Privacy Policy

Effective date: October 28, 2026

This policy explains what our interior design app (the "App") collects, why, who receives it and how long it is kept. The App is operated by Denis Salaev ("we", "us"). Questions and requests: support@cotoha.app.

1. What we collect

Photos and designs

• Room photos you take with the camera or pick from your library, and any reference images you add, such as a style example, a piece of furniture or a moodboard you use as a style. Before upload the App resizes and re-encodes each photo, which drops the location and camera details stored in the original file.
• What you ask for: the tool and options you choose (for example room type, style, materials or colors), any text you type to describe a design or an edit, and the instruction we build from them for the AI.
• Generated designs: the images the AI makes for you.

Device information

• An anonymous device ID: a random identifier the App creates on first launch. It links your projects to your device. It is not your name, your Apple ID or an advertising identifier.
• Language and time zone of your device.
• Subscription details: whether you have Premium, which plan, purchase and renewal dates and the transaction identifiers Apple gives us, plus how many free designs you have used. If you came to the App from an Apple Search Ads ad, Apple's attribution service may tell us which campaign it was; it does not identify you.
• Technical logs on our server: IP address, time, the request made (which can include text you typed) and error messages. We use them to keep the service running and secure.

What stays on your device

Moodboards, your wishlist and cached images are stored only on your device, unless you use a moodboard as a style for a design (then it is sent as a reference image). The camera is used only when you take a photo. When you pick a photo, the App receives only that photo, not your library. Saving a design to Photos uses add-only access: the App cannot read your library.

What we do not collect

No account details, contacts, precise location or advertising identifier. The App contains no advertising and no analytics or tracking tools, and does not track you across other companies' apps or websites. Payments are made through Apple: we never receive your card details, your name or your Apple Account.

2. How we use it

• To make the designs and edits you ask for and show them to you.
• To give you Premium when you subscribe and to count your free designs.
• To keep your projects so you can come back to them.
• To show the App in your language and keep it working, secure and free of errors.
• To answer your emails and handle your requests, such as deletion.

We do not sell your data, we do not use your photos or designs for advertising, and we do not use them to train AI models. We share them only with the service providers below, only as needed to run the App, or when the law requires it.

Where EU or UK data protection law applies, we rely on: providing the service you ask for (contract); your consent, which the App asks for before your first photo is sent to the AI service; and our legitimate interest in keeping the service secure and working (technical logs).

3. Third-party AI processing

The App does not make designs on your device. For each design or edit our server sends the AI service your photo (or the design being edited), any reference images, and the instruction text, including what you typed. The AI service fetches the images through a temporary link that expires after one hour and returns the new image, which our server downloads and stores. The AI service does not receive your device ID.

• fal.ai (Features & Labels Inc., United States) runs the image model and processes your request. Privacy policy, terms.
• Google makes the image model we use (Nano Banana). To run it, your request may also be processed by Google. Privacy policy, Gemini API terms.

These providers handle the data under their own terms and privacy policies, which also set how long they keep it and what else they may do with it. Please read them if this matters to you. If we change the AI service or the model, we will update this policy and the list in the App before your photos go to the new service.

4. Hosting and other service providers

• Hetzner Online GmbH (Germany) provides the server in its data center in Nuremberg, Germany. Your photos, designs, the anonymous device ID, settings and logs are stored there. Privacy policy.
• Telegram: when a design fails or the server hits an error, we may receive an alert in a private Telegram chat. It contains the anonymous device ID and the error message, never your photos, and stays in that chat until we delete it. Privacy policy.
• RevenueCat, Inc. (United States) manages subscriptions for us: it receives the anonymous device ID, your purchase receipts from Apple and, for Apple Search Ads, the attribution token, and tells our server when Premium starts or ends. Privacy policy.
• Apple distributes the App and processes payments for subscriptions. If you allow it in your device settings, Apple shares crash reports and usage statistics with developers under Apple's privacy policy.

Some providers process data outside your country, including in the United States. Where the law requires it, we rely on the safeguards those providers offer for international transfers.

5. How long we keep it

• Photos, reference images, designs and instructions: until you delete the design or the project in the App, or ask us to delete them. Deleting a project removes its photo and all its designs from our server.
• Anonymous device ID, language and time zone: while you use the App, until you ask us to delete them.
• Technical logs: about 14 days, then they are deleted automatically.
• Subscription details: while you use the App, and longer only where tax or accounting law requires it.
• At the AI service: whatever fal.ai and Google keep is governed by their own policies (section 3).

Deleting the App from your phone does not delete data on our server. Delete your projects in the App first, or email us.

6. Your choices and rights

• Delete any design or project in the App at any time.
• Ask us to delete all data linked to your device, or to see a copy of it, by emailing support@cotoha.app. Because there are no accounts, we may ask for details that help us find your data, such as when you used the App or a design you made.
• You can withdraw your consent to AI processing at any time by stopping using the App and asking us to delete your data. Withdrawal does not affect processing that already happened.

Depending on where you live (for example the EU, the UK or California), you may also have the right to correct your data, object to or restrict its processing, receive it in a portable format and complain to your data protection authority. We answer requests within one month. We do not sell or share personal information for cross-context behavioral advertising.

7. Security

The App talks to our server over encrypted HTTPS connections, links given to the AI service expire after one hour, and only we can log in to the server. No method of storage or transfer is completely secure, so please do not upload photos that show documents, faces or anything else you would not want to share.

8. Children

The App is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has sent us photos, email us and we will delete them.

9. Changes to this policy

If we change how we handle data, we will update this page and its effective date. If the change is significant, for example a new AI service, we will also tell you in the App.

10. Contact

Denis Salaev
support@cotoha.app

See also our Terms of Service.