Privacy Policy
Last updated October 13, 2026
Who we are
Tattofy is provided by its developer, who is shown as the seller on Tattofy’s App Store page (“we”, “us”). This policy explains what the Tattofy app collects and why. Contact us at 742harunn@gmail.com.
What we collect
Tattofy works without an account. On first launch the app creates a random anonymous identifier, stored on your device and on our servers. We do not collect your name, email address, phone number, contacts or location. The app never reads your photo library: it only asks permission to add designs you choose to save.
What you create
The text you enter to describe a tattoo, the style and placement you choose, and the images generated for you are stored so your library works across sessions. The people who operate Tattofy can view these descriptions and images, with the chosen style and placement, to maintain quality, prevent abuse and provide support; they see a pseudonymous code, not your identifier.
Image generation
Before your first design the app asks for your agreement. Your description, with the style and placement you chose, is sent to our server, which composes a tattoo-oriented prompt and forwards it to OpenAI, a third-party image generation provider. No name, email, contacts, photos or identifier are sent to the provider. It processes the prompt under its own terms and policies. The date and version of your agreement are stored on your device.
Service providers
We use a small number of providers to run Tattofy: Render hosts our servers and handles the network information, such as IP address, needed to deliver each request; Supabase stores our database and the generated images; OpenAI generates the images; Apple processes subscription payments; and RevenueCat manages subscription status, receiving your anonymous identifier and purchase status but never your payment details. Each processes data under its own terms and policies.
Security and fair use
To prevent abuse, our servers count requests per network address and per anonymous identifier; IPv6 addresses are shortened to their network prefix. We also count how many free designs each network uses per day (UTC), so that one network cannot use up the free designs available to everyone. These counters hold only a network address or identifier and a number, are used only for security and fair use, and are kept apart from your account and library. Our server logs replace your identifier with a pseudonymous code.
No analytics or advertising
Tattofy does not use analytics, advertising or tracking services and does not use your device’s advertising identifier. We do not sell your data.
Purchases
Subscriptions are processed by Apple. We never see or store your payment details. We store whether your subscription is active, when it expires and when we last confirmed it with RevenueCat. To count premium designs, we also keep a premium usage record for each billing period: a code computed from the App Store’s record of that period’s purchase, the start date of the current 7-day window and the number of premium designs used in it.
How long we keep data
Your anonymous identifier and everything linked to it — descriptions, prompts, generated images, the number of designs generated and when, onboarding answers and subscription status — are kept until you use Delete my data. Request counters are kept only until the time window they limit ends: for example, the count of new identifiers created per network expires after one hour, and the daily count of free designs per network expires one hour after the end of that day (UTC), so at most about 25 hours after it starts. Expired counters are deleted automatically as our servers handle later requests. Premium usage records (see Purchases) are kept indefinitely: they are not deleted when a billing period ends or when you use Delete my data. The identifier exists only in the app on your device: if you delete the app without using Delete my data first, the data stays on our servers and we can no longer tell which data was yours, so use Delete my data before deleting the app.
Deleting your data
Settings → Delete my data permanently deletes your anonymous account from our servers — your identifier, descriptions, prompts, generated images, the number of designs you generated, onboarding answers and subscription status — then removes the identifier from this device; the app starts again with a new one. Two kinds of records are not deleted with it: security counters, which expire as described above, and premium usage records. A premium usage record belongs to the subscription’s billing period rather than to your identifier, so deleting data cannot refill a subscription’s allowance: its code is computed from the App Store’s purchase record, so the same subscription leads back to the same record, for example after Restore purchases. Images you saved to your photo library stay there. Deleting data does not cancel a subscription: cancel it in your App Store account settings. RevenueCat keeps its record of an App Store purchase under its own policies; to keep using an active subscription after deleting your data, tap Restore purchases.
Children
Tattofy is made for adults considering a tattoo and is not directed to children. It does not ask for anyone’s age, name or contact details.
Changes and contact
If this policy changes, we will update the date at the top of this page. Questions about privacy can be sent to 742harunn@gmail.com.