PhotoRepair Privacy Policy

Effective Date: October 11, 2026

This Privacy Policy explains what PhotoRepair (“the app”, “we”) does with your information. The short version:

The editing tools run on your device. Photos you edit with them are not uploaded.
The cloud AI features are different. When you use “Edit with words” or “Create an image”, the photo and the text you send leave your device and are processed by third-party AI models. The app asks for your permission before the first upload.
An account is optional. Signing in only exists so your AI credits can follow you to another device, and you can delete the account in the app.
No ads, no ad tracking, no third-party analytics SDKs.

1. On-Device Editing

These tools run entirely on your device, using on-device models: Erase, Enhance, Restore, Cutout, Replace Background, Blur, Filters, Adjust, Hide Location and Set Location. Photos you open with them, and the results, are not uploaded to us or to anyone else.

Your edited photos, your project library and your AI conversation history are stored on your device. A result is saved to your photo library only when you choose to save it, and leaves the app only when you share or export it.

2. Metadata and GPS Data

PhotoRepair can remove or change the GPS location stored in a photo before you share it. This is done on your device; we do not receive the photo’s location or its other metadata. Set Location shows a map provided by Apple Maps, so Apple receives the map area you look at, under Apple’s own privacy policy.

3. Face Data

The Restore tool includes an optional face-enhancement feature. When — and only when — you choose to run this tool on a photo you have selected, the app performs on-device face detection to locate faces and eye positions in that image, and then runs an on-device AI model to reconstruct and sharpen facial detail.

What is processed: Face and facial-landmark geometry (such as eye positions) detected in the photo you are editing, used solely to align and restore the face within that same photo.
Purpose: The face data is used exclusively to produce the enhanced version of the photo you are editing. It is not used to recognize, identify, verify, or track any individual, and the app does not create, store, or derive a faceprint, facial template, or any biometric identifier.
On-device only: All face detection and enhancement run entirely on your device. Face data is never transmitted to us or to any third party, and it is never uploaded to any server.
No sharing: Face data is not shared with, sold to, or disclosed to any third party.
Retention: Face data exists only transiently in device memory during processing and is discarded as soon as the operation completes. We do not retain it. The only output that persists is the resulting edited image, which stays on your device and is saved to your photo library only if you choose to save it.

The cloud AI features in section 4 are separate from Restore. They do not detect faces or extract face data either, but a photo you choose to send to them is uploaded as a whole image — including any people in it.

4. Cloud AI: “Edit with words” and “Create an image”

These two features cannot run on your device. They are the only features that upload a photo.

What is sent: the text prompt you type and, if you attached one, the photo you chose. Before upload the photo is scaled down so its longest side is at most 2,048 pixels and re-encoded as a JPEG, which does not carry over the original file’s location or camera metadata. Nothing else from your photo library is sent.
When: only when you press send in the AI chat, and only after you have tapped Allow on the in-app question “Send this to our AI service?”. If you do not allow it, nothing is uploaded and the rest of the app works as before.
Where it goes: to our relay server (ai.mzjpg.com, hosted on Cloudflare), which forwards the prompt and photo to the AI model that draws the result:
- Standard and HD quality — Google’s Gemini image models (Google LLC).
- Fast quality — Pruna AI’s P-Image model, reached through Cloudflare’s AI platform.
The model receives the prompt and the photo only. We do not pass on your account, your device identifiers or your IP address.
What we keep: our relay does not store your photo, your prompt or the resulting image. It handles them in memory to complete the request, and we have switched off caching and request logging for these requests on the gateway we operate. What we do record is that a picture was made: the time, the quality and model used, the credits charged, and whether it succeeded — with no prompt and no image.
What the AI providers keep: Google, Pruna AI and Cloudflare process the prompt and photo under their own terms and privacy policies, which may include safety screening and retaining data for a limited time in their systems. We do not control that. Please do not send photos or text you are not comfortable sharing with these providers. See Google’s Gemini API terms, Pruna AI and Cloudflare’s privacy policy.
The result is returned to the app and kept on your device, in your AI conversation history, until you delete it.

If we add or change AI providers, we will update this section.

5. Your Account and Identifiers

You do not need an account to use PhotoRepair.

Anonymous app identity. So that our server can hold a credit balance and tell genuine copies of the app from abuse, the app registers itself with our account server (account.mzjpg.com) the first time it connects, using Apple’s App Attest service. This creates a random user ID tied to a cryptographic key generated on your device. We store that key’s ID and public key, the app it belongs to and the date it was registered. It does not include your name, your Apple Account, your phone number or an advertising identifier. The app also sends Apple’s signed proof that it was downloaded from the App Store; where that proof contains one, we store its app-transaction identifier — a value specific to your Apple Account and this app that does not reveal who you are — so that a reinstall or a new phone can find the same credit balance.

Optional sign-in. You can sign in with Apple, Google, or a code sent to your email, so that your credits follow you to a new device. If you do, we store:

which method you used and the account identifier that Apple or Google gives us for you;
your email address — for Sign in with Apple only if you share your real address (a “Hide My Email” relay address is not stored);
for Sign in with Apple, an encrypted token that lets us revoke the sign-in when you delete your account;
for email sign-in, a hashed, short-lived copy of the code and a record of when codes were sent to your address, used to limit abuse and cleared after about a day.

We do not receive your password, your name, your contacts or your profile picture from Apple or Google.

Signing out and deleting your account. In the Me tab you can sign out, or choose Delete Account. Deleting your account:

removes your sign-in methods and email address from our server, and revokes the Sign in with Apple authorization;
deletes your notification history;
permanently forfeits any unused AI credits;
sends one confirmation email to the address the account had.

After deletion the app continues as an anonymous install. We keep the record of App Store purchases already made (transaction identifiers, not payment details) so that an active subscription can still be restored and the same purchase cannot be redeemed twice.

6. Purchases and Credits

PhotoRepair offers PhotoRepair Pro as an auto-renewing weekly or yearly subscription, and one-time credit packs (200, 500 or 1,200 AI credits). All payments are processed by Apple through the App Store. We never receive your card details, billing address or Apple Account email.

To unlock what you bought and add credits, the app sends the Apple-signed transaction record to our account server, which verifies it. That record includes the product, Apple’s transaction identifiers, purchase and expiry dates, your App Store region and the price paid. We keep the product, the transaction identifiers and expiry dates, and your resulting credit balance and history (credits added, spent, expired or refunded). Apple also notifies our server directly about renewals, failed renewals and refunds. To match those notices to the right balance, your random user ID is attached to the purchase as the App Store “app account token”.

7. Push Notifications

Notifications are off unless you turn on Credit notifications in the Me tab. If you do, we store your device’s Apple push token and language so we can tell you when credits are added or a renewal could not be charged. Turning the switch off removes the token from our server. We do not send marketing notifications.

If you are signed in with an email address, we may also email you about your account — for example when a refund removes credits, or to confirm that your account was deleted.

8. Rating Prompt and Feedback

The rating prompt and the Feedback form are provided by our own service at rate.mzjpg.com.

Feedback you send: the message you write, the category you pick, your email address if you choose to give one, up to three screenshots if you attach them, and the device details shown in the form before you send — app version and build, system version, device model, language and region, time zone, days since install and number of launches. We use this only to answer you and fix problems.
Rating prompt: the app fetches its prompt settings from this service, sending the app version and language, and reports anonymous counts of whether the prompt was shown, dismissed or acted on. These reports carry no user or device identifier.

9. What We Do Not Collect

No advertising, no advertising identifier (IDFA), and no tracking across apps or websites.
No third-party analytics or crash-reporting SDKs. If you have agreed in iOS Settings to share analytics with app developers, Apple provides us with aggregated, anonymous crash and usage statistics.
No access to your contacts, microphone, or precise location. The app uses your photo library only to show and open your photos and to save results; reading them happens on your device.

Like any online service, our servers and our hosting provider (Cloudflare) process your IP address and basic request information when the app connects, to deliver the service and to limit abuse. We do not use it to build a profile of you.

We do not sell your personal information and we do not share it for advertising. Information leaves us only as described above:

AI model providers (Google, and Pruna AI via Cloudflare) — the prompt and photo you send to the cloud AI features.
Cloudflare — hosts our servers and database, and delivers email we send.
Apple — purchases, push notifications, Sign in with Apple, App Attest and Apple Maps.
Google — Sign in with Google, if you choose it.
When required by law, or to protect against fraud and abuse.

These providers may process data in countries other than your own.

11. Retention

Photos and prompts sent to cloud AI: not stored by us (see section 4).
Account and credit records: kept while your account or app identity is in use. Sign-in details are deleted when you delete your account.
Purchase records: kept as long as needed to honor purchases and meet accounting and legal obligations.
Feedback: kept until it is resolved and no longer needed; you can ask us to delete it.

12. Your Choices and Rights

Use only the on-device tools if you do not want any photo to leave your device.
Decline the cloud AI permission, do not sign in, leave notifications off — each is optional.
Delete your account in the Me tab at any time.
Delete the app to remove everything stored on your device.
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, or to object to how it is used. Email us at [email protected] and we will respond.

13. Children’s Privacy

PhotoRepair is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on our website and reflected in the Effective Date above. If a change materially affects how your photos or personal information are handled, we will also tell you in the app.

15. Contact Us

If you have any questions or concerns about our privacy practices, please contact us at:

Email: [email protected]
Full Policy URL: https://www.mzjpg.com/policy/photorepair