Privacy Policy

Your email address, if you create an account. You can use the product without one; a guest session has no email attached to it.

Your confirmation that you are 14 or older. Not your birth year, and not your date of birth — the answer to that one question is all the threshold requires, so it is all we keep.

Your questionnaire answers: hair texture, how much styling time you have, and the style you picked.

The photographs you upload: one selfie, and optionally one inspiration image.

Ordinary technical data: which pages you opened, and a salted hash of your IP address used only to cap free generations per network. We do not store raw IP addresses.

Uploaded photographs are deleted within 24 hours of processing. This is enforced by a scheduled job that deletes the files from storage, not merely the database rows pointing at them.

An inspiration image is deleted as soon as the hairstyle has been read from it, usually within seconds. Our database physically refuses to store the extracted style description until that deletion has been recorded.

Generated results are deleted on the same 24-hour schedule unless you press save. Saved results are kept until you delete them or close your account.

An inspiration photo is never used for a face. It is read for hair attributes — length, curl, layering, colour — and nothing else; no facial data, embeddings, landmarks or identity information is extracted or stored from it. (Multi-profile, where an annual subscriber generates previews of a family member or friend from that person's own photo, is a separate feature — see "Multi-profile" below.)

We do not score, rate or rank anybody's appearance. There is no attractiveness metric in this product and no database column that could hold one.

We do not sell personal data, and we do not use your photographs to train models. Our AI provider is used under paid terms that exclude your content from training.

An annual subscriber may add up to four additional faces — family, a partner, a friend — and generate previews from that person's own photo. Adding one requires confirming, at that moment, that the photo is either their own or that they have that person's consent to use it.

We do not verify the identity of anyone added this way; that confirmation is the account holder's own statement. Responsibility for having the right to use a photo rests with the account holder who added it, not with us.

These photos are not on the 24-hour deletion schedule — they are kept so the account can reuse them, and removed when that profile or the account itself is deleted.

Our infrastructure providers process data on our behalf: Supabase (database, authentication, file storage), Vercel (hosting and the AI gateway that routes generation requests), Paddle (payments — they receive your payment details, we do not), and Cloudflare (bot protection).

When you tap a booking or product link, you leave for that partner's site and their own policies apply. We record that the click happened; we do not share your photographs or answers with them.

You can delete any saved result at any time, and you can delete your account, which removes everything attached to it.

You can ask for a copy of your data or its deletion by writing to the address below. Depending on where you live, you may also have the right to object to processing or to lodge a complaint with a supervisory authority.

Coifly is not for people under 14. You confirm you meet that threshold before you can generate anything, and we record the confirmation rather than your age.

Write to privacy@coifly.com and we will respond within 30 days.