STRIA (“we,” “us,” or “our”) is a personal hair guidance mobile application. This Privacy Policy describes how we collect, use, share, and protect information when you use the STRIA app. It is written to reflect how the app is implemented today, including optional features that depend on your build configuration and environment.
1. Information we collect
Depending on how you use STRIA, we may process the following categories of information:
- Profile and onboarding information you enter in the app, such as name, age, hair type, styling goals, preferences, and similar fields stored in the app’s onboarding session (primarily on your device).
- Selfies and photos you choose to capture or upload for hair vision analysis, hairstyle recommendations, “See It On Me” preview generation, and optional progress tracking. Photos are processed when you use those features; they are not used for public display or advertising profiles within STRIA.
- Account identifiers created through anonymous authentication with Supabase when the app is connected to our backend. The app creates or restores a Supabase session without a separate sign-in screen and persists that session on your device (for example via AsyncStorage). Your Supabase user ID is also used as the RevenueCat customer identifier when in-app purchases are configured.
- Look credits and purchase-related data on our servers when Supabase is configured: credit balance, credit ledger entries, and purchase event records received from RevenueCat webhooks (product identifiers, store transaction identifiers, and related metadata). We do not store your payment card details; billing is handled by Google Play or the Apple App Store.
-
Saved styles and previews you save in the app, including preview image
files stored locally on your device. The database includes a
saved_hairstylestable for future sync; in the current app, saved styles are managed on-device unless or until server sync is enabled. - App usage and product analytics only when analytics is enabled in your build (see Analytics below). When enabled, events such as paywall views, purchase flow steps, and preview generation outcomes may be sent to PostHog, associated with your Supabase user ID as the analytics distinct ID.
2. How we use information
We use the information above to:
- Provide core app features: hair profile guidance, recommendations, and visual previews.
- Maintain your anonymous account, session, and look-credit balance on our backend.
- Validate and record in-app purchases and grant look credits after store purchases.
- Enforce usage limits and authenticate AI requests when a STRIA AI proxy is deployed.
- Improve reliability, security, and quality of STRIA (including optional analytics).
- Comply with law, respond to lawful requests, and protect users and the service.
AI outputs are estimates for styling purposes only. They are not medical, dermatological, or professional cosmetology advice.
3. Photos and AI processing
When you use live AI features (configured with live AI mode and a STRIA AI proxy URL), your photo may be sent from the app to our STRIA AI proxy, which verifies your Supabase session before forwarding requests to third-party AI providers:
- Google Gemini — selfie analysis and hairstyle recommendations (text/structured outputs from your image and profile context).
- OpenAI — generated hairstyle preview images for “See It On Me” and related preview endpoints exposed by the proxy.
In development or when live AI is not configured, the app may use mock analysis that does not send your selfie to external providers. Provider-side logging, retention, safety review, and model training practices are governed by each provider’s policies. We do not promise that providers never retain, log, or use submitted content for their own purposes (including model improvement), unless we have verified a specific contractual or product setting for your deployment.
If you operate or use a deployed proxy, it may maintain usage counters keyed by authenticated user id for rate limiting. Those counters are not full copies of your photos but may retain identifiers for a rolling window depending on server configuration.
4. Local app data
Much of your STRIA experience is stored on your device, including onboarding answers, saved hairstyle records, preview image files, routine state, progress entries held in memory, cached preview files, and flags such as onboarding completion. Uninstalling the app or clearing app storage removes local data but does not by itself delete your Supabase account or server-side credit data.
5. Accounts, look credits, and purchases
Supabase hosts authentication, profile rows created for new users, look credit balances, transaction ledgers, and purchase event records used for reconciliation and fraud prevention.
RevenueCat and the Google Play Store or Apple App Store process payments. RevenueCat receives purchase events from the stores and sends webhooks to our Supabase Edge Function to grant look credits idempotently (duplicate webhooks should not double-grant credits).
The app reads your credit balance from Supabase; clients cannot arbitrarily grant or delete credits for other users.
6. Analytics (optional)
If EXPO_PUBLIC_POSTHOG_API_KEY is set in the app build, STRIA initializes
PostHog (US ingestion host) with autocapture disabled. We send named product
events (for example app ready, paywall shown, purchase started or completed, preview generation
started or succeeded or failed, hairstyle saved) and may call
identify with your Supabase user ID. If the key is absent, analytics calls are
no-ops and events are not sent to PostHog.
7. Service providers and their roles
| Provider | Role | Typical data involved |
|---|---|---|
| Supabase | Authentication, database, Edge Functions (e.g. purchase webhook, account deletion) | User ID, session tokens, profile row, credits, purchase events |
| RevenueCat | In-app purchase SDK and webhook source for entitlements/credits | App user ID (Supabase UUID), purchase metadata |
| Google Play / App Store | Payment and billing | Payment and purchase records per store policies |
| STRIA AI proxy (when deployed) | Authenticated gateway to AI APIs | Supabase JWT, image payloads, usage counters |
| Google Gemini | Selfie analysis and recommendations (via proxy) | Images and prompts derived from your use |
| OpenAI | Preview image generation (via proxy) | Images and prompts derived from your use |
| PostHog (optional) | Product analytics | Event names, properties, distinct ID (Supabase user ID) |
These providers process data on our behalf or as independent processors under their own terms. Their retention, subprocessors, and international transfers may differ from ours. Consult each provider’s privacy documentation for details.
9. Security
We use reasonable technical and organizational measures appropriate to the service, including authenticated API access, server-side purchase granting (not client-writable), and keeping provider secrets (such as Gemini or OpenAI keys) on the proxy server rather than in the public app bundle. Supabase privileged keys are not embedded in the mobile app.
No method of transmission or storage is completely secure. Use STRIA on a device you trust and keep your operating system and app updated.
10. Retention
We retain information for as long as needed to provide STRIA, comply with legal obligations, resolve disputes, and enforce agreements. We have not published fixed retention schedules for every data category; retention depends on operational needs and provider practices.
- Server-side account data (profile, credits, ledger) generally remains until you delete your account or we remove it.
- Purchase event records may be kept after account deletion in anonymized form (user identifier removed, webhook payloads redacted) for legal, tax, and fraud-prevention purposes.
- Local device data persists until you delete it in-app, use account deletion (which clears much local data), clear app storage, or uninstall.
- Third parties may retain data they receive under their own policies; account deletion in STRIA does not guarantee deletion of historical records at Google, Apple, RevenueCat, PostHog, or AI providers.
11. Your choices and account deletion
You can:
- Choose whether to upload or capture photos (some features require them).
- Update profile details in the app as your preferences change.
- Delete saved styles and related local content where the app provides controls.
- Delete your account and associated server data in the app: open Profile → Delete account and data and confirm. This uses your in-app session to request verified deletion on our servers, then clears much of the local app data on that device.
Full instructions, including what is deleted on our servers and what third parties may still retain, are published at: https://stria-account-deletion.pages.dev/.
If you cannot access the app, email privacy@stria.app with the subject “Deletion request” and your Account ID from Profile if you have it.
Remaining look credits are forfeited when your account is deleted. Certain purchase records may be retained in anonymized form as described above.
12. Children’s privacy
STRIA is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information through STRIA, contact privacy@stria.app.
Users under 18 should use the app with permission from a parent or guardian, consistent with our Terms of Use.
13. International users
If you use STRIA from outside your home country, your information may be processed in the United States and other locations where we or our service providers operate, subject to applicable data protection laws. Provider locations depend on your Supabase project region, PostHog configuration, and where AI APIs are invoked.
14. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “last updated” date on this page and, where appropriate, in the in-app privacy document. Continued use of STRIA after an update means you accept the revised policy to the extent permitted by law.
15. Contact
Privacy questions or requests: privacy@stria.app
General support: support@stria.app