Privacy policy
Last updated 29 October 2026
In short
Sfuma processes your photos on your phone. Your photos, your face, your edits and your identity are never sent to us unless you choose to send feedback yourself (see below). The app has no account, no analytics SDK and no ad tracking.
What the app collects
Nothing on its own. The app reads only the photos you choose (through the system photo picker; it never asks for access to your library) and stores edits on your device. The "Network activity" screen inside the app lists every server the app has connected to, so you can check this claim yourself. The one exception is feedback you send.
Feedback
"Send feedback" in the app is optional. Nothing is sent until you press Send, and that screen lists exactly what goes: the photo you are editing, the edited result, your edit settings, the face-detection numbers, your device model and app version, and your email address if you choose to give it. Location data and the camera serial number are removed from photos before they leave your phone. A report carries a random install identifier, not an account or a name.
Files are stored with our storage provider (Cloudflare R2, United States). They are deleted 30 days after the related issue is closed, or 90 days after the report if it was never linked to an issue; the text you wrote is kept. You can delete a report at any time from "My reports" in the app, and the files are removed right away.
Purchases
Purchases are handled by Apple through the App Store. Apple sends us signed notifications of subscription events (renewal, cancellation, refund). Our server verifies them and keeps only daily totals by product, storefront and event type. We do not store transaction identifiers or anything that identifies you.
Recipe links
A recipe you share travels in the part of the link after the "#". Browsers do not send that part to the server; the recipe is decoded only in your browser and the recipient's.
This website
This site is served from our servers in the United States, through Cloudflare. Like any website, server logs hold the request path and IP address briefly. The only cookie is your language preference. There are no third-party scripts, fonts or analytics.
Ads
After the first 30 days, unless you unlock, the app shows contextual ads: no advertising identifier, no tracking prompt, no personalisation.