Privacy in the app
Last updated: 1 November 2026
This page says what the Back in Color app for iPhone does with your photo and your data, in plain words.
The short version
- If you give a photo, a small copy of it goes to our server and on to a computer model that reads the coloring of your hair, skin and eyes. We do not store your photo.
- You can skip the photo. Then no photo is sent anywhere, and your result rests on your answers.
- Your name stays on your iPhone. So do your answers, except the six that decide your colors, which go with the analysis.
- You pay through Apple. We never see your card or your Apple Account details.
- We do not build or keep a face template, and we do not identify anyone.
- No advertising, no tracking across other apps, and nothing sold or shared for advertising.
Who we are
Back in Color is run by Nik Novak, Ob dolenjski železnici 124, 1000 Ljubljana, Slovenia.
For anything on this page, write to us at hello@backincolor.com.
Your photo
Before the photo, the app shows you what it will do with it and asks. These are its words:
What we take: One photo of your face.
What we do with it: A computer model reads the coloring of your hair, skin and eyes. If it cannot read your photo, it tells you what to change.
Where it goes: Your photo is sent to our server and passed through a routing service to the company that runs the computer model, and to a second model if the first gives no answer. We do not keep it, and we ask everyone it passes through not to keep it or train on it.
What we never do: We never show ads, sell your data, or use it to train anything.
You can choose "Skip the photo". Then no photo is taken or sent.
The app asks iOS for the camera. To choose a photo instead, iOS shows you its own photo picker, and the app receives only the one photo you choose: it never sees the rest of your library and asks for no access to it. The app does not save the photo to your library.
What happens on your iPhone
- The app redraws your photo as a new image, which leaves out the location and camera data stored in the original. The copy the camera hands the app is deleted from the app's storage once it has been read.
- A face-landmark model inside the app finds your skin, eyes and lips. The app measures their colors and three quality numbers: how bright the photo is, how even the light is, and how much of the frame your face fills.
- The points it finds on your face never leave your iPhone and are gone when the analysis ends.
- The app makes a small copy of the photo for the computer model, at most 1024 pixels on its longer side. The copy is of the whole picture: anyone else in it, and whatever is behind you, is in it too.
What is sent to our server
For an analysis, the app sends our server:
- the small copy of your photo, if you gave one;
- the color measurements for your skin, eyes and lips, and the three quality numbers;
- six of your answers: your hair now, your natural hair color, your eye color, how your skin reacts to the sun, which jewelry metal suits you, and the decade you are in;
- the build number of the app, and once you have paid, the token that shows the purchase is yours.
If the analysis could not reach our server and you press "Try again", the app makes a new copy of your photo and sends it. If the copy arrived and our server answers that no computer model could read it just then, the app makes a new copy and sends it once more by itself, and never a third time. Where another try can help, your preview offers "Try again", which sends one new copy each time you press it. So one analysis can pass your photo to our server more than once, and to both companies named below.
Sometimes the copy is not sent at all, though you gave a photo: when our server has told the app beforehand that it is reading no photos, when the app cannot make the copy, or when an earlier try with the photo failed on our server or got no answer in time. Then the analysis goes without it.
Our server checks that the file is an image and not too large, takes out anything that is not the picture itself, and passes the picture to a computer model. It holds the picture in memory only while your request is being answered. The picture and the measurements are not written to our database, to a file or to a log.
The server works out your result and answers with a preview and a sealed copy of your result, which the app keeps. Only our server can open the sealed copy, and it shows you the full result once you have paid.
Your first name and your other answers are not sent to us.
The computer model that reads your photo
Our server sends the picture to OpenRouter (OpenRouter, Inc., United States), which passes it to the computer model. The model is Claude, made by Anthropic. If Claude gives no answer we can use, the same request goes to Gemini, made by Google. Nothing else about you goes with the picture: not your name, your answers or your IP address.
OpenRouter does not run these models itself. It passes your photo to a company that does: the maker of the model, or a cloud company that hosts it. When this page was last updated, OpenRouter's list of companies that keep nothing showed Amazon Web Services and Google Cloud for Claude, and Google Cloud for Gemini.
Every request carries two conditions, which are settings of OpenRouter: use only providers that do not collect user data, and only providers with a zero data retention policy. If no provider meets both, the model is not asked. We cannot look inside the other companies, so we rely on what they state:
- OpenRouter says it does not store what it passes on unless its customer turns logging on, and that it does not use it to train models. We keep OpenRouter's own logging turned off. Our server passes no photo on until someone here has looked at that setting in our account and written down the day.
- Amazon Web Services says that what is sent to a model through its service is not shared with the company that made the model and is not used to train models. It checks for misuse automatically, and says it may store and review an image that those checks flag as apparent child sexual abuse material.
- Google Cloud says it will not use its customers' data to train or fine-tune models without their permission. For its own Gemini models it also says that, unless its customer arranges otherwise, it may cache what is sent for up to 24 hours and may log prompts to detect abuse.
- Anthropic says in its commercial terms that it may not train models on its customers' content.
From the model's answer our server takes only words from fixed lists and one number (for example your hair color, your undertone and how sure the model is). It also takes the model's yes or no on whether the photo can be read, and its advice on what to change (for example to face a window, to go without makeup or to take off glasses). The rest is dropped. Nothing of it is stored.
Three of the model's words (hair, eyes and contrast), its note about the photo and its advice when it has some come back to the app with your preview, and the app shows them to you. They are not saved on your iPhone. When what the model says shows that your photo will not give a true reading, its advice comes back instead, and the app shows you what to change before anything else: you can take another photo, choose a different one, or go on with the one you gave. Your result then comes mainly from your answers.
Sometimes no computer model is asked, for example when a daily limit on readings has been reached. Then your result comes from your answers and the measured colors, and the app says so.
What stays on your iPhone
- Your progress: where you are in the app, your first name if you gave one, your answers, your preview and the sealed copy of your result. It is kept for 30 days from your analysis.
- Your access: once you have paid, a token from our server that shows the purchase is yours. It lasts up to 400 days and is renewed when you open the app.
- Your full result: once opened, so that you can see it without a connection. It is kept only while the token is.
"Forget this device" and "Redo my analysis", both in your result, clear your name, your answers and your saved result at once. Your purchase stays unlocked. Deleting the app removes everything above from your iPhone.
Your photo is never saved by the app.
When you pay
The full result is a one-time in-app purchase. You pay Apple, under your Apple Account. Apple handles the payment and never shares your card or account details with us.
The app uses RevenueCat (RevenueCat, Inc., United States) to work with Apple's In-App Purchase. RevenueCat gives the app an anonymous ID, made up on your iPhone, and keeps the purchase history for that ID. RevenueCat also receives technical details such as the device model, iOS version and app version, and sees your IP address when the app talks to it.
Our server asks RevenueCat to confirm a purchase before it unlocks your result. What we record about a purchase:
- a random reference, your season and the date;
- Apple's transaction number, the anonymous RevenueCat ID and whether it was a test purchase;
- the purchase notices RevenueCat sends us: the anonymous ID, the product, the price and currency, the store's country and Apple's transaction numbers. They hold no name, email or address;
- later: whether it was refunded and how many retakes you have used.
"Restore purchase" asks Apple what your Apple Account has bought, so a purchase comes back on a new iPhone without an account or a password with us.
App updates
The app can fetch fixes to its screens from our server. To do so it sends our server the app's version and build, iOS's version and a random device number made by the update library. The number decides when a gradual update reaches your iPhone. We do not store it.
Analytics
We use PostHog (PostHog Inc., United States) to see where people leave the app and how many buy.
- The app sends events to our own server, which passes them on without your IP address and without your location.
- It records no sessions, no taps and no typing. It can send only a fixed list of events, such as which screens are reached, whether the photo check passed, whether a computer model read the photo and whether a purchase was started.
- It is never sent your photo, anything measured from it, your result, your name or your answers.
- Two things the computer model said are counted: when the app suggests taking the photo again, the kind of problem with it (the light, heavy makeup or a filter); and when the model cannot read your photo, the first piece of advice the app shows you, how many it shows and what you did next. Nothing else the model said goes there.
- With each event come general technical details such as the iOS version, screen size, language and time zone.
- It keeps nothing on your iPhone between launches.
When a purchase completes or is refunded, our server tells PostHog the amount, the currency and a code made from the purchase reference. No Apple or RevenueCat ID.
Protection against misuse
Our server limits how often one internet address can use it. For a count of readings it keeps, for one day, a keyed hash of your IP address and how many readings it has had. The hash cannot be turned back into the address without our secret key, and it is deleted once its day is over. One internet address gets 10 readings a day.
Two things are kept for each day, for all users together and with nothing in them that points to a person or a photo: the number of readings and what they cost us, and a tally of what became of the photos: how many were read, how many were not and why, and which model answered.
Who else handles your data
- Apple: the App Store, the payment and your Apple Account, under Apple's own privacy policy.
- RevenueCat: confirms purchases, as described above.
- Cloudflare: runs our server and our database. Our database is in the United States.
- OpenRouter, and the company that runs the computer model (Amazon Web Services or Google Cloud for Claude, made by Anthropic; Google Cloud for Gemini, made by Google): read the photo, as described above.
- PostHog: analytics, as described above.
For people in the EU, a transfer out of the EU rests on the EU-US Data Privacy Framework or on standard contractual clauses, as each provider's terms set out. For people in the United Kingdom, a transfer out of the UK rests on the UK extension to that framework or on the UK's addendum to those clauses, as each provider's terms set out.
How long we keep things
- Your photo and the measurements: never stored by us. They are gone from our server when your request has been answered.
- Your name and your answers: only on your iPhone, until you choose "Forget this device", 30 days pass or you delete the app.
- Purchase records: for as long as you have access to your result, and after that for as long as accounting law requires.
- The count of readings: one day.
- The day's totals and the tally of what became of the photos: kept, with nothing in them that points to a person.
Our legal grounds (EU and UK)
- Contract: the purchase and the result.
- Your consent: reading your photo. You give it on the screen before the photo. You can withdraw it by not giving another photo: we keep nothing of an earlier one.
- Legitimate interests: product analytics and preventing misuse.
- Legal duty: accounting records.
Your rights
We are based in Slovenia. Slovenian law and the EU's General Data Protection Regulation (GDPR) apply to how we handle your data, and for people in the United Kingdom the UK GDPR does too.
You can ask what we hold about you, ask for it to be corrected or deleted, or object to how we use it. Write to the address under Who we are. We answer within one month. We keep no copy of your photo, so there is none to send you or to delete.
If you live in the EU you can also complain to your data protection authority. In Slovenia that is the Informacijski pooblaščenec. If you live in California or another US state, you have the rights your state's law gives you. We do not sell or share personal information.
If you live in the United Kingdom or Ireland
The app is sold in the United Kingdom and in Ireland. In the United Kingdom the UK GDPR and the Data Protection Act 2018 give you these rights, and in Ireland the GDPR does:
- Access: you can ask whether we hold data about you, and for a copy of it.
- Correction and deletion: you can ask us to correct it or to delete it.
- Restriction, objection and portability: you can ask us to use it less, object to how we use it, and ask for what you gave us in a form you can take elsewhere.
- Withdrawing your consent: for your photo, by not giving another one. We keep nothing of an earlier one.
Write to hello@backincolor.com. It costs nothing, and we answer within one month.
You can also complain to the regulator where you live. In the United Kingdom that is the Information Commissioner's Office (ICO), at ico.org.uk. In Ireland it is the Data Protection Commission, at dataprotection.ie. You do not have to come to us first.
Washington consumer health data
Washington's My Health My Data Act may count a photo of your face, and the colors measured from it, as consumer health data. This is what we do with them:
- What we collect: the small copy of your photo and the colors of your skin, eyes and lips, only after you agree on the screen before the photo.
- Why: to work out your colors. Nothing else.
- Who receives it: OpenRouter and the company that runs the computer model: Amazon Web Services or Google Cloud for Claude (made by Anthropic), Google Cloud for Gemini (made by Google), as described above.
- What we keep: nothing. It is not stored, sold or used for advertising.
- Your rights: you can ask whether we hold any of it, ask us to delete it, and withdraw your consent, by writing to hello@backincolor.com.
Children
The app is for adults. We do not knowingly collect anything from anyone under 18.
Changes
If this page changes, the date at the top changes with it.