Portrait Art
SmartHarmony AI · Portrait Art

Privacy Policy

What happens to your photos and information when you use Portrait Art — including the automated assessment of each photo and the AI processing that paints it.

Last updated: October 11, 2026

Portrait Art has not launched yet. This page describes how the service will handle your information from launch; nothing described here is processing anyone’s data today. We will update this page if anything changes before launch.

1. Who we are

Portrait Art is an app by SmartHarmony AI LLC, Austin, Texas, United States (“we”, “us”). It turns a photo you choose into a painted portrait using AI. This policy explains what the app and our service handle, why, who else receives it, and how long it is kept. Contact us at support@smartharmonyai.com.

2. The short version

  • You do not create a login. The app makes an anonymous account; we never ask for your name, email or phone number.
  • Your photo does leave your device when you commission a portrait. A reduced copy of each photo you add (at most 1280 pixels on its longest side; most looks take one photo, some take two) is sent to our service and to our AI provider, OpenAI. We delete our copy of your photos as soon as the piece is finished or refunded.
  • An automated system assesses each photo before a portrait is made, and it can refuse the photo. OpenAI’s models check whether the photo fits the look you chose — for example whether it shows a person and a usable face — and then create the piece. A refused photo costs no credit, and you can ask us to look at a refusal you think is wrong (section 4).
  • This is not face recognition: no photo is compared with any database, nobody is identified, and we create and store no face template or other biometric identifier.
  • So that the same photo is not assessed twice, we keep a validation-cache identifier — a hash of the photo file, tied to your account — with the result of the assessment, for at most 30 days. It is personal data linked to your account; it is not anonymous data. It is deleted when you delete your account.
  • On iPhone and iPad the app also looks for faces on the device and sends three numbers with the photo (how many faces, how large the biggest one is, whether it is cut off). On Android it does not (section 4).
  • The finished piece is created by OpenAI and passes through our service to reach your device. We delete our copy within 72 hours of your device saving it, or after 30 days if your device never confirms it.
  • Your pieces, and the photos you used, are kept in the app on your device. We set no expiry on them there, but they exist only on that device: they are lost if you uninstall the app, clear its data or lose the device, unless your device’s own backup (for example iCloud) includes them. You can save a piece to your photo library, share it, or delete it in the app. Our service does not keep a copy for you: see the next point.
  • Subscriptions and payments go through Apple or Google; we receive confirmation of the payment and the subscription’s status, never your card details.
  • No ads in the app. On iPhone and iPad we never use your device’s advertising identifier (IDFA). On Android the app reads the Google advertising ID only if you turn on advertising measurement, and never otherwise. We use Google Analytics for Firebase to understand how the app is used; you can turn it off in Account → Privacy choices. In the EEA, the UK and Switzerland it stays off unless you turn it on. Advertising measurement (Tenjin), which tells us whether an ad led to your install, is off unless you turn it on.
  • If the app crashes or hits an error, a cleaned-up crash report goes to Sentry so we can fix it — never your photos, portraits or account identifier.
  • You can report a portrait from the app if it is offensive or not what you asked for; the report names the commission and a reason, never the image.

3. Information we handle

On your device

  • The photos you take or choose for a commission, and the pieces you receive, stored inside the app.
  • Your anonymous account credential, in the device’s secure storage.
  • On iPhone and iPad: the result of the on-device face detection for a photo you are about to use (section 4). It is held only while you are using the app and is not saved.

On our service

  • Account: a random account identifier, a hash of its credential, when it was created, and — if you create one — a hash of your recovery code (never the code itself).
  • Network signal: a keyed one-way hash of the network prefix your connection came from (not your full IP address), used to limit account creation and account-recovery attempts per network.
  • Device key for the introductory free credits: a keyed one-way hash that tells us a device has already received the 3 introductory free credits that Portrait Art gave before the subscription plans. The app computes a hash on your device (from a random identifier it keeps in secure storage on iOS, or from the Android ID on Android) and sends only that hash; we store a further keyed hash of it. It is used only to give the introductory free credits once per device, for accounts created before the subscription plans. It is not used to decide who gets the free trial (the free trial is the app’s own: see “Free trial” below), and not for analytics, advertising or tracking.
  • Commissions: which look you chose, how many photos it took, its status, timestamps, the result of the automated photo assessment (accepted, or reason codes such as “no face visible”), and the cost of the AI calls that assessed the photo and produced the piece. Your photos and piece are held only for the periods in section 4.
  • Validation-cache identifier: when a photo is assessed (section 4), we store an identifier computed from the photo file or files, your account identifier and what the look requires — a one-way hash — together with the result (accepted, or the reason codes) and the date it expires. We use it for one thing: if you submit the same photo again for a look with the same requirements, we reuse the result instead of sending the photo to be assessed, and paid for, a second time; a photo that was refused is refused again without a new assessment until that result expires. The identifier contains no image and cannot be turned back into your photo. It is not used to recognise a face, and it cannot match a photo between accounts. Because it is derived from your photo and tied to your account, it is personal data linked to your account — it is not anonymous. How long it is kept is in section 8.
  • On-device measurements (iPhone and iPad only): three numbers for each photo of a person, described in section 4. Our service uses them only to compare what the device found with its own assessment; they never replace, skip or change that assessment.
  • Free trial: a random trial identifier made by the app and kept on your device in protected storage that can outlive the app (iOS Keychain; Android Block Store), a one-way hash of it on our service, the trial’s start and end times and whether its 3 credits were granted, and the app’s own record of the latest time it has seen (so setting the phone’s clock back does not extend the trial). To confirm the request comes from a genuine device and to give the trial once, the app sends Apple a DeviceCheck token or Google a Play Integrity token; our service asks Apple or Google to verify it and keeps only the result and, on iPhone and iPad, a one-time “trial used” mark that Apple stores for the device. We do not receive your device’s advertising identifier, hardware identifiers or location. Our service also tells the app its own current time, only when the app asks, to keep the trial’s clock correct.
  • Credits and subscriptions: your balance and an append-only record of credits granted, spent, returned and refunded, including store transaction identifiers; and, for a subscription, its plan, whether it is in a trial or a paid period, the dates of that period and whether it will renew, as reported by the store.
  • Notifications: if you allow them, a push token for your device. A notification contains a fixed title, the name of the look, and a commission identifier — never an image.
  • Diagnostics: if the app hits an error, a report with the error’s name, a cleaned-up message, the area of the app, your platform and the app version. It carries no account identifier, photo or device identifier.
  • Crash reports (Sentry): if the app crashes or hits an unexpected error, the app sends Sentry a crash report: the error and its stack trace (where in the app’s code it happened), your device model, operating system and version, and the app version and build, with a short trail of recent app actions. Before it leaves your device the report is cleaned: photos, portraits, prompts, image data, file paths, web addresses’ details, email addresses, recovery codes, account and purchase identifiers are removed, the device name is removed, and no IP address is attached by the app. No screenshots, no screen recordings, no performance tracing. Crash reports are not tied to your choices in Privacy choices, because they are needed to keep the app working.
  • Portrait reports: if you use “Report this portrait”, we store which commission you reported, the look it used, the reason you chose, your optional note (up to 500 characters) and when — linked to your anonymous account so one account files one report per portrait. Never the image.
  • Recovery codes: a record of when a code was created, used or tried, with the keyed network hash (never the code), to stop guessing. It is deleted with your account.
  • Usage reports: our operations console sees per-user usage only under a keyed pseudonym, never the account identifier.

4. Photos, automated assessment, AI processing and storage

When you commission a portrait, the app resizes each photo you added and uploads it to our service (Cloudflare Workers and storage). Most looks take one photo. Some take more than one — for example a couple, a group of friends, two adults for an imagined baby, or a person and a pet — and a picture can include up to four people. Our service sends the photo or photos to OpenAI’s API for two purposes, each time asking OpenAI not to store the request for later retrieval:

  1. An automated assessment of whether the photo fits the look. An OpenAI model is asked a fixed set of questions about each photo: whether it shows a person; whether a face is visible, large enough, not cut off and not covered; whether the photo is too blurred or too dark; whether it shows more than one prominent person where the look needs exactly one; whether it shows an animal, for looks that include a pet; whether the person appears to be an adult, for looks that need adults; and, for looks that need photos of two different people, whether the two photos appear to show the same person. Our service applies fixed rules to the answers and either accepts the photo or refuses it.
  2. Creating the portrait. The photo or photos are sent with a written description of the chosen look that we prepare (you never write the prompt). The model that creates the portrait is instructed not to invent a person or an animal that is not in the photo, so it too can refuse a photo that does not show what the look needs. OpenAI returns the finished image to our service, which delivers it to your app.

This assessment is automated, and it can refuse your photo. No person looks at a photo before it is accepted or refused. If a photo is refused, no portrait is made from it and no credit is used — a credit set aside for the commission is released — and the app tells you which photo was refused and why, so you can choose another one. The assessment can be wrong. If you think a photo was refused in error, email support@smartharmonyai.com with Portrait Art in the subject and tell us which look you chose and what the app said; we will look into it. Please do not send the photo itself unless we ask for it. A refusal is remembered for one day (the validation-cache identifier in section 3); after that the same photo is assessed afresh.

What the assessment is not. It is not face recognition. No photo is compared with a database of faces or with other people’s photos, nobody is identified, and we do not learn or record who is in a photo. We do not create or store a face template (“faceprint”), a map of facial features or any other biometric identifier. From the assessment we keep only its result: accepted, or reason codes such as “no face visible” or “both photos show the same person”. Whether someone appears to be an adult, and whether two photos show the same person, are rough visual judgements by the model about the photos you submitted for that one commission. They are not an age check or an identity check, and they are used only to decide whether the photo fits the look.

What the app checks on your device first. Before anything is sent, the app checks the file itself on your device: that it is a still photo in a format the app accepts, and that it is neither too small nor too large. On iPhone and iPad the app also looks for faces in the photo with Apple’s Vision framework. That detection runs entirely on the device and its result is not saved. When you commission, three numbers from it are sent with each photo of a person: how many faces were found, how large the biggest face is relative to the photo, and whether that face is cut off at the edge. No position, outline or feature of a face is sent. The numbers are not used to decide whether your photo is accepted: our service’s own assessment, described above, always runs. On Android the app does not run face detection on the device and sends no such measurements; the photo is assessed on our service as described above.

  • Your photos on our service: deleted when the piece is finished, refunded or cancelled, or the photo is refused. Where a look takes more than one photo, all of them are stored and deleted together. A scheduled sweep removes anything left behind, within a day at most.
  • The piece on our service: deleted within 72 hours after your device confirms it has saved it, or after 30 days if it never does.
  • The validation-cache identifier and the result of the assessment: see sections 3 and 8.
  • At OpenAI: under OpenAI’s API data policy, inputs and outputs may be retained for up to 30 days to detect abuse, and content flagged for abuse may be kept longer. This applies to photos sent for the assessment as well as for the portrait. OpenAI does not use API data to train its models by default. We have no separate retention arrangement with OpenAI; its standard API data terms apply.

We use your photos only to assess them for, and to create, the portrait you asked for. We do not use them to identify you or anyone else, build a face profile, or train AI models.

Photos of other people. If you add a photo of someone else — for example another person in a couple or group look — that photo is handled exactly as described here: it is sent to OpenAI for the assessment and for the portrait and deleted from our service with the commission. Nothing about that person is kept except the result of the assessment and the validation-cache identifier, both tied to your account. You must have their permission before you add their photo (see the Terms).

5. Permissions and your choices

  • Camera: to take a photo for a commission. Optional — you can choose an existing photo instead.
  • Photos: to choose a photo, and to save a finished piece. By default the app adds each finished piece to your photo library; you can turn this off in Account → Photos, and you can also save a piece yourself with Save to Photos. Saving uses permission to add a picture to your photo library; the app does not read your library to do it, and nothing about it is sent to us. Choosing a photo uses your device’s photo picker, which gives the app only the photo you pick.
  • Notifications: to tell you when a piece is ready. Optional; everything works without them.

You can change these in your device settings at any time.

Saving and sharing. A finished piece is added to your photo library automatically unless you turn that off in Account → Photos; you can also save it yourself, or share it through your device’s share sheet to apps such as Instagram, Messenger, Facebook, WhatsApp or X. Sharing is your choice each time: your device hands the picture to the app you pick, and we send nothing to those services ourselves — not the picture, not your photo, and not your account identifier. What you post is then handled by that service under its own privacy policy. A shared piece may show other people; share it only if they have agreed.

Usage analytics and advertising measurement are separate choices in Account → Privacy choices. Usage analytics is on by default and can be turned off at any time, which stops collection and resets the analytics identifier on this device. In the EEA, the UK and Switzerland — and until the app knows which region you are in — it is off unless you turn it on. Advertising measurement is off unless you turn it on.

6. Why we process information

  • To create and deliver the portraits you commission (performing our contract with you).
  • To assess automatically whether a photo fits the look you chose before a portrait is made, so that a portrait is not invented from an unsuitable photo and no credit is used for one (performing our contract with you); and to remember that result for a limited time through the validation-cache identifier, so the same photo is not assessed and paid for twice (our legitimate interests in running the service at a sustainable cost).
  • To run credits and subscriptions, add the weekly credits of a plan, return credits for failed work, and handle refunds.
  • To prevent abuse of trials and free credits and protect the service (our legitimate interests).
  • To find and fix errors and crashes (including crash reports to Sentry), and to monitor the cost and reliability of the service (our legitimate interests).
  • To review reported portraits and improve how looks are made and filtered (our legitimate interests, and to meet app store rules on AI-generated content).
  • To meet legal and accounting obligations.
  • Usage analytics and advertising measurement: with your consent in the EEA, the UK and Switzerland; elsewhere, our legitimate interest in understanding how the app is used, which you can turn off at any time.

This policy is written to meet the EU and UK General Data Protection Regulation (GDPR), the Swiss data protection law, and US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA). Where the GDPR applies, the legal bases are shown in brackets above: performing our contract with you, our legitimate interests, your consent, or our legal obligations. Credits, subscriptions and refunds rely on our contract with you; error and crash fixing, cost and reliability monitoring, and reviewing reported portraits rely on our legitimate interests; accounting relies on our legal obligations.

7. Service providers and disclosures

  • OpenAI — assesses each photo for the look you chose and creates the portrait from it (section 4). It receives the photo or photos and our written instructions; it does not receive your account identifier.
  • Cloudflare — hosts our service, database and temporary file storage.
  • RevenueCat — verifies App Store and Google Play subscriptions and purchases. It receives your anonymous account identifier and the subscription and purchase details. On Android, if you turn on advertising measurement, it also receives the Tenjin installation identifier and the device identifiers its software collects for attribution, which on Android include the Google advertising ID. On iPhone and iPad it never receives an advertising identifier.
  • Apple and Google — process payments under their own terms, deliver notifications, and verify that a free-trial request comes from a genuine device (Apple DeviceCheck; Google Play Integrity). Apple stores a single “trial used” mark for the device; neither receives your photos or account identifier.
  • Expo — relays push notifications to Apple and Google, if you allow notifications.
  • Google Analytics for Firebase — usage analytics, unless you turn it off: how the app is used (screens, buttons such as opening the credits screen, whether a portrait was completed), an app-instance identifier, app version and device type. RevenueCat also sends it purchase events (product, store, transaction identifier and your anonymous account identifier), joined to the app-instance identifier. Turning usage analytics off removes that identifier from RevenueCat, so later purchases can no longer be joined to this device’s analytics; RevenueCat does not document whether it still forwards a purchase event without it. Turning analytics off does not delete data already collected — ask us to request its deletion. Never your photos or portraits.
  • Sentry (Functional Software, Inc.) — crash and error diagnostics: the cleaned crash reports described in section 3 (error and stack trace, device model, operating system and app version; no photos, prompts or account identifiers). Sentry deletes them after its retention period — at most 90 days.
  • Tenjin (advertising measurement, Android only — the iPhone and iPad app does not include it) — only if you turn on Advertising measurement in Account → Privacy choices (it applies only while usage analytics is on). Until then the Tenjin software in the app is not started and sends nothing. When on, Tenjin receives an install and app-open signal with your IP address (as with any internet request), device model, operating system and app version, a Tenjin installation identifier, and — on iPhone — the identifier Apple gives the app for this device (IDFV) and Apple’s ad-attribution token, or — on Android — the Google Play install referrer and the Google advertising ID. It never receives the iOS advertising identifier (IDFA), your photos, portraits, prompts or account identifier. For installs Tenjin attributes, RevenueCat also sends Tenjin purchase events (product, price and transaction identifier) joined to the Tenjin installation identifier and the device details above. Turning it off tells Tenjin to stop and removes that identifier from RevenueCat.

We do not sell or share personal information for advertising, and we disclose information otherwise only when the law requires it.

8. Retention and deletion

You can delete your account at any time in the app, or without the app — see Delete your data. Deleting removes your account credential, recovery code, push tokens, commissions, portrait reports, every validation-cache identifier and assessment result kept for your photos, and any photo or piece still on our service. Deleting in the app also deletes the photos and pieces stored in the app on that device. Copies you saved to your photo library or shared elsewhere are outside the app and are not removed.

How long it takes. In the app, deletion takes effect on our service immediately and the app tells you when it is done. If a portrait is being painted at that moment, its last records are removed within minutes, as soon as that work stops. If you ask by email, we reply within 30 days and confirm when your account has been deleted.

What we keep after deletion, why, and for how long. We keep only records we need for security, fraud prevention or legal (accounting, tax) obligations, and delete them automatically when their period ends. The periods below are our own choices: Apple and Google require that we delete account data on request, keep only what security, fraud prevention or legal obligations need, and tell you what we keep and why — they do not set the periods themselves.

  • A deletion record — the anonymous account identifier, when it was deleted, how the deletion was requested and, for an email request, how we confirmed the account was yours. Why: evidence that we carried out the request, and fraud prevention. Kept for 2 years after deletion.
  • Credit and purchase records — the credit history of your closed wallet (amounts, dates, references; no photos), your purchase and refund records, and any payment that arrives after deletion (never granted; kept so it can be refunded). Why: accounting and tax law, and handling refunds. Kept for 7 years after the transaction; a deleted account’s records are removed together once its most recent one is 7 years old. RevenueCat keeps its record of these purchases for the same reason; the device, analytics and advertising identifiers on it are removed when you delete your account.
  • The one-way device key for the introductory free credits, where one was recorded for an account created before the subscription plans (and, if the app was verified by Apple or Google device attestation, that device key too), no longer linked to your account. Why: fraud prevention — deleting and recreating an account does not grant the introductory free credits again. Kept for 2 years after that device last used it.
  • AI cost records — what each AI call cost (no images). These are not kept about you: when you delete your account, every link to it and to your commissions is removed, so only anonymous cost totals remain.

Validation-cache identifier. Kept, with the result of the assessment, for at most 30 days after a photo was accepted and for 1 day after a photo was refused, then deleted automatically. It is deleted at once when you delete your account. The result of the assessment (accepted, or the reason codes — no image) also stays on the record of the commission it belonged to, until you delete your account.

While you have an account. Records of recovery-code use (a code issued, used, or a failed attempt) are kept for 1 year, for security. Diagnostics reports are kept for 90 days (daily counts, with no content, for about 13 months). Crash reports are kept by Sentry for at most 90 days. Portrait reports are kept until you delete your account; after that only anonymous totals remain (how many reports per reason and look, per day — no account, commission or note), for about 13 months. Google Analytics keeps user-level usage-analytics and purchase event data for 14 months (aggregate reports that identify no one are kept longer); it is not linked to your account on our service and is not deleted automatically when you delete your account — ask us and we will request its deletion from Google.

9. Security and international processing

Data travels over encrypted connections. Account credentials and recovery codes are stored only as hashes. Our providers may process data in the United States and other countries where they operate. When personal information from the EEA, the UK or Switzerland is processed in the United States or elsewhere, we rely on our providers’ data processing terms, which include the European Commission’s Standard Contractual Clauses (and the UK and Swiss equivalents), or on the EU–U.S. Data Privacy Framework where a provider is certified.

10. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete or port your information, and to object to or restrict processing. Because accounts are anonymous, we can act on a request only if you can show it is your account — for example with your recovery code, or a store receipt for a purchase. Email support@smartharmonyai.com.

The photo assessment described in section 4 is made by an automated system. You can ask us to look at a refusal, as explained there, and you can ask what we hold about your photos: the result of each assessment and the validation-cache identifiers linked to your account.

11. Children, updates and contact

Portrait Art is not directed at children under 13, and you must be at least 13 to use it. We do not knowingly process information from children under 13. If you believe a child under 13 has used the app, contact us and we will delete the account’s information on our service.

If we change this policy, we will update the date above and, for material changes, tell you in the app. Questions: support@smartharmonyai.com.