私隱政策 - photo-coach
Ralphel返回首頁

法律

私隱政策

Last Updated: June 30, 2026

Introduction

Welcome to Ralphel (the "App" or "we"). Ralphel is a photography coaching tool that analyses reference photos, benchmarks your own shots against them, and surfaces personal-style insights. This Privacy Policy explains what we collect, how we use and share it, where it is processed, and how you can contact us.

At a glance

  • Accounts: Ralphel uses accounts. We collect your name, email, and a hashed password, and optional two-factor authentication settings.
  • Your content: the reference photos and your own shots that you upload, and images from public Instagram posts you choose to import.
  • Third-party AI processing: we send your images to AI providers through OpenRouter to generate analysis and benchmark results.
  • Essential cookies only: session, sign-in, and language-preference cookies. No advertising trackers.
  • Limited retention: we keep data only as long as needed for the purposes described below.

What we collect

Account information

  • Name, email address, and a hashed password.
  • Email verification status and, if you enable it, two-factor authentication settings.

Content you upload or import

  • Reference photos and your own shots that you submit for analysis and benchmarking.
  • When you use Instagram import, the public Instagram post link you provide and the images and related data we fetch from it.

Generated or technical data

  • Analysis results, benchmark scores, and style insights derived from your content.
  • Log data and diagnostics, including IP address, browser/device information, and error and performance metrics used to keep the App reliable and secure.

How we use information

  • Provide the core service: analyse your photos, generate benchmark comparisons, and surface style insights.
  • Operate your account: authentication, email verification, and two-factor authentication.
  • Safety and reliability: prevent abuse, debug issues, and maintain service quality.

We do not sell your data, and we do not use it for advertising.

Third-party services and cross-border processing

To provide the AI analysis, we transmit your images and related data to third-party AI providers:

  • OpenRouter, which routes requests to underlying model providers.

When you use Instagram import, we fetch data from Instagram's public endpoints to retrieve the post you requested.

These providers may process data on servers outside your region, including in the United States and other jurisdictions. When your data is sent to these services, it is subject to their security practices and terms. We work with providers we believe implement appropriate safeguards.

Where data is stored

  • Account data and your uploaded content are stored on our servers and cloud object storage, which may be operated by our hosting and storage partners.
  • AI processing occurs in the infrastructure of OpenRouter and the model providers it routes to, which may be located outside your region.

Retention

  • Account data: retained while your account is active and deleted (or irreversibly anonymised) after you delete your account, unless a longer period is required for security or legal reasons.
  • Uploaded and imported photos and derived results: retained while associated with your account and removed when you delete the relevant items or your account.
  • Logs and diagnostics: retained for up to 12 months for security, fraud prevention, analytics, and service reliability, then deleted or irreversibly aggregated.

Cookies and tracking

We use essential cookies only: a session cookie, a sign-in ("remember me") cookie, and a cookie that stores your language preference. We do not use third-party advertising trackers. Limited technical logs may be recorded as described above.

Your rights and how to exercise them

Where applicable under the Personal Data (Privacy) Ordinance (PDPO) and other laws, you may request to:

  • Access or receive a copy of your personal data
  • Correct inaccurate personal data
  • Delete your personal data
  • Port your data, where technically feasible

You can manage much of your account data directly in the App, or contact us using the details below. We aim to respond within 40 days as recommended under the PDPO, and we may charge a reasonable fee for repeated or excessive requests as permitted by law.

Children's privacy

The App is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided data, please contact us so we can delete it.

Security

We implement technical and organisational measures to protect information, including encryption in transit, hashed passwords, access controls, and regular security reviews. No method of transmission or storage is 100% secure.

Changes to this Policy

We may update this Policy from time to time. We will post updates on this page and, for significant changes, notify you in-app or through other appropriate means.

Contact us

Completeness and severability

This Privacy Policy describes how the current version of the App handles data. If any provision is held invalid under applicable law, the remaining provisions will continue in full force and effect.