Privacy Policy
TryOnMe is for people aged 18 or older. Generated results are private by default. A result becomes accessible to others only when you explicitly create a sharing or voting link. Anyone with an active link may view only the generated images selected for that link; original uploaded photographs are never included. Stop Sharing revokes access through the link immediately, although recipients may retain copies they made.
Public sharing safety / 공개 콘텐츠 안전 관리
Public links expose selected AI-generated faces to anyone with the link. Share only with the permission of every depicted person. Sexual or nude content, violence, privacy violations, harassment, impersonation and illegal content are prohibited. Report an image or its publisher using the image menu. Hide individual images or block a publisher; signed-in blocks persist on your account, while anonymous blocks apply to this browser. Administrators review reports and may hide or delete public copies or restrict repeated violators from public sharing. This does not automatically remove private results, credits or purchases. Contact support@tryonme.fun for review or appeal. 신고는 이미지 메뉴에서 접수하며 개인정보 침해·성적 노출·폭력·괴롭힘·사칭 및 위법 콘텐츠를 금지합니다. 공개 전 사진 당사자의 동의가 필요합니다.
Reports store a pseudonymous reporter identifier, reason, public image reference and timestamps. Only authorized administrators can inspect reports and public copies; the reporter is never disclosed to the publisher. Resolved reports and action history are retained for 180 days after resolution, then removed by scheduled cleanup; unresolved cases remain pending review. Account blocks remain until unblocked or account deletion. An essential, random HttpOnly moderation cookie lasts up to 365 days for anonymous reports and browser blocks; it is not an advertising or analytics identifier. 신고자 식별정보는 게시자에게 공개하지 않으며 처리 완료 후 신고·처리 이력은 180일간 보관합니다.
Account, sessions and payments
Optional Google sign-in provides a Google account identifier, verified email, display name and optional profile image. We use an internal user ID, not your email, for account authorization. Google sign-in alone does not save a result to My Looks; you must select Save My Look. Session cookies authenticate you. Wallet sign-in uses a server challenge and cryptographic signature from Phantom or Solflare. A public wallet address alone does not authenticate you. A wallet may be linked to your Google account after signature verification. We record public wallet addresses, order and transaction references, credit balances and credit events to verify payments and prevent duplicate grants. Solana addresses and transactions are public on the blockchain and cannot be erased by TryOnMe.
Photos and AI processing
Uploaded originals and generated images are stored in private Cloudflare R2; Cloudflare D1 holds account, access and payment records. To create a look, your original photo, a style reference image and editing instructions are sent to OpenAI. Image generation requests use store:false; OpenAI's applicable terms and legal retention may still apply. Photo suitability checks may run in your browser. Private image routes verify your session, payment entitlement and internal account ownership. The R2 bucket and object keys are not public image URLs.
Retention and device storage
Temporary results become inaccessible after 24 hours unless explicitly saved to My Looks. Uploaded originals have a 24-hour access limit and are queued for earlier deletion after successful processing when no active or retryable job needs them. Background R2 deletion is retried on failure, so physical deletion may lag behind access expiry. A saved generated result stays in private My Looks until deletion; its original is not copied there. Your browser may keep a draft original in IndexedDB for reload or retry, normally up to 24 hours, and clears it after generation or photo deletion. Local storage holds style selections and checkout recovery state. Share and voting links expire after one day for guests and seven days for signed-in users. Link, vote and referral records are scheduled for cleanup 100 days after link expiry for fraud and dispute review. Shared image copies are queued for deletion when sharing stops or expires. New rate-limit records use keyed hashes instead of raw IP values and expire after a short period. Historical rate-limit rows remain pending a separately reviewed cleanup.
Voting, referrals and processors
Visitors may vote without Google or wallet sign-in. A random browser vote token is hashed to limit duplicate votes; we record vote selection and time. Share views, try-on clicks, referral attribution and verified purchase eligibility may be recorded for rewards and abuse prevention. Share pages do not expose your original photo, Google profile, wallet address, payment record or internal identifiers. Processors include Cloudflare for hosting/storage, OpenAI for generation, Google for optional sign-in, Solana for USDC settlement, and Phantom or Solflare when you choose those wallets.
Operational analytics
Authorized operators can view aggregate usage and payment reconciliation records. Public landing pages use a separate random first-party HttpOnly cookie, kept for up to 30 days, to estimate browser visitors and page views. We retain a pseudonymous cookie hash, UTC day and month, landing path, and source based on UTM tags or the referring site hostname, never the full referring URL or query. A separate 30-minute random session records only broad device type, browser, operating system, language, country/city estimate and whether the session is signed in; it never stores an account ID, email, photo, wallet, raw IP address, fingerprint or object key. Session and funnel event rows are retained for 30 days; aggregate daily rows are deleted after 400 days by scheduled retention. Optional Google Analytics is loaded only after you choose Allow analytics and receives no photos, names, email addresses, wallet details or IP addresses from TryOnMe event parameters. A browser can clear its site analytics visitor rows and cookie through the analytics deletion endpoint; anonymous aggregate view totals remain. Voting pages use a separate random first-party HttpOnly cookie, kept for up to 30 days, to count browser identities rather than people. We use its hash with the voting link and UTC day for rolling 90-day analytics. Entries older than that are removed by retention cleanup; cleanup failures are retried. no IP, fingerprint, account ID, photo or object key is included. Photo/data deletion in this browser requests removal of this visitor history and clears the analytics cookie. Share deletion removes its visitor rows. Anonymous daily totals may remain without an account or link identifier. Scheduled cleanup retries retention work; administrative screens cannot display user photos. Existing public transaction identifiers are available only to authorized operators for reconciliation, without restoring deleted Google-account associations.
Your choices
Stop Sharing disables a link. When a deletion request is accepted, access to the affected originals, generated images, saved looks and sharing links is blocked immediately. If no processing is active, removal proceeds immediately. If processing is active or its state cannot yet be confirmed, the request remains in progress until it can be safely finalized; we do not label it fully deleted before that point. Stored objects are then removed, with storage failures retried. We cannot retroactively cancel a request already sent to an external processor. A processing state that cannot be confirmed may require support review; elapsed time alone does not establish deletion completion. Delete Photos preserves unused credits. Delete Account disables access to the account resources and unused credits and removes Google profile details when finalization completes. Pseudonymous purchase, credit and referral attribution records may remain for reward reconciliation, fraud review and applicable legal obligations. For access, deletion, or other privacy requests, contact support@tryonme.fun. Accepted account deletion signs out normal account sessions immediately. A random HttpOnly receipt lets this browser check deletion progress without restoring account access. Uploads, generated images, Saved Looks and public image copies are removed through retryable storage cleanup; active or uncertain external AI processing and image writes can delay permanent removal. Already-sent processor requests may not be retroactively cancellable. Google profile information and account associations are removed at safe finalization. Necessary transaction and credit reconciliation records may remain under a retired pseudonymous account identity, without image access. Account deletion does not automatically send a USDC refund; unused account credits may become unavailable, subject to applicable consumer rights. Signing up again after completion creates a new account and does not restore old images, shares, wallet ownership or credits.