18 October 2026

TRY A CUT · PRIVACY NOTICE

Who is responsible

Metric Rise FZE LLC operates Try a Cut and is responsible for the data described here. Our registered address and licence number are below. Contact info@metric-rise.com with “Try a Cut privacy”.

Your photo and AI

Choosing a camera or library photo keeps an imported copy on your device. It does not upload it to AI. When you request a look and consent to the named provider, our authenticated server sends the prepared portrait, haircut, colour and enhancement choice to that provider. The current version uses Google’s paid Gemini API over encrypted HTTPS connections. We do not need your whole photo library or automatically switch a failed request to another provider.

Enhancement is on by default and can be turned off before generation. It permits lighting and subtle skin adjustments. The comparison source can also be colour-corrected when generation starts. AI can change facial details. We do not identify people, build a facial-recognition database, or use customer photos for advertising, our own model training or separate experiments without separate permission.

Copies on your phone

Imported photos, saved looks and comparison copies stay in the app until removed. Remove current photo preserves sources needed by saved or pending looks. Delete individual looks in My Looks, or use Settings → Delete my data to remove this device’s saved looks, source photos, previews and preferences together. Exported Photos copies, shared files, device backups and other devices’ photos are separate. We do not provide a cloud photo gallery or restore deleted portraits.

Server retention

Your photo travels over encrypted HTTPS connections. Our server holds the source portrait only in memory while processing your request. It does not save the source to a file, database or server backup. We do not back up source photos or generated images on our server. Recovery exports contain only image-free records. We do not take full-server snapshots.

Access to the generated result expires one hour after submission, or earlier when the app confirms local saving. That confirmation or expiry starts automatic server deletion. If a technical interruption prevents deletion, cleanup is retried. Opening or downloading a result alone is not a save confirmation. The one-hour limit starts with the request, not when generation finishes. Saved looks and their comparison photos remain in the app's local gallery until you delete them.

Access ends at the deadline even if no save confirmation arrives. Cleanup runs while the server is active and on restart; if the server is offline, physical deletion waits until it restarts. Deleting a look requests earlier result deletion. It cannot cancel work already sent to the AI provider.

No app registration; necessary records

The app uses a silent Firebase session, verified Store purchase/acquisition information and Apple App Attest to protect requests and restore allowances. You do not create an app account or give us an email to generate. These identifiers are pseudonymous, not anonymous or a permanent hardware ID. We retain a protected mapping, request hashes, style/color choices, consent revision, status and usage, without portraits in this metadata database. Raw Store proofs and device UUIDs are verified transiently, not retained as profile data.

Detailed request records are reduced after 30 days; a minimal expired-request marker prevents replay. Active or uncertain work remains until settled. Free-allowance records remain while the promotion is supported, so deletion or reinstall does not issue another trial. After that promotion is retired and pending obligations settled, its records can be removed without reopening the retired offer. Purchase period details remain through active or pending obligations, normally then for 90 days after period end; reduced purchase/revocation records last 180 days and duplicate-notification records 30 days. We retain unresolved obligations rather than treating missing accounting as unused allowance.

Recovery copies

The older private-beta service has encrypted image-free SQLite recovery copies in Cloudflare R2, protected from deletion for seven days after upload and then eligible for cleanup. They do not protect the public Firestore database. Managed recovery is enabled for the public Firestore metadata database: point-in-time history for up to seven days and scheduled daily backups retained for seven days. Available history builds over time; enabling the schedule does not confirm a completed backup. Restoration has not yet been verified. These protections do not include photos. Existing restricted recovery copies can retain recently deleted metadata until their retention ends; physical cleanup can be delayed. Completed deletions and expired records must be reapplied before restored data is used. Source photos and generated images are excluded from these recovery copies.

Hosting and public pages

Hetzner hosts our application server in Nuremberg, Germany. The app uses an encrypted HTTPS backend selected for its verified Store environment. The server forwards only the requested processing to the disclosed AI provider. Cloudflare supplies DNS and hosts public legal/support pages; opening a page sends connection information such as your IP address to Cloudflare. It does not proxy the app’s photo uploads. Hosting in Germany does not make Google processing EU-only.

Providers and transfers

We may use different AI models. Before upload, the processing dialog’s Details identifies the company receiving your portrait and the applicable processing scope. The current version uses Google’s paid Gemini API. A material provider or scope change requires renewed permission; an unsuccessful request is not automatically sent to an undisclosed provider.

Our expiry does not delete a provider's safety logs or other retained copies. Processing may take place outside your country, including outside the EEA or UK; we do not promise EU-only storage. The active provider is shown before upload. A future change of provider requires the applicable permission and an updated notice.
Under its paid API terms, Google does not use submitted content or responses to improve its products. It may retain limited safety logs; our result-deletion deadline does not apply to those logs.
Google: https://ai.google.dev/gemini-api/terms
Cloudflare: https://www.cloudflare.com/privacypolicy/
Hetzner: https://www.hetzner.com/legal/privacy-policy/

Optional usage and crash reports

Usage analytics and crash reports are separate options in Settings, both off by default. With analytics consent, Amplitude receives limited events such as app opening and generation success, with an SDK identifier and app/OS information. Automatic capture, location fields and advertising IDs are disabled. We do not attach photos, paths, prompts or receipts. Network services receive connection information such as an IP address. The current Amplitude project uses its US endpoint.

With diagnostic consent, Firebase Crashlytics receives app/device diagnostics and error or crash information. App-reported Flutter errors omit exception messages and keep app code locations; native reports can contain diagnostic stacks. Turning a setting off disables that feature's reporting; Crashlytics also deletes unsent reports. This does not erase data already received. We do not use these services for cross-app advertising or sell personal data.
Amplitude: https://amplitude.com/privacy
Firebase: https://firebase.google.com/support/privacy

Why we process data and purchases

We process a requested preview and manage paid allowances under our agreement with you, with explicit permission before sending a photo to the disclosed AI provider. Optional analytics and diagnostics use separate consent. Service protection and preventing allowance resets are legitimate interests; legal obligations may require specific records. Support messages are used to handle your request.

Apple processes purchases. RevenueCat receives a pseudonymous customer identifier, product/transaction information, subscription status and technical connection information to verify entitlements and restore the same remaining allowance. We do not receive card details or send portraits to RevenueCat. TestFlight purchases use Apple’s sandbox and do not charge real money. The released app’s price and renewal period are shown by Apple before confirmation. RevenueCat: https://www.revenuecat.com/privacy/

Your choices and rights

Use Settings to change optional consents or choose Delete my data. Deletion removes local private content and requests current-session server cleanup; it does not cancel an Apple subscription or erase minimum disclosed usage/purchase records. The device keeps the deletion request and necessary protected authorization until the server confirms it. Local removal can work offline; remote status remains pending or unknown until confirmed. A private receipt reports status for 7 days after acceptance; expired or unknown status does not prove completion.

For records outside that action, including previously sent analytics or separately authorized test copies, email “Try a Cut privacy” to info@metric-rise.com. You may request access, a copy, correction, deletion, restriction or objection as applicable, and withdraw consent without affecting earlier lawful processing. We ask only for information needed to verify the request. Do not initially send a portrait, ID document, card details or access token. Where GDPR applies, the usual response time is one month; we explain any lawful extension. You may complain to your local data protection authority. Mandatory rights are unaffected.

Adults and updates

Use only your own adult portrait. The app is for people aged 18 or over; contact us if a child's photo was submitted. We will update this notice for material changes to providers, storage or data use and obtain new permission where required.

Online version

https://businessphotostudio.com/try-a-cut/en-GB/privacy/

Metric Rise FZE LLC · 262235415888
CWS-1V-001232, 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, Ajman, United Arab Emirates, P.O. Box 4848.
info@metric-rise.com