providing the App |
| Let you save the result to your device gallery | The generated image (handled on your device) | Your request / consent |
| Understand app usage and improve features | Firebase Analytics app-instance ID, usage/event data | Consent (where required, e.g., EU/UK) / legitimate interest |
| Detect, diagnose, and fix crashes and bugs | Firebase Crashlytics diagnostic and crash data | Legitimate interest in a stable, secure App |
| Configure and roll out features remotely | Firebase Remote Config app/device metadata | Legitimate interest |
| Send notifications you enable | Firebase Cloud Messaging registration token | Consent (notification permission) |
| Show advertising that keeps the App free | Advertising ID, ad-interaction data | Consent (where required, e.g., EU/UK) |
| Review reports of inappropriate generated content and keep the App safe | Reported image content you send us | Legitimate interest |
We do not use your photos to build advertising profiles, we do not use them to train general-purpose AI models, and we do not sell them.
4. Third-Party Services
4.1 AI image processing
To change your hairstyle, your photo is sent over an encrypted connection to our backend service, which uses a third-party AI image-generation provider to produce the restyled result. Your photo is processed only to provide this feature and is not used to serve you ads or feed analytics. We instruct our AI provider not to use your content to train their general models where such controls are available. The image is retained only as long as needed to generate and deliver your result and for a short period for abuse-prevention and debugging, after which it is deleted or anonymized (see Section 7).
4.2 Analytics, diagnostics & configuration — Google Firebase (Google LLC)
We use several Google Firebase services provided by Google LLC:
| Service | What it does & what it processes |
|---|---|
| Firebase Analytics (Google Analytics for Firebase) | Measures aggregate app usage. Collects an app-instance ID, device and OS information, coarse region (from IP), and in-app events. We use it in aggregate and do not use it to identify you. |
| Firebase Crashlytics | Detects and diagnoses crashes. When the App crashes it collects a stack trace, device state (such as OS version, memory, and app version), and the events leading up to the crash. It does not collect your photos. |
| Firebase Remote Config | Lets us adjust features and settings without an app update. Sends basic device/app metadata and an instance ID to fetch the right configuration. |
| Firebase Cloud Messaging (FCM) | Delivers push notifications you enable. Uses a device registration token. See Section 4.3. |
Firebase acts as our processor for these services. Learn more: Firebase Privacy & Security and Google Privacy Policy. You can limit some collection by resetting your Advertising ID and, where offered, declining analytics consent in the App.
4.3 Push notifications — Firebase Cloud Messaging
If you enable notifications, we use Firebase Cloud Messaging to deliver them. FCM assigns your device a registration token so messages can reach it. You can turn notifications off at any time in your device settings, and Android requires your permission before notifications are shown. See Section 13.
4.4 Advertising — Google AdMob (Google LLC)
We display advertisements through Google AdMob. AdMob may collect your Android Advertising ID, a truncated IP address, and ad-interaction data to deliver and measure ads. Learn more: AdMob & data and Google Ads Privacy.
AdMob uses mediation to fill some ad requests from the following ad partners, which may collect your Advertising ID, device information, a truncated IP address, and ad-interaction data to serve and measure ads:
| Ad partner (via AdMob mediation) | Privacy policy |
|---|---|
| AppLovin | AppLovin Privacy Policy |
| Meta Audience Network | Meta Privacy Policy |
| Mintegral | Mintegral Privacy Policy |
| Pangle | Pangle Privacy Policy |
| Unity Ads | Unity Privacy Policy |
4.5 Analytics & ad measurement — AppMetrica, Meta (Facebook) SDK, TikTok Business SDK
In addition to Firebase, the App includes the following SDKs. They collect device identifiers (such as the Advertising ID and an app-instance ID), device and app information, a truncated IP address or coarse region derived from it, and in-app events (for example app opens, screens viewed, and ad impressions and their revenue). They do not receive your photos. Where consent is required (Section 5.2), the Meta and TikTok SDKs only send events after you consent.
| SDK (provider) | Purpose | Privacy policy |
|---|---|---|
| AppMetrica (YANDEX LLC) | App analytics, crash reports, and install attribution. | Yandex Privacy Policy · AppMetrica SDK terms |
| Meta (Facebook) SDK (Meta Platforms, Inc.) | Measuring installs, in-app events, and the performance of our ads on Facebook and Instagram. | Meta Privacy Policy |
| TikTok Business SDK (TikTok Pte. Ltd.) | Measuring installs, in-app events, and the performance of our ads on TikTok. | TikTok Privacy Policy |
4.6 Image hosting
Hairstyle catalog thumbnails and your generated result are served from our own backend over HTTPS. The App does not embed third-party tracking pixels.
5. Advertising & Tracking
5.1 Android Advertising ID
Google AdMob and its mediation partners use your device's Advertising ID to show and measure ads; AppMetrica, the Meta SDK, and the TikTok SDK may use it to measure installs and ad performance. You can reset this identifier or opt out of ad personalization at any time in Settings → Google → Ads on your device (on Android 12+ you can also delete the Advertising ID entirely, after which apps receive a string of zeros).
5.2 European Union / United Kingdom
Where the GDPR/UK GDPR and ePrivacy rules apply, we use Google's consent mechanism (User Messaging Platform) to ask for your consent before your device identifier is used for personalized advertising and, where applicable, before non-essential analytics. You may withdraw consent at any time, and you will still be able to use the App with non-personalized ads.
5.3 California — "Do Not Sell or Share My Personal Information"
Sharing advertising identifiers with ad networks for personalized advertising may be considered a "sale" or "sharing" under California law. You may opt out by resetting/limiting ad tracking in your Android settings (Section 5.1), or by emailing exostudio.feedback@gmail.com. We honor opt-out preference signals where required.
6. Data Sharing & Disclosure
We share information only as described here: (a) with service providers who process data on our behalf (our AI image-generation provider, our hosting providers, Google Firebase, and AppMetrica); (b) with advertising and ad-measurement partners — Google AdMob and its mediation partners listed in Section 4.4, Meta (Facebook SDK), and TikTok — which receive device identifiers and app/ad-interaction data (never your photos); (c); to comply with law, a valid legal request, or to protect rights, safety, and the integrity of the App; and (d) in connection with a merger, acquisition, or asset sale, in which case we will notify you. We do not sell your photos.
7. Data Retention
- Your photos sent for AI processing are retained only as long as needed to generate and deliver your result, and for a short period for abuse-prevention and debugging, after which they are deleted or anonymized.
- Generated results are returned to your device. Any copy you save lives in your device gallery under your control.
- Analytics data collected by Firebase Analytics is retained per Google's configured retention (up to 14 months by default) and used in aggregate.
- Crash data collected by Crashlytics is retained for approximately 90 days.
- On-device data (settings, preferences) remains on your device until you delete it or uninstall the App.
- Reports you send us are kept as long as needed to investigate and improve safety.
- Advertising data is retained by Google per its own policies.
8. Data Security
We use industry-standard safeguards, including encryption in transit (HTTPS/TLS) for all communication with our servers. No method of transmission or storage is 100% secure, but we work to protect your information and limit access to it.
9. International Data Transfers
EXO Studio is based in Vietnam, and our service providers (including Google and our AI provider) may process data in the United States and other countries. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. By using the App, you understand your information may be processed in countries with different data-protection laws than your own.
10. Your Rights
10.1 EU/EEA/UK (GDPR)
You have the right to access, correct, delete, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent. You may also lodge a complaint with your local data-protection authority.
10.2 California (CCPA/CPRA)
You have the right to know, delete, and correct personal information; to opt out of "sale"/"sharing" (see Section 5.3); to limit the use of sensitive personal information; and to non-discrimination for exercising your rights. We respond within 45 days.
10.3 Other US states
Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights to access, delete, correct, and opt out of targeted advertising.
10.4 How to exercise your rights
Because Hairify has no account, much of your data lives only on your device and can be removed by uninstalling the App. For anything we hold on our servers, email exostudio.feedback@gmail.com and we will verify and respond to your request.
11. Children's Privacy
Hairify is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are under the age required to consent in your country (16 in parts of the EU), please use the App only with the involvement of a parent or guardian. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it within 30 days. Contact us at exostudio.feedback@gmail.com.
12. Your Data & Deletion
Hairify does not require an account, so you remain in control of your data:
- Delete all on-device data: uninstall the App. This removes your settings, preferences, and any saved state.
- Delete server-side data: email exostudio.feedback@gmail.com to request deletion of any photo or report content retained on our servers. We will action verified requests within 30 days; backups are purged within 90 days.
- Turn off ad tracking: reset or delete your Advertising ID in Android settings (Section 5.1).
13. Push Notifications
If you enable notifications, Hairify may send you reminders and updates. Notifications are delivered through Firebase Cloud Messaging, which assigns your device a registration token so messages can reach it. Android asks for your permission before notifications are shown, and you can turn them off at any time in your device's notification settings. Turning notifications off does not affect your ability to use the App.
14. Permissions We Request
| Permission | Why we request it |
|---|---|
| Camera | Only if you choose to take a photo to restyle. We do not record video or use the camera in the background. |
| Photos / media (read) | To let you pick the single photo you want to restyle. We do not scan or upload your wider photo library. |
| Storage (save) | To save your generated result into your gallery when you tap save. On Android 10+ this uses scoped storage and needs no special permission. |
| Notifications | To show notifications you enable, delivered via Firebase Cloud Messaging (Section 13). |
| Internet | To send your photo for AI processing, load hairstyle thumbnails, run Firebase services, and show ads. |
| Advertising ID | Used by Google AdMob for advertising (Section 5). |
15. On-Device Storage
Hairify stores your settings and preferences locally on your device (for example, your chosen language and intro choices). This information stays on your device and is included in your device backups under your control.
16. Changes to This Policy
We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the App. Your continued use of Hairify after changes take effect means you accept the updated Policy.
17. Contact Us
If you have questions or requests about this Policy or your data, contact:
EXO Studio
Hanoi, Vietnam
Email: exostudio.feedback@gmail.com