Gyeolbit Privacy Policy

01Photos and editing data

• The app first opens Android Photo Picker and reads only the one photo that you explicitly select. If the device has no Photo Picker handler, the app automatically opens Android's system document picker throughOpenDocument(image/*). You may also explicitly capture one photo after tapping Take a selfie.
• Take a selfie gives an external camera app a temporary, app-scoped FileProvider destination. Gyeolbit does not request camera or microphone permission. A pending result is staged in app cache; a successful non-empty capture becomes an app-private working file excluded from Android backup and device transfer.
• Photo pixels, masks, adjustment values, and presets are processed on your device for editing.
• The app uses the bundled Google ML Kit Face Detection SDK to find face bounds and landmarks after a photo is opened. MediaPipe Face Mesh V2 and SelfieMulticlass models also run on your device to locate facial features and estimate face skin, body skin, hair, clothes, accessories, and background. These models are used for editing, not to identify a person across photos.
• Raw landmark and segmentation results are held in the current editing session. When you apply an edit, the local recovery file may retain the derived edit geometry, selected areas, protection masks, and adjustment values needed to restore that edit. Photo and face-analysis data are not sent to our server.
• For a supported photo, the app may suggest an automatic skin editing area from the selected face geometry. It tries to exclude eyes, eyebrows, lips, the upper hairline, and other faces and softens the mask edge. You can view the selected area, paint or erase the mask, or continue with manual selection when detection is unavailable. The suggestion does not identify you, generate a new face, or send the photo to a Gyeolbit Studio server.
• Eye and teeth adjustments use on-device facial features and local pixel checks to estimate supported editing areas. You can review and refine skin and targeted adjustment masks using add and erase controls. The segmentation model estimates hair and other regions for area selection and protection; its boundaries may be imperfect. These adjustments do not generate new facial features.
• The Shape tool starts every face, jaw, eye, and nose adjustment at zero and changes geometry only after you move a control. It does not score appearance, recommend a shape, or automatically make a face symmetrical. Supported contours are reduced to compact normalized control geometry for local rendering; uncertain poses and incomplete contours are limited instead of being guessed.
• When a photo contains multiple faces, the app can keep separate skin, Detail, and Shape masks or adjustment values for up to five faces. A source-local key and normalized anchor reconnect each edit only within that same source photo. They are not biometric identifiers and are not used to compare or track a person across photos.
• For a current recovery checkpoint that contains an edit, the app stores a SHA-256 signature of the orientation-corrected preview so the edit can be restored only to the exact source content. An automatic skin-area edit also stores a SHA-256 digest and byte length for the complete source stream. These values are local integrity checks, not face templates, and are not shown in the interface, written to logs, or transmitted over a network.
• If you use Shape, the checkpoint may also store your numeric adjustment values, compact normalized control points, local eye extents and axes, and the normalized bounds of nearby faces used for protection. Saved geometry can include normalized face-outline points and feature-control regions. The app does not use this geometry to recognize a person in another photo.
• Older version 1–10 manual checkpoints that do not contain an exact content signature are quarantined instead of restoring their edits, even if the photo URI is unchanged. An existing automatic-area signature from versions 4–10 may be upgraded only after the preview and complete source stream are verified.
• Photo pixels and editing data are not sent to a Gyeolbit Studio server. We do not operate an app server for Gyeolbit.
• Newly saved images do not copy original metadata such as location, capture device, or capture time.

Google states that ML Kit may send non-image diagnostics to Google over HTTPS, including an installation-scoped non-identifying ID, app and device information, API configuration, input and output sizes, usage, performance, and error data. Photo pixels and face-analysis results remain on the device. These diagnostics are handled under Google's terms and privacy policy.

02Data stored on your device

The app may store the following information locally on your device:

• Display theme and presets that you create locally
• A photo URI, source properties, editing commands, and masks used to restore an interrupted editing session, including face-specific skin and Detail areas, Shape values and compact control geometry for up to five faces
• An app-private, backup-excluded working copy of the current external-camera capture, plus short-lived cache staging while a capture result is pending
• A short-lived, immutable app-private source snapshot while each save or share request is processed
• Ad-frequency information, including the first-success exemption, last display time, displays per local date, and the time of a purchase-screen interaction
• PRO status verified by Google Play, verification time, product ID, app package name, and schema version

The ad-frequency store does not contain photos, photo URIs, accounts, advertising IDs, or purchase tokens. The app also does not persist raw purchase tokens, order IDs, payment methods, or Google Account information in its local storage.

The export performance interface accepts only fixed categories, booleans, and limited numeric timing and image-size values. It cannot accept photo URIs, paths, file names, photo or face IDs, pixels, exception messages, or free-form text. Its production default is a no-op, so Gyeolbit currently does not store or transmit these measurements.

03Google Mobile Ads and consent

A free user may see one banner on the home screen. No ad is shown while the editor is open. After a free user successfully saves or shares a photo, the app may also request an interstitial ad through the Google Mobile Ads SDK. The Google User Messaging Platform SDK is used for regional consent checks and privacy choices.

According to Google’s current Mobile Ads SDK disclosure, the SDK may automatically collect and share the following data with Google for advertising, analytics, and fraud prevention:

• IP address and the approximate location inferred from it
• App interactions such as launches, taps, and ad views
• Diagnostic information such as app and SDK performance, runtime, crashes, and energy usage
• App Set ID and other device- or account-related identifiers

The legacy Android advertising ID permission is removed from the app manifest. This does not mean that all other identifiers or network data processing by Google SDKs is disabled. Google states that data sent by the Mobile Ads SDK is encrypted in transit using TLS. Where required, a consent form is shown. You can revisit your choices through Ad privacy settings in the app. After Google Play verifies PRO entitlement, the app does not request, load, or show ads. Because the advertising SDK is packaged to serve free users, an SDK startup component may still initialize when the app process starts; the Google data disclosures above therefore continue to apply to PRO users.

04Google Play billing

PRO is a non-consumable, one-time in-app product sold through Google Play. Google Play handles payment methods, pricing, charges, and transaction processing. The app processes the product ID, purchase state, and purchase token in memory as needed to verify, acknowledge, and restore a purchase. Only PRO status, verification time, product ID, package name, and schema version are stored locally.

We do not operate an account or billing server and do not send raw purchase tokens to our own server. Purchase cancellation, refund, and revocation decisions are handled by Google Play. After the next successful Google Play ownership check, a refunded or revoked purchase no longer unlocks PRO. You can reconnect to the internet and use Restore purchases while signed in to the same Google Play account. Google Play processing is governed by the Google Privacy Policy (opens in a new tab).

05Saving and sharing

• Saved results are written to a location you select or to Pictures/Gyeolbit through Android MediaStore.
• When you share a result, the app creates a temporary cache file and gives the Android system share sheet a read-only FileProvider URI.
• At the start of every save or share request, the selected source bytes are copied once into a short-lived, immutable app-private snapshot. Source bounds, EXIF, preview-signature verification, and full-resolution decoding all use that same file so a changing external provider cannot mix different source bytes in one result. Automatic skin-area edits also verify the complete-stream digest and byte length.
• Preview and export decoding use an on-device SDR/sRGB ARGB_8888 working space. This color-processing choice does not transmit the photo or its color data.
• Original preserves the source-based dimensions only when the device passes a memory check. If it cannot be processed safely, Gyeolbit blocks the request instead of silently reducing it and offers the explicit Standard option, which may reduce the long edge to 2,048 pixels.
• The result is sent only to the app that you choose in the system share sheet.
• We do not control how another app handles a file after you choose to share it.

06Permissions and security

• INTERNET and ACCESS_NETWORK_STATE: Google Play billing, consent checks, and advertising
• Billing permission merged by the Google Play Billing library
• AdServices, wake lock, and foreground-service support permissions merged by Google SDK dependencies
• Android Photo Picker, or the system OpenDocument(image/*) fallback when no Photo Picker handler is available: read one photo that you explicitly select
• External camera screen: write one photo that you request to an app-scoped FileProvider URI, without Gyeolbit requesting camera or microphone permission
• MediaStore or the system document creator: save an edited result at your request
• FileProvider: temporarily grant read access to a file that you choose to share

The app does not request broad photo-library, location, contacts, or accounts permissions. Local app data is excluded from Android cloud backup and device transfer.

07Retention and deletion

• An editing recovery file is retained only while it may be needed to restore the current edit, and is cleared when you choose a new photo or finish the edit normally.
• A pending external-camera result uses a dedicated staging cache file. Cancellation or failure deletes that exact file. A successful capture is promoted to a backup-excluded app-private working file and retained only while the current edit or its recovery state needs it.
• Replacing, discarding, or finishing that edit deletes its exact working file. Unreferenced staging or working files that match the app's strict filename rules are also eligible for non-recursive cleanup after 24 hours; a pending capture and the active editor source are preserved.
• Temporary sharing files are stored in app cache and may be removed by Android or during app cleanup.
• Every immutable export source snapshot is deleted after success, failure, or cancellation. A matching leftover from an abnormal termination is removed before the next export begins.
• You can delete the local theme, presets, recovery data, ad-frequency data, and PRO entitlement cache by clearing the app’s data in Android settings or uninstalling the app.
• Images saved to your photo collection or another location may remain after uninstalling the app and must be deleted by you.
• Data processed by Google for advertising and billing is retained and deleted under the applicable Google service policies and account controls.

The current app does not register identities, group people across photos, or train models using your photos. If a previous development build left identity registration data on your device, the current app does not read or extend it. Clearing the app's data in Android settings or uninstalling removes that local data along with local presets and recovery settings, while your original gallery photos remain unchanged.

Gyeolbit has no developer-operated user account, so it does not provide a separate app-account deletion feature.

08Children

Gyeolbit is not designed primarily for children. Advertising settings and this policy must be reviewed before offering the app to children or families.

09Changes to this policy

If app features, included SDKs, or legal requirements change, we will update the effective date and contents of this policy. Material changes will be communicated through the app or its Google Play listing.