Legal

Privacy Policy

Last updated: October 28, 2026

The short version

  • One policy for every SanFlorence app. Each section covers a feature. If an app doesn’t have that feature, the section doesn’t apply to it.
  • Most apps need no account. Your photos, AI results and chat history are saved only on your device. heya is the exception: if you sign in with Apple, your library, profile and AI previews sync to your heya account, and you can delete it in the app at any time. Lists you make in heya stay private unless you choose to publish them. In DIY Decor AI, if you share a list, a copy of it goes to an unlisted link until you stop sharing (Section 04).
  • AI features send what you submit to Google (Gemini API) to create your result. It passes through our secure gateway, which doesn’t keep it. heya saves only the AI previews you make, to your account.
  • Free versions may show ads from Google and its partners, such as Meta. They’re shown only after any consent the law requires, and tracking happens only if you allow it. Subscribers see no ads.
  • We measure our own Meta ads. If you came from one of our ads on Facebook or Instagram, Meta can learn that you installed the app. In the EEA, UK and Switzerland that happens only after you agree. Elsewhere it doesn’t use your advertising ID unless you allow tracking, and US residents can opt out in the app’s privacy settings.
  • We count which features get used, with Google Analytics for Firebase, so we know what to improve. It never includes your photos or what you type, and in the EEA, UK and Switzerland it runs only if you agree.
  • We don’t sell your personal information, and we don’t train AI models on your content.

01 — Who we are & what this covers

SanFlorence Digital LLC (“SanFlorence,” “we,” “us”) is a small iOS studio in California, USA, and is the data controller for the information described here. This policy covers every app we publish, now and in the future (the “Apps”), and the website sanflorence.com. What we collect depends on which app and features you use, and each app’s App Store privacy label shows which categories apply to it. Most Apps don’t require an account, and we don’t ask for your name or contacts. heya, our home decor app, offers an optional account (Section 04). Contact: hello@sanflorence.com.

02 — Photos & camera

If an app offers photo features, you can take a photo or pick one from your library. iOS asks for permission first. The app reads only the photos you pick, or the ones you allow with limited access, and never scans your library. Saving a result uses “add photos only” access, which can’t see your existing photos. A photo leaves your device only when you use it with an AI feature (Section 03) or, in heya, when you add it to your profile, or in DIY Decor AI, when you share a list that includes it (Section 04). You can change permissions in iOS Settings → Privacy & Security.

03 — AI processing

If an app offers AI features, such as generating images, designs, plans, instructions or cost estimates, answering questions in an AI chat, or rewriting or translating text, it sends what you submit to Google’s Gemini API. That can be a photo, your text, and earlier messages in the chat for context. The result comes back to your device.

  • Content is sent only when you use an AI feature. It travels through our gateway, which runs on Cloudflare, forwards it to Google and sends the result back. The gateway doesn’t store your photos, prompts or results, and we don’t look at them. The one exception is heya: when you make an AI preview of your room, the room photo goes to Google and isn’t kept, but the preview that comes back is saved to your heya account (Section 04). heya also sends the photos and words of a list you choose to publish to Gemini for an automatic safety check (Section 04).
  • Stopping abuse. The gateway uses Apple’s App Attest on iPhone, or Google Play Integrity on Android, to check that requests come from a genuine copy of the app on a real device. It keeps an anonymous key for your device and a count of its AI requests each day, so it can apply daily limits and block misuse. In heya, these counts, including how many of your free AI previews you’ve used, are kept against your account’s random ID instead. These records contain no photos, text or contact details. On Android, Google Play checks your device and app under the Google Privacy Policy and tells us only whether they passed. Cloudflare’s logs briefly record technical details such as your IP address (Cloudflare Privacy Policy).
  • Google processes this content under the Gemini API Terms and the Google Privacy Policy. Google may keep requests for a limited time to detect abuse. Depending on the service tier, Google may also use them to improve its products, and human reviewers may read them. Please don’t submit sensitive information, such as health details, ID documents, or other people’s faces without their consent.

04 — Accounts & sync

If an app offers an account, as heya does, you can sign in with Apple (or Google, where heya offers it) to keep your library on every phone and to make AI previews. Signing in is optional: without it, heya keeps everything on your device and its AI features are off.

  • What we get when you sign in. With Sign in with Apple: a random user ID for heya, your email address (or an Apple relay address if you choose Hide My Email) and, the first time only, the name you choose to share. With Google, where heya offers it: your Google account ID, email address and name. We never see your password, and we can’t access anything else in your Apple or Google account.
  • What we store. Your account (name, email, and whether you use Apple or Google); the profile you choose to fill in (display name, @handle, city, bio, profile photo and up to six photos of your home); your style, budget and region choices from onboarding; your library (saved pieces, likes, the creators you follow, the lists you copy, and the lists you make, with your own photos, piece names, prices and shop links); and the AI previews you make. It’s stored with Cloudflare (D1 database and R2 file storage). Your profile, lists and photos aren’t shown to other people unless you publish them. Until then they’re kept at random, unlisted links that only the app uses. Sharing a list that isn’t published sends its name, pieces and links as a message, through your phone’s share sheet; nothing extra is uploaded.
  • Room photos. Photos you use to read a room or make a preview go to Google’s Gemini API (Section 03) and aren’t kept on our servers. Only the finished preview is saved to your account.
  • Staying signed in. The app keeps your sign-in token in your phone’s secure storage (the iOS Keychain or Android Keystore). We store only a scrambled (hashed) copy of it. It lasts up to 180 days, and signing out ends it.
  • Google user data. heya uses the information it receives from Google only to create your heya account, sign you in and show your name. We don’t use it for advertising, we don’t sell it, we don’t use it to train AI models, and we share it only with the provider that runs heya’s servers (Cloudflare). heya’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  • Shared lists in DIY Decor AI. DIY Decor AI has no account. If you tap Share on one of your lists, the app uploads a copy of it to Cloudflare (D1 database and R2 file storage) and gives you a link at share.sanflorence.com. The copy holds the list’s name, its designs, the products and links in it and, only if you choose to include them, your “before” room photos. Anyone you send the link to can open it. It isn’t listed anywhere, and search engines are asked not to index it. To stop abuse, we keep a scrambled code that lets only your phone change or stop the share, your device’s anonymous key, and simple counts such as how many times the page was opened. Tap Stop sharing or delete the list, and we remove the page and its photos from our servers straight away.
  • Publishing lists (heya). When heya lets you publish, a list stays private until you choose to publish it. If you do:
    • What becomes public: the list (its name, note, room and style, its pieces with their photos, names, prices and shop links, and its cover), plus your public profile: display name, @handle, profile photo, city and bio. Anyone can see them in heya and on the web at heya.sanflorence.com, they can be shared and saved by others, and search engines may index them. Counts such as likes, followers and views are public too.
    • Safety checks: before anything is shown to others, its photos and words are checked automatically by Google’s Gemini API for things like nudity, violence, hate, scams and personal details. We keep the result of each check (not a copy of the content), so the same photo or text isn’t checked twice.
    • Reports and blocks: if you report a list or a person, we keep who reported it, the reason and any note, to review it. If you block someone, we keep that so their content stays hidden from you, and yours from them. We keep a log of moderation actions, such as removing a list or banning an account. A report from the web is checked by Cloudflare Turnstile, which looks at technical signals from your browser to tell people from bots (Cloudflare Privacy Policy).
    • Unpublishing: unpublish or delete the list in heya and it stops being public straight away; its link then says the list is no longer available. Copies other people saved to their own heya, and pages already stored by search engines, may stay with them for a while.
  • Deleting your account. In heya, go to Your profile → Delete account, or email us. This deletes your account, profile, photos, lists (published ones too), saved pieces, AI previews, blocks, reports you made and sign-in details from our servers straight away, on every phone. We keep only how many of your free AI previews you’ve used, stored under a one-way code made from your Apple or Google sign-in ID (never the ID itself), so deleting your account and signing up again doesn’t reset your free previews. Deleting your account doesn’t cancel heya Pro (Section 08). You can also remove heya’s access in your Google account settings, or under Sign in with Apple in your Apple Account settings.

05 — Voice input

If an app offers voice dictation, it uses your microphone and Apple’s speech recognition to turn speech into text, after asking your permission. Apple processes the audio, on your device or on Apple’s servers depending on your device and settings, under the Apple Privacy Policy. We never receive the audio. The text is treated like anything you type.

06 — Videos from YouTube

Some apps use YouTube API Services to show tutorial videos and thumbnails. When you view them, your device connects to YouTube and Google, which may collect data such as your IP address and device details. By using these features you agree to the YouTube Terms of Service, and the Google Privacy Policy applies. Our apps never ask you to sign in to YouTube or Google and can’t access your account. You can review apps connected to your Google account at Google’s security settings.

07 — Advertising, consent & tracking

Apps that show ads use Google AdMob to show interstitial ads and optional rewarded ads to free users. Paid subscribers see no ads. Ads can come from Google or from ad networks that compete in Google’s auction, such as Meta Audience Network. Google and these partners use device identifiers (such as the IDFV, and the IDFA if you allow tracking), your IP address, device information and ad interactions to serve and measure ads and prevent fraud. Where you consent, they may also personalise ads. See How Google uses information from sites or apps that use its services and the Meta Privacy Policy.

  • Consent. Where the law requires it (EEA, UK, Switzerland and some US states), the app shows Google’s consent form before ads load, in line with Google’s EU User Consent Policy. If you decline, you may still see non-personalised ads. You can change your choice at any time in the app’s privacy settings, which is also where US residents can opt out of “sale” or “sharing.”
  • Tracking. We use the IDFA only if you tap “Allow” on Apple’s tracking prompt. You can change this in iOS Settings → Privacy & Security → Tracking.
  • Measuring our own ads. We sometimes advertise our apps on Facebook and Instagram. To see which ads work, some apps include Meta’s SDK, which can tell Meta when the app is installed or opened and when a purchase is made, along with device information and, if you allowed tracking, the IDFA. In the EEA, UK and Switzerland it’s switched on only after you agree in the consent form or tap “Allow” on Apple’s tracking prompt. Elsewhere it’s on, but it sends the IDFA only if you allow tracking, so Meta can measure our ads only in aggregate. US residents can turn it off by opting out of “sale” or “sharing” in the app’s privacy settings. Meta processes this under the Meta Privacy Policy.
    • In heya, Meta’s SDK (Meta Platforms, Inc.) receives app installs, app opens and purchases, and a few events: signing up (and whether with Apple or Google), viewing or saving a piece (with the piece’s heya ID), reading a room (the room type and how many pieces were found), making an AI preview (the style and how many pieces) and publishing a list (how many pieces). It also gets device information such as model, iOS version, language and country, and the IDFA only if you tap “Allow” on Apple’s tracking prompt. It never gets your name, email, photos, lists or anything you type.
    • To stop it, turn off Settings → Privacy → Share app activity with Meta in heya, and to stop tracking, go to iOS Settings → Privacy & Security → Tracking.

08 — Purchases, subscriptions & credits

Apps with subscriptions or in-app purchases use Apple’s In-App Purchase, so Apple handles payment and we never see your card details. We use RevenueCat to unlock and restore purchases. It receives an anonymous app user ID, your purchase history and basic device information such as model, iOS version, country and IP address (RevenueCat Privacy Policy). Rewarded ads can grant in-app credits.

heya Pro is a yearly subscription bought through Apple. heya doesn’t use RevenueCat. Instead, Apple sends our server a signed record of the purchase, and later App Store Server Notifications when it renews, expires or is refunded. We store that subscription record with your heya account: Apple’s transaction IDs, the product, whether it’s a test or real purchase, the expiry date, any refund, and a random purchase code the app creates. We never see your card or Apple Account details. If you delete your heya account, the subscription carries on until you cancel it with Apple. We keep its record, no longer linked to you, so you can restore Pro if you sign in again.

09 — Affiliate links

Some apps suggest products you can buy, such as “Shop this look” in DIY Decor AI. Product links in DIY Decor AI may be affiliate links: if you buy something after tapping one, we may earn a commission, at no extra cost to you. Today that means the Amazon Associates Program, and we may add other retailers’ programs later. As an Amazon Associate, we earn from qualifying purchases.

Tapping a product link opens the store’s website or app. The link carries only the search words, a price range and our affiliate tag. From there, the store handles your visit and any purchase, and uses its own cookies and tracking to credit the sale, under its own privacy policy (for Amazon, the Amazon Privacy Notice). We don’t share your personal data with the stores, and they don’t tell us who you are. We see only totals, such as how many items were ordered.

In heya, the pieces in heya’s own library link to Amazon, and those links are Amazon Associates affiliate links with heya’s tag (heyaapp-20). If you buy after tapping one, SanFlorence Digital LLC may earn a commission, at no extra cost to you. As an Amazon Associate, SanFlorence Digital LLC earns from qualifying purchases. The link opens Amazon, where the Amazon Privacy Notice applies, and it carries only the product and our tag, nothing about you. Links that people add to their own lists go wherever they point, and may carry that person’s own affiliate tags.

10 — Notifications

Some apps send local notifications, such as a reminder that a trial is ending or that you have credits left. They’re scheduled on your device, with no push server, and only if you allow them. You can turn them off in iOS Settings → Notifications.

11 — Support & reports

When you email us, or use an app’s “Report a Concern” option (which drafts an email to us), we receive your email address, your message and anything you include. You see the whole email before sending. We use it to reply, review reported content and prevent abuse.

12 — On-device storage, analytics & diagnostics

  • Photos, AI results and chat history are stored only on your device. You can delete them in the app, and deleting the app removes them. In heya, if you sign in, your library and AI previews are also kept in your account until you delete it. In DIY Decor AI, a list you share is copied to our server until you stop sharing it (Section 04).
  • Free credits are tracked in the iOS Keychain. This record contains no personal content, and iOS may keep it after you delete the app, so free credits don’t reset.
  • App usage analytics. If an app uses Google Analytics for Firebase, it tells Google which features you use: for example, which tool you opened, whether a design finished, which screens you visited, whether you’re on a free or paid plan, and how many days a week you open the app. It also sends a random app ID and basic device details such as model, iOS version, app version, language and country (worked out from your IP address). It never includes your photos, the words you type, your chats or your name. We look only at totals, to learn which features people love and which need work.
    • In the EEA, UK and Switzerland, the app doesn’t save an analytics ID or connect your activity until you answer Google’s consent form (Section 07), and then only if you agree. You can change your choice any time in the app’s privacy settings.
    • Elsewhere, Google may also use this data to measure ads, and to personalise ads only if you tap “Allow” on Apple’s tracking prompt.
    • Google processes it under the Google Privacy Policy (see also Privacy and Security in Firebase).
  • Remote settings. If an app uses Firebase Remote Config, it downloads small settings from Google, such as which stores “Shop this look” links to, so we can change them without an app update. It checks when you open the app, at most once an hour. Google receives a random installation ID, your IP address and basic details such as app version, language and country, but nothing you create or type.
  • Diagnostics. If you share analytics with developers in iOS Settings, Apple may send us anonymous crash reports. The ad and purchase services above may also collect technical diagnostics. We use these only to fix problems.

13 — Mailing list & website

We run a waitlist for our apps. If you sign up, we collect the email address you enter and, optionally, your Instagram handle, which we use only as a second way to reach you if you win a giveaway. It’s an ongoing list: we use it to announce new apps, run giveaways and contact winners, occasionally and only about SanFlorence. We do not share these details with advertisers, we do not sell them, and we do not email you on anyone else’s behalf. The list is open only to people aged 18 or older.

Leaving the list. You can opt out at any time. There is no automated unsubscribe link. Instead, reply to any email we send you or email hello@sanflorence.com. We process opt-outs by hand, normally within a few days and always within 30 days, and leaving also withdraws you from any giveaway not yet drawn.

Entries are stored in a private Google Sheets spreadsheet that only we can access. We keep your entry until you leave or we retire the list. When you opt out, we delete your details but keep a minimal record that the address opted out, so we don’t add you back by mistake. You can ask us to delete that record too.

This website is hosted on GitHub Pages and loads fonts from Google Fonts, so both receive your IP address. We use no analytics or tracking cookies. Your browser stores only your theme choice and whether you’ve joined the waitlist. The contact form simply opens your own email app.

14 — Legal bases & sharing

If you’re in the EEA, UK or Switzerland, we rely on these legal bases under Article 6 of the GDPR:

  • contract, to provide the features you use, including your heya account, sync, heya Pro and publishing lists;
  • consent, for personalised ads, the IDFA, ad-related device storage, measuring our Meta ads, app usage analytics and the mailing list;
  • legitimate interests, for non-personalised ads that fund free versions, fraud and abuse prevention, safety checks and moderation of published content, security, diagnostics, remote app settings and support; and
  • legal obligation, where the law requires us to keep or disclose data.

We share data only with the providers named above: Google (including Firebase), Cloudflare, Meta, RevenueCat, Apple and GitHub. We also share it when the law requires, or as part of a sale of our business. We don’t sell personal information for money. Some US state laws treat personalised advertising as a “sale” or “sharing” of data, and Section 07 explains how to opt out.

15 — Retention & international transfers

On-device data stays until you delete it or the app. heya account data stays until you delete your account. We then delete it from our live systems straight away, and any copy in Cloudflare’s automatic database backups is overwritten within 30 days. Sign-in sessions expire after 180 days. A list shared from DIY Decor AI stays online until you stop sharing it or delete it. A list published in heya stays public until you unpublish it, delete it or delete your account. Safety-check results, reports and the moderation log are kept as long as we need them to keep heya safe and deal with abuse. heya Pro subscription records are kept while the subscription lasts and afterwards as long as tax and accounting rules require. Anonymous device keys and daily AI counts may remain after you delete your account, but they can no longer be linked to you. The gateway’s anonymous request counts are kept only as long as we need them to apply limits and prevent abuse. We keep support emails and reports only as long as we need them to resolve the matter or deal with abuse. Third parties keep data under their own policies. We and our providers are based in the US. Transfers from the EEA, UK and Switzerland are protected by Standard Contractual Clauses or, where a provider is certified, the EU-U.S. Data Privacy Framework.

16 — Your rights

EEA, UK & Switzerland. You can access, correct, delete or export your data, restrict or object to how we use it, withdraw consent at any time, and complain to your local data protection authority.

California & other US states. You can learn what personal information we collect, which may include identifiers, account details such as your name and email (heya), purchase history, ad and app activity, photos you submit and approximate location from your IP address. You can also ask us to delete or correct it, opt out of “sale” or “sharing” for targeted ads (Section 07), and appeal our decision on your request. We won’t treat you differently for using these rights.

How to ask. Email hello@sanflorence.com. To verify your request, we may ask you to confirm it from the same email address or give purchase details. Most Apps have no accounts, so we may be unable to link anonymous IDs to you. If so, we’ll tell you how to manage that data on your device or with the provider. We reply within one month (GDPR) or 45 days (US laws). Most app data is on your device, so you can delete it yourself at any time. In heya, you can delete your account in the app, and we’ll send you a copy of your account data if you ask.

17 — Children

The Apps are not directed to children under 13, or under 16 in the EEA and UK. We do not knowingly collect their personal information, in line with COPPA and similar laws. If you believe a child has given us data, email us and we’ll delete it.

18 — Security & changes

We keep your content on your device, store only anonymous usage counts on our gateway (and, for heya accounts, your account data with Cloudflare, with sign-in tokens kept only as hashes), use encrypted connections (HTTPS) to providers, and limit access to our accounts. No system is perfectly secure. If a breach affects your data, we’ll notify you and the authorities as the law requires. When we change this policy, we’ll update the date above. For material changes, we’ll also give notice in the Apps or by email before they take effect.

19 — Contact

Questions or privacy requests: hello@sanflorence.com, SanFlorence Digital LLC, California, USA.

← Back to home