Face Data and Photo Processing
Data accessed. When you choose to take or select a photo, Toniva temporarily accesses the photo pixels. Apple Vision, running on the device, returns one face bounding rectangle, head-angle values (yaw, roll, and pitch), a relative capture-quality value, facial landmark points that outline the eyes, pupils, brows, nose, lips, and jawline, and a person mask that separates the person from the background. Toniva uses these only to find small skin areas on the cheeks, forehead, and chin, the iris and eye-white areas, the lips, the visible hair, and bright neutral background areas, and samples color values there. The eye-white and background samples are used to estimate and balance the color of the light. Toniva does not collect a name or identifier from the photo, create a face template or face embedding, perform facial recognition, use Face ID, or infer identity, health, ethnicity, age, gender, or attractiveness.
Use and purpose. This face data is used only to perform the personal-color analysis requested by the user: checking that one suitable face is visible, evaluating and balancing lighting, sampling skin, hair, eye, and lip colors, and calculating a cosmetic undertone, depth, contrast, and color-family estimate.
Storage and retention. Photo pixels, the face bounding rectangle, head angles, capture quality, facial landmark points, the person mask, and sampled skin, hair, eye, lip, eye-white, and background colors are processed only on the user’s device. They are held only for the duration of the current analysis, normally a few seconds. They are not written to Toniva history, a database, a server, iCloud, Firebase, logs, or backups. The temporary working photo is deleted when the analysis finishes, whether the analysis succeeds or fails. For Color Check, the picker working copy is deleted immediately after decoding. The decoded item photo is held only in memory while that screen is open, hidden when the app becomes inactive, and never written to Toniva history. Live Color Check reads the color of a small area in the center of the back-camera preview in memory; frames are not captured, saved, or transmitted.
Deletion. Face data in memory is released when analysis ends. The temporary working photo is deleted automatically at that time. Toniva does not retain a source photo or face data for the user to delete later. A photo already in the user’s Photo Library is not modified or deleted.
Sharing and third parties. Toniva does not transmit, disclose, sell, or share photos, face data, or sampled face colors with the developer, Apple, Firebase, an AI provider, an analytics provider, an advertising network, a data broker, or any other third party. If the user explicitly taps Share Passport, the iOS share sheet sends only an image showing the color subtype, palette, and metal suggestion to the destination the user chooses. No photo, face rectangle, landmark, head angle, or sampled face color is included. Apple Vision is an on-device iOS system framework; no photo or face data is sent to Apple by Toniva for this processing.
Automated processing. Toniva does not use a cloud, generative-AI, or third-party facial color-matching service. On-device Apple Vision is used only to locate one face, its landmarks, its angle and capture quality, and to separate the person from the background. Toniva’s own deterministic color calculations perform the personal-color match locally. The result is a cosmetic styling estimate, not biometric identification or a medical or biological assessment.
Saved results
If you choose to save a palette, Toniva stores only derived, non-photo result metadata: an optional profile name, color family and the closest alternative, cosmetic undertone, depth, chroma, and contrast estimates, lighting quality and lighting notes, which face areas could be read (not their colors), confidence, palette and favorite color values, your chosen focus, which profile is active, and date. If you choose to save a Color Check swatch, Toniva stores the selected color value, its name and garment type, match grade, and date. This metadata is stored only in local app storage until you delete it, clear all local data in Settings, or uninstall the app. It does not contain the source photo, sampled skin, hair, eye, or lip colors, the face rectangle, head angles, facial landmarks, the person mask, a face template, or biometric identifiers.
Network and third parties
The app has no backend, account, cloud synchronization, third-party analytics SDK, advertising SDK, tracking SDK, or AI service. Firebase Hosting serves only this public policy and the support website; the iPhone app does not send user data to Firebase. Apple may process App Store downloads under Apple’s own terms. After a few helpful moments, Toniva may ask iOS to show Apple’s standard rating prompt; Apple decides whether it appears, and Toniva receives no information from it.
Support communications
The support page prepares an email draft on your device and does not submit form data to Toniva or Firebase. If you choose to send the email, your name, reply address, message, and any details you add are handled by your email provider and received in Toniva’s support inbox. They are used only to answer your request and retained only as reasonably needed for support or legal obligations. You can ask for deletion by replying to the support email.
Permissions
Camera access is requested when you choose to take a selfie for color analysis, use the live Color Check, or open Drape Lab. Drape Lab shows a live front-camera preview but does not capture, save, analyze, or transmit frames. Live Color Check reads only the color under its center ring in memory. Photo-library access is requested only when you choose a photo. Toniva does not request microphone, contacts, location, tracking, or notification access.
Children
Toniva is a cosmetic styling tool intended for adults. It does not knowingly collect personal information from children.
Changes
If a future release introduces cloud processing, analytics, accounts, or payments, this policy and the in-app disclosure will be updated before that behavior ships.
Contact
For privacy or support questions, email erenexxe@gmail.com.
Effective date: 19 October 2026