Privacy Policy

Sheen ("the app") is a beauty camera for Android made by Aridya Technologies ("we", "us"), Doddanekundi, Bangalore, India 560037, which is responsible for your personal data under this policy. This policy explains what data the app and the services behind it handle, why, where it goes, how long it is kept and the choices you have. We wrote it to be read, not skimmed past: if anything is unclear, write to privacy@aridya.com.

• 01 Scope
• 02 What stays on your phone
• 03 Permissions
• 04 Cloud AI tools (optional)
• 05 Credits, purchases and your wallet
• 06 Analytics, crash reports and Firebase
• 07 Notifications
• 08 AR lenses from Snap's Camera Kit
• 09 Effects downloads and request logs
• 10 Who we share data with
• 11 Personalised ads and how we advertise Sheen
• 12 How long we keep data
• 13 Your choices in the app
• 14 Legal bases
• 15 Your rights
• 16 Information for specific regions
• 17 Where data is processed
• 18 Children
• 19 Security
• 20 Google Play Data safety summary
• 21 Changes to this policy
• 22 Contact us

01Scope

This policy covers the Sheen app for Android (package com.aridya.sheen) and the online services it uses: Sheen's server (the credits, AI and notification service run by Aridya Technologies on Google Cloud) and the content service that delivers filters and lenses. It does not cover Google Play, Snap's Camera Kit, Meta or other services that have their own policies, which we point to where they apply.

02What stays on your phone

• Camera frames and face data. To place beauty, makeup and lens effects, the app finds the position of your face in each camera frame (face landmarks, expressions and segmentation masks). This is computed in memory on your phone, used for that frame only, never written to storage and never sent anywhere. Sheen does not create face templates and does not recognise or identify anyone.
• Photos and videos you save go to your phone's gallery. When you edit a photo from your gallery, Sheen can save a copy so your original stays as it was.
• Working files (unsaved captures, imported photos while you edit, masks you draw) are kept in the app's private storage and deleted automatically after 24 hours. They are excluded from Android backups and device-to-device transfers.
• Your settings (beauty levels, chosen filters, preferences) are stored on your phone.

03Permissions the app asks for, and why

• Camera — to show the camera and take photos. The app explains why before Android asks.
• Microphone — only if you record a video with sound, asked the first time you do.
• Storage — only on Android 8 and 9, to save photos. Newer versions of Android need no permission for this.
• Photos — when you edit an existing photo, Sheen uses Android's photo picker, so it sees only the photos you pick.
• Notifications — asked when you choose to be told that an AI result is ready. Without it, notifications are simply not shown.
• Granted at install, with no prompt: internet and network state (credits, AI, downloads), Google Play Billing (credit packs), motion sensors used by some AR lenses, and the install referrer that tells Analytics which store listing installed the app.

Sheen does not ask for location, contacts or call logs. It has Android's advertising-ID permission, granted at install with no prompt, so that Meta and Google can measure the ads we run for Sheen (Section 11). The advertising ID is read only while your personalised-ads setting allows it, and you can reset or delete it in Android's settings. Sheen uses none of Android's Privacy Sandbox ad features: the permissions for them that Google's and Meta's libraries normally add are removed from the app.

04Cloud AI tools (optional)

Most of Sheen runs on your phone. Removing a background is also done on your phone, for free. A few tools — Magic Eraser, AI Retouch, AI Enhance, AI Background, AI Generate and the upscales — need more computing power than a phone has, so they run on our server. They are optional, cost credits, and run only when you tap them.

4.1 What is sent

• The one photo you chose for the edit, plus the area you painted for Magic Eraser.
• Any text you type for the tool (the AI Generate prompt or a retouch note) and the options you picked.
• Your wallet's identifier, so the edit can be charged to your credits.

Before the first upload, the app shows what is sent and asks for your consent. Nothing else from your gallery is uploaded.

4.2 How it is processed

The photo is uploaded directly to private storage on Google Cloud (Mumbai, India). Our server automatically checks any text you typed for unsafe requests, then sends the photo and instructions to Google's Gemini image models — through Google Cloud Vertex AI or the Google Gemini Developer API — which return the edited image. Google processes this as our service provider. Under the terms of the paid services we use, Google does not use the photos or text we send to train its models; it may keep them for a limited period only to detect abuse, as its terms describe. The result is stored next to your upload and offered to your phone through a link that expires. Neither we nor Google use these photos to identify anyone.

4.3 How long it is kept

• Your uploaded photo and the AI result are deleted automatically one day after they are created (the storage service's clean-up runs in the background, so occasionally up to a day later).
• The job record (tool, price, status and any text you typed) is deleted 7 days after the job.
• If you report an AI result, a copy of that result and your optional comment are kept for up to 90 days so we can review it, then deleted.

4.4 AI results

AI results are generated by a machine and can be inaccurate or unexpected. They may carry an invisible watermark that marks them as made with AI (for example Google's SynthID). You can report any result from the app.

05Credits, purchases and your wallet

• Your wallet. The first time you buy credits or use a paid AI tool, the app creates an anonymous wallet: a random identifier and a secret. The secret is kept on your phone in Google Block Store, which lets the app restore your credits if you reinstall. The wallet has no name, email address or password.
• Finding your wallet again. Clearing the app's storage in Android's settings also erases Block Store. So that your credits are not lost, the app sends our server a one-way hash of the identifier Android gives Sheen on your phone (the Android ID, which is different for every app), and our server keeps only a further hash of it, linked to your wallet. The Android ID itself never leaves your phone. If you clear the app's storage, the app uses this link to reconnect to your wallet; if you bought credits, your Google Play purchases can restore it on any phone signed in to the same Google account.
• Sign in with Google. Before you buy credits, use a paid AI tool or redeem a code, the app may ask you to sign in with your Google account, with one tap in Android's Google sign-in sheet. Google then gives the app a signed token that names your account; the app sends it to our server once, and our server checks it with Google and keeps only a keyed one-way hash of your Google account's identifier, linked to your wallet. We never receive your password, and we do not store your email address, name or profile photo (they are part of Google's token but are not kept). Your phone remembers the email address only to show which account is signed in. If you sign in on another phone, the same wallet and credits come back there. Settings › Account › Sign out gives this phone a new, empty wallet; your credits stay with your Google account until you sign in again. You can also remove Sheen's access in your Google account's settings.
• Purchases. Credit packs are sold through Google Play, which handles payment; we never receive your card or payment details. Our server receives the purchase from Google Play, checks it with Google, adds the credits to your wallet and records the purchase in the wallet's credits ledger. Google Play receives a one-way hash of your wallet identifier with each purchase, to match purchases to wallets.
• Spending. Each AI edit holds its price when it starts and is charged when it succeeds; if it fails, the credits go back to you.
• Refunds. If Google refunds or reverses a purchase, the matching credits are removed from your wallet.

06Analytics, crash reports and Google Firebase

Sheen uses Google Firebase to understand how the app is used and to find problems. These services are on by default and can be switched off at any time in Settings › Share usage analytics, which turns off all three together:

• Google Analytics for Firebase — counts of actions in the app, such as which features and effects are used, photos saved, AI tools used, credit purchases and notification opens. Events carry fixed values only: never a photo, face data, anything you type, your wallet identifier or your name. Google derives an approximate location (country or region) from your IP address. Analytics uses an app-instance identifier. Only while personalised ads are on (Section 11) does it also use the advertising ID and let Google use these events for our ads.
• Firebase Crashlytics — crash reports (where in the app it crashed, the app's state, and device details such as model and Android version).
• Firebase Performance Monitoring — app start time, network request times, and CPU and memory use.

We also use Firebase Remote Config to change settings and content without an app update, and Firebase App Check with Google Play Integrity to make sure requests to our server come from the genuine app. These use the Firebase Installation ID and basic device information; for Play Integrity, Google checks the app and device and our server receives only the verdict.

We copy Analytics events to a reporting database in our own Google Cloud project (BigQuery, India) to build product reports. The copies hold the same pseudonymous events and are kept for the same period.

07Notifications

Sheen can send notifications, such as "your AI result is ready" or a change to your credits. To address them, the app sends our server its Firebase Installation ID together with the app's language and your region (for example hi-IN), your time zone (so we only send messages during the day), the app version and your notification switches. This record is linked to your wallet, so it is only sent once you have one. Notifications never contain a photo, a result or information about a person. You can turn each kind off in the app or in Android's settings.

08AR lenses from Snap's Camera Kit

Some lenses in Sheen are augmented-reality lenses provided by Snap Inc. through its Camera Kit. Before you use one for the first time, the app shows Snap's terms and asks you to accept them. When a Snap lens is running, Camera Kit processes the camera image on your phone to run the lens, downloads the lens from Snap, and sends Snap usage data (such as which lenses are used) and diagnostics (crash and performance data). Snap handles that data under its Privacy Policy and Terms of Service. We receive no data from Snap about you, and Sheen's own lenses, filters and beauty effects do not use Snap.

09Effects downloads and request logs

Filters, lenses and makeup looks are downloaded from our content service so new ones can arrive without an app update. As with any internet request, the servers that receive the app's requests (ours and Google's) see your device's IP address. Our hosting provider keeps it in routine request logs, with basic request details, for up to 30 days, used only for security and troubleshooting.

10Who we share data with

We do not sell your data for money. Data is processed on our behalf, under contracts that limit its use to providing their services to us, by:

• Google — Google Cloud (our server, storage and databases), Vertex AI and the Gemini Developer API (the cloud AI tools), Firebase (analytics, crash reports, performance, configuration, notifications, App Check) and Google Play (purchases, Play Integrity).
• Snap Inc. — Camera Kit, for AR lenses (Section 8).

While personalised ads are on, we also share limited app activity for advertising with Meta (Meta Platforms Ireland Limited for people in the EEA, the UK and Switzerland; Meta Platforms, Inc. elsewhere) and with Google. They use it under their own terms and are responsible for their own use of it (Section 11).

We may also disclose data if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply to it.

11Personalised ads and how we advertise Sheen

Sheen shows no ads inside the app. We do advertise Sheen on other apps and websites, mainly on Meta's apps (such as Facebook, Instagram and Threads) and through Google (such as Search, YouTube and Google Play). To learn which of our ads lead people to install and use Sheen, and to show our ads to people who are likely to enjoy it, the app can share a limited set of data with Meta and Google. In the app this is called personalised ads.

11.1 What is shared

• With Meta, through Meta's app events library: that Sheen was installed and opened, and, when a credit pack you bought is added to your wallet, its price and currency. With these events Meta receives your device's advertising ID, an anonymous identifier the library creates for this installation of Sheen, basic device information (such as the device model, Android version and language), the app's version, and the IP address the requests come from.
• With Google: the Analytics events described in Section 6 (such as installs, app opens, the features you use and credit purchases) and your device's advertising ID, which Google can then use to measure and improve our Google ads.
• Never shared: your photos, the camera image, face data, your edits, anything you type, your wallet identifier, your name or your email address.

11.2 When it is shared, and your choice

• In the EEA, the UK and Switzerland, nothing is shared until you choose. Sheen asks once, after the welcome screen on a new install or on the camera screen after an update, whether to allow Sheen to personalise ads on other apps. Allow and Don't allow are equally easy, and closing the question counts as Don't allow. Until you answer, and after Don't allow, nothing is shared.
• Everywhere else, personalised ads are on by default, and you can turn them off at any time.
• Sheen learns whether you are in one of these regions from Google Firebase, which works out your country from your IP address. Until Sheen knows, nothing is shared.
• Settings › Personalised ads changes your choice at any time, in any country. When you turn it off, Sheen stops sharing straight away and deletes the events it had not sent yet. This switch is separate from Share usage analytics (Section 6). With Share usage analytics off, Google receives nothing for ads either.
• You can also reset or delete your device's advertising ID in Android's settings (usually Settings › Google › Ads, or Settings › Privacy › Ads).

11.3 How Meta and Google use it

Meta and Google use this data under their own terms and privacy policies: to measure how well our ads work, to show our ads to people likely to be interested, to show you more relevant ads, and to improve their advertising services. They may combine it with information they already hold about you. Meta's use is described in the Meta Privacy Policy, and Google's in How Google uses information from sites or apps that use our services. You can also manage ads in your Meta ad preferences and in Google's My Ad Center.

11.4 Ads inside Sheen and subscriptions in the future

Sheen has no ads inside the app and no subscriptions today. We may introduce either in a future version. If we do:

• We tell you first. Before they arrive, we update this policy to describe exactly what changes, change the date above, and tell you in the app.
• Ads. Ads would be shown by an advertising partner such as Google AdMob, which may collect your device's advertising ID, IP address, approximate location and how you interact with ads, to show, measure and limit ads and to prevent ad fraud. Where the law requires it, for example in the EEA, the UK and Switzerland, we would ask for your consent to personalised ads before any are shown, and you could choose non-personalised ads instead. We would not show personalised ads to users we know to be under 16.
• Subscriptions. A subscription would be sold through Google Play, which would handle payment, as it does for credits today; we would receive only the purchase details we need to give you access (Section 5).

What never changes: your photos, the camera image, face data and anything you type are never used for ads or shared with advertisers, and we never sell them.

12How long we keep data

13Your choices in the app

• Settings › Share usage analytics — turns Analytics, Crashlytics and Performance Monitoring off or on.
• Settings › Personalised ads — stops or allows sharing with Meta and Google for advertising (Section 11), in any country, at any time.
• Notifications — each kind can be switched off in the app or in Android's settings.
• Cloud AI tools — simply don't use them; nothing is uploaded otherwise.
• Settings › Delete my data — deletes, on our server, your AI uploads, results and jobs, your notification device records, your wallet recovery link, your Google account link and your credits balance, then your wallet's credentials; and on your phone, the app's working files, AI records and notification records, and the anonymous identifier, purchase records and unsent events of Meta's library. A Don't allow for personalised ads is kept; an Allow is forgotten, so Sheen asks again where the law requires consent. Data Meta and Google have already received is kept under their own policies; you can ask them to delete it. Purchase records stay in the ledger without a usable account, for accounting and late refunds, and reported AI results are kept, anonymised, up to 90 days. Credits are lost when the wallet is deleted.
• If you no longer have the app, see how to ask us to delete your data.

14Legal bases

EEA, UK and Switzerland (GDPR, UK GDPR and the Swiss FADP): we process data to provide the features you use (performance of a contract: credits, purchases and the AI tools you start); with your consent (uploading a photo to a cloud AI tool, notifications, and sharing data with Meta and Google for personalised ads, Section 11); for our legitimate interests in keeping the app working, secure and free of fraud, and in understanding how it is used (analytics, crash reports, performance data, App Check), with a simple way to object in Settings; and to meet legal obligations (purchase and accounting records). You can withdraw consent at any time without affecting what was done before.

India (Digital Personal Data Protection Act, 2023): photos sent to the cloud AI tools are processed on the basis of your consent, which you can withdraw at any time by not using those tools and by using Delete my data. Sharing with Meta and Google for personalised ads (Section 11) can be turned off at any time in Settings › Personalised ads. Other processing is for the uses described in this policy.

15Your rights

Depending on where you live, you may have the right to know what personal data we hold about you and get a copy of it, to correct it, to delete it, to object to or restrict its use, to withdraw consent, to move it to another service, and to complain to a regulator. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Because Sheen keeps no names or email addresses, we cannot find your data from them: the in-app controls (Section 13) are the quickest route. To write to us about your data, use Settings › Contact support: the email it prepares includes your Support ID, which identifies your wallet and is never shown anywhere else. We use it to verify that a request is yours. We answer within 30 days (or sooner where the law requires) and do not charge for reasonable requests.

16Information for specific regions

16.1 United States (California and other states)

This section supplements the policy for residents of California and of other states with consumer privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon). In the last 12 months we have collected these categories of personal information, from you and your device, for the purposes in Sections 4 to 9:

• Identifiers — the wallet identifier, the Firebase Installation ID, a hashed device identifier (to reconnect your wallet), a keyed hash of your Google account identifier (if you sign in), the Analytics app-instance identifier, IP address, and, while personalised ads are on, the advertising ID and the anonymous installation identifier of Meta's library.
• Commercial information — credit packs you bought.
• Internet or other electronic network activity — app interactions, crash reports and performance data.
• Approximate geolocation — country or region derived from your IP address.
• Audio, electronic and visual information — the photos you send to a cloud AI tool.
• Other information you provide — text you type for an AI tool or a report.

We do not sell personal information for money. While personalised ads are on (Section 11), we share personal information for cross-context behavioural advertising, as California law uses that word: identifiers (the advertising ID and the anonymous installation identifier of Meta's library), commercial information (the price and currency of credit packs you buy) and internet activity (installs, app opens and the features you use), with Meta and Google. Some other states' laws may treat this as a sale or as targeted advertising. Settings › Personalised ads is our "Do Not Sell or Share My Personal Information" choice: turn it off and Sheen stops sharing straight away. We do not use or disclose sensitive personal information for purposes other than providing the services you ask for, and we do not knowingly sell or share the personal information of consumers under 16. You have the right to know, access, correct and delete your personal information, to opt out of its sale or sharing and of targeted advertising (Settings › Personalised ads), and not to be discriminated against for using these rights. You can use them as described in Section 15, or through an authorised agent with your signed permission. If we decline a request, you can appeal by replying to our answer; if you remain unsatisfied, you can contact your state attorney general.

16.2 Biometric data (Illinois, Texas, Washington and similar laws)

Sheen does not collect, capture, receive, store, share or sell biometric identifiers or biometric information. The face positions used to place effects are computed on your phone, in memory, for each camera frame and then discarded; we never create face templates or scans of face geometry, and we never use any data to identify a person.

16.3 Brazil (LGPD)

We process personal data on the legal bases in Section 14 (performance of a contract, consent, legitimate interest and legal obligation). You have the rights in Article 18 of the LGPD, including confirmation that we process your data, access, correction, anonymisation, blocking or deletion, portability, information about who we share it with, and withdrawal of consent. Our point of contact for data protection (encarregado) can be reached at privacy@aridya.com.

16.4 Canada, Australia, Japan, South Korea and elsewhere

You can access and correct the personal information we hold about you and withdraw consent, as described in Section 15, and complain to your privacy regulator (for example the Office of the Privacy Commissioner of Canada or the Office of the Australian Information Commissioner). Your data is processed in India and by Google in other countries (Section 17); India's data protection system differs from yours, and we protect your data as this policy describes wherever it is processed.

17Where data is processed

Sheen's server, storage and databases run on Google Cloud in Mumbai, India. Google may process cloud AI requests, Firebase data and Play data in its data centres in other countries, under its data processing terms, which include the European Commission's standard contractual clauses for transfers from the EEA. If you are outside India, using the cloud AI tools or credits means your data is transferred to and processed in India. Meta and Google may process the data they receive for ads (Section 11) in the United States and other countries, under their own terms and transfer safeguards.

18Children

Sheen is not directed at children under 13, or under the minimum age for consenting to digital services in their country (up to 16 in some EEA countries), and we do not knowingly collect their personal data. If you are under 18, use the cloud AI tools and buy credits only with a parent's or guardian's permission. We do not knowingly share children's data for personalised ads. If you believe a child has used a cloud AI tool or bought credits, contact us and we will delete the related data.

19Security

• All traffic uses encrypted connections (HTTPS/TLS); unencrypted traffic is blocked in the app.
• Uploads and results sit in private storage, reachable only through short-lived signed links.
• Requests to our server must pass Firebase App Check and Google Play Integrity.
• Server secrets are kept in Google Secret Manager; the app's working files are private to it and excluded from backups.

No system is perfectly secure, but we design Sheen so that as little as possible leaves your phone in the first place. If a breach affecting your personal data occurs, we will notify you and the authorities as the law requires.

20Google Play Data safety summary

None of this data is sold for money. Only what the table marks as shared goes to Meta and Google for advertising, and only while personalised ads are on (Section 11). All of it is encrypted in transit, and you can ask for it to be deleted (Section 13).

21Changes to this policy

We will update this policy when Sheen changes — for example if we add ads inside the app, a subscription or a new AI service — or when the law requires it. When we make material changes, we update the "Last updated" date above and tell you in the app before they take effect, and where the law requires your consent for a new use of your data, we ask for it first. The current version is always at this address and linked from the app; earlier versions are available on request.

22Contact us

• Aridya Technologies, Doddanekundi, Bangalore, India 560037
• Email: privacy@aridya.com
• Grievances (India, Digital Personal Data Protection Act, 2023): privacy@aridya.com. If you are not satisfied with our response, you may approach the Data Protection Board of India.

If you are in the EEA, UK or Switzerland and believe we have not addressed your concern, you have the right to complain to your local data protection authority.

See also the Sheen Terms of Use.