Colorella Privacy Policy

Who we are

The controller responsible for your data is:

Dumke Ventures UG (haftungsbeschränkt)
Ebersprung 2
16321 Bernau, Germany
Email: tom@colorella.app

Full company details, including our registry entry, are in the Impressum.

The short version

Your colour measurement runs on your phone. The calibration photos are never uploaded. Four features are different, and we name them: the daily look, the Check second opinion, the daily line and the shopping colour names send data to our AI provider to be read. Two of them can send a photo, and only after you have agreed to it (section 2). Your profile is also backed up to our database so it can come back on a new phone (section 3). This website sets no cookies and runs no analytics. The colour test on test.colorella.app works differently and is described in section 7a.

1. What Colorella does with the camera

Colorella takes calibration photos of your face to measure your colouring, and reads garment colours through the camera and from photos you choose. The colour measurement itself happens on your device. The extra calibration frames are deleted as soon as your palette is derived. One photo per measured person is kept on your phone, because your season card and the try-on are built on it. It never leaves the device through this path, and you can delete it at any time in Settings → Measurement → Remove my photo.

2. What leaves your phone, and when

These four features send data to our servers (Google Cloud Functions, running in the United States) and on to our AI provider, OpenAI Ireland Ltd., with processing by OpenAI, L.L.C. in the United States:

• Daily look: the photo you take is downscaled and sent together with your season, your undertone and depth words, your best palette colours and your day count, so the model can read your outfit. The screen says so before the camera opens.
• Check: a colour question is read on your phone and sends no photo. For a question about a design, or a colour question whose photo cannot be read on your phone, up to two photos you choose are downscaled and sent, together with your question, your season, your undertone and depth words and your best palette colours. The camera screen says when a photo goes to our provider.
• Daily line: no photo. Your season, your undertone and depth words, six of your palette colours, and your answers to the in-app questions are sent, because the model has to know your colours to say anything useful about them.
• Shopping colour names: no photo and none of your colour data or answers. The product page's title, the product name, the colour words and the swatch links from the retailer's page you are looking at are sent so the model can name the colours on offer.

The daily look and Check send a photo only after you have agreed to it once: either by continuing past the page before the camera when you measure your colours, which says that a photo goes to our provider for the AI opinion, or by tapping Turn on in the one-time message "Use AI for opinions?". You can stop this at any time in Settings → Your data → AI opinions.

Each of these requests also carries our random user ID (it contains no name or email). We do not store the photos on our servers, and our provider does not use them to train its models under our API agreement. Nothing is sent when you are offline or when the day's limit is spent.

To stop automated abuse of the AI features, each request is also counted against your network's IP address for that day. We store only a scrambled (hashed) code made from the address and the date, never the address itself, together with the date and the number of requests. This counter is not linked to your user ID and is not removed when you delete your account. For free users we also check with RevenueCat that the random user ID belongs to a real installation. This rests on our legitimate interest in protecting the service (Art. 6(1)(f) GDPR).

3. What we keep

• Your measurement: a small set of colour coordinates (CIELAB values) for your skin, hair and eyes, the derived axes, and your colour palette. The coordinates themselves are never sent anywhere. What leaves is the derived summary in section 2, the profile backup below, and, if you correct a colour on the confirm screen, the before-and-after value of that correction in section 4.
• Saved scans: the colour read from a garment and its verdict, never a photo of the garment. Stored on your device.
• Your kept photo: the one calibration photo described in section 1, stored on your device only.
• An account without your name: we create an anonymous sign-in (Firebase Authentication) with a random user ID so your purchases can be restored. It contains no name, email or password unless you later provide one.
• Your profile backup: so your colours and your days come back on a new phone, a copy of your profile is saved to our database (Google Cloud Firestore, United States) under your random user ID when you sign in, after a daily session and after a measurement. It holds your season and runner-up, your undertone, depth and contrast values, your gold or silver verdict, your answers to the in-app questions (for example your age range, hair and eye colour, vein colour, how your skin reacts to sun, and your sizes), your Check questions with their verdicts, your this-or-that picks, the tip headlines you were shown, how often you use features, and your daily plans. It never contains a photo, a name or the raw colour coordinates.

If you measure someone else, their photo and their measurement are stored on your phone the same way yours are, under their own profile, and deleting the profile deletes their photo with it. If they have a daily plan, it is included in the profile backup under their own profile ID. Ask them first, and do not send someone else's photo to the AI features without telling them.

4. Analytics in the app

We collect usage analytics in the app: which screens are used, whether a measurement completed, how features perform. These events go to our own event store in our database (Google Cloud Firestore, United States) and to PostHog. They carry a device ID, our random user ID, and, so we can tell whether the engine is getting people's colours right, your season, the colour values you corrected on the confirm screen, and the answers you gave in the intake questions. They never contain a photograph.

Usage data is switched on when you continue past the app's first screen, by tapping Find my colors or by swiping to the next page, under the line "By continuing you agree to our Terms and Privacy Policy". You can turn it off at any time in Settings → Your data → Share anonymous usage data. From that moment our event store, PostHog and the Meta events described below stop.

We also use PostHog (hosted in the EU) to see how people move through the app: the same events, plus session recordings of the screens while usage data is on. In those recordings every image, every photo and every text field is masked, so your face and your photos never appear in them.

The app also contains Google's Firebase Analytics SDK (Google Analytics for Firebase). It starts when the app opens and can record standard app events, such as the first open, the start of a session and the screens viewed, together with an app-instance identifier it stores on your device, and send them to Google. The Share anonymous usage data switch does not control it. It never receives a photograph, your measurement or your answers.

Ad measurement (Meta)

We advertise Colorella on Facebook and Instagram. To learn which ads bring people to the app, the app includes Meta's SDK. It sends Meta that the app was installed and opened, that you finished your first colour reading, that a paywall was shown, and that you started a subscription or trial with its price, together with Meta's anonymous app ID. It never sends a photograph, your measurement, your palette or your answers. Install counts also reach Meta through Apple's SKAdNetwork, which does not identify you.

Your device's advertising identifier (IDFA) is only shared, and your activity only linked to other companies' apps and websites, if you tap Allow in Apple's tracking prompt, which the app shows after your first result. You can change that answer at any time in iOS Settings → Privacy & Security → Tracking. RevenueCat passes your subscription events, including renewals, to Meta for the same measurement.

Meta's SDK is part of the app and starts when the app opens. On every start it contacts Meta's servers to load its settings, which shows Meta your IP address and device type. If your phone's region is set to a country in the EU, the EEA, the UK or Switzerland, or no region is set, the app sends Meta no events about you. Everywhere else it only sends the events listed above while Share anonymous usage data is on.

5. Purchases

Subscriptions and purchases are processed by Apple's App Store or Google Play and managed through RevenueCat, which receives your purchase history and our random user ID, never your measurement. Cancellation happens in your store account, on the same screen as every other subscription you have.

6. Shopping links

The in-app shopping browser opens retailers' own websites. Some links are affiliate links: when you tap a retailer link it passes through Sovrn Commerce's redirect, which sees your IP address, your browser details and the retailer you are going to, and may set its own cookie in the in-app browser. Sovrn is responsible for its own cookie under its privacy policy (sovrn.com/legal/privacy-policy). If you buy something, the retailer may pay us a commission. This costs you nothing, is disclosed in the app whenever it applies, and has no influence on any colour verdict. The verdict code cannot see which retailer pays. Retailer websites you browse have their own privacy policies.

7. This website

colorella.app is a static site hosted by Cloudflare, Inc. (Cloudflare Workers). It sets no cookies, runs no analytics and loads nothing from third parties; even the fonts are served from our own domain. When you visit, Cloudflare processes your IP address and standard request data (browser type, requested page, timestamp) as technically necessary to deliver the site and defend it against attacks, and your browser may send Cloudflare a technical report if a page fails to load. This is based on our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). We do not receive or store personal server logs ourselves. Because this website stores nothing on your device, it shows no cookie banner.

7a. The colour test on test.colorella.app

The colour test is a separate website where you answer questions, add a photo and can buy a colour guide or the Colour Club. It works differently from the app, so here is exactly what happens.

• Your answers (for example your age range, hair and eye colour, and what you want help with) are stored on our servers (Google Cloud Firestore, United States) with a random visitor ID, so we can show your result and prepare your guide.
• Your photo: your browser first checks that a face is visible. This check runs on your device, using face-detection software your browser downloads from jsDelivr (cdn.jsdelivr.net) and Google (storage.googleapis.com), which see your IP address and browser details. The photo is then uploaded to our server (Google Cloud, Belgium) and sent to our AI provider, OpenAI Ireland Ltd. (with processing by OpenAI, L.L.C. in the United States), to estimate your colouring. OpenAI does not use it to train models under our API agreement and keeps it for at most 30 days for abuse monitoring. We keep your photos, including the extra photos you add after buying, in a private storage area in the EU (Belgium) so we can look over your result and prepare your guide. They are deleted there automatically after 90 days. When you buy, and when you add photos after buying, a copy of your photos, your answers, your result and your email address is also emailed to our order mailbox through Resend, Inc. (United States) so the guide can be made. Emails to our addresses are forwarded by Cloudflare's email routing to our mailbox, which is hosted by Apple (iCloud Mail).
• Your email and first name, when you enter them, are used to send your result, your guide and, if you buy a subscription, your weekly colour letter. Colour tips and offers (including up to three reminders about your result) are only sent with your permission: in the EU, the EEA, Switzerland and Canada only if you tick the box under the email field; elsewhere we tell you under the email field before you continue. We store what you were shown and your choice as proof. Every email has an unsubscribe link. Emails are sent by Resend, Inc. (United States).
• Printed copy: if you order one, your name and delivery address are passed to our print partner, who prints and posts it, and to the postal service.
• Payments are processed by Stripe Payments Europe, Ltd., and by PayPal (Europe) S.à r.l. et Cie, S.C.A. if you choose PayPal at checkout. Stripe's payment script (js.stripe.com) loads on every page of the test and sets cookies (__stripe_mid, __stripe_sid) that Stripe uses to prevent payment fraud. We receive your name, email, country and what you bought, never your full card details.
• Usage of the test: we record which steps you view and answer, with your random visitor ID, your country and the ad or link you came from, so we can see where people stop and improve the test. This happens for every visitor, whatever you choose in the cookie bar. This data never contains your photo.
• Ad measurement (Meta): the test uses the Meta Pixel and Meta's Conversions API so we can see which Facebook and Instagram ads bring people to the test and to a purchase. When you view the test, leave your email, open checkout or buy, Meta receives that event with your IP address, browser details, Meta's cookie IDs, and, in hashed (scrambled) form, your email address, first name, country and our visitor ID. Meta never receives your photo, your answers or your colour result. In the EU, the EEA, the UK and Switzerland, and when we cannot tell your country, this runs only after you tap OK in the cookie bar; elsewhere it runs from the start. So the purchase can be matched to the ad, we save your IP address, browser details, country and Meta's cookie IDs with your visitor record in our database.
• Session recordings (PostHog, EU hosting): to see where the test is hard to use, we record how pages are scrolled and tapped. In these recordings every photo and image is hidden and every text you type is masked, so your face, your email and your name never appear. PostHog sets its own cookie and local storage. In the EU, the EEA, the UK and Switzerland, and when we cannot tell your country, this runs only after you tap OK; elsewhere it runs from the start.
• Your browser stores your answers, your visitor ID and your cookie choice locally (local storage), so you can continue where you left off. The Meta Pixel sets its own cookies (_fbp, _fbc).
• Changing your cookie choice: clear this site's data in your browser (cookies and site data for test.colorella.app). The cookie bar then appears again on your next visit. If you withdraw consent, the Meta Pixel and session recordings no longer load; what was already collected is not affected.

Legal bases: preparing your result and guide, payment and delivery emails are necessary to perform our contract with you (Art. 6(1)(b) GDPR). Keeping your answers and visitor ID in your browser so you can continue is strictly necessary for the test you asked for (§ 25(2) TDDDG). Colour tips, offers and reminder emails are sent in the EU, the EEA, Switzerland and Canada only with the consent you give by ticking the box (Art. 6(1)(a) GDPR), and elsewhere on our legitimate interest in telling customers about our own products (Art. 6(1)(f) GDPR); you can object or unsubscribe in every email. In the EU, the EEA, the UK and Switzerland, Meta ad measurement and PostHog (usage statistics and session recordings) run only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); elsewhere they rest on our legitimate interest in measuring our advertising and improving the test (Art. 6(1)(f) GDPR). Usage records of the test, Stripe's fraud prevention and the download of the face-check software rest on our legitimate interest in running a working, secure test (Art. 6(1)(f) GDPR). Purchase records are kept to meet tax law (Art. 6(1)(c) GDPR). Colour measurements are used only to work out your colours, never to identify you. The photo screen tells you that your photo is used for your colour test, and choosing to upload it is your explicit consent to that analysis (Art. 9(2)(a) GDPR, see section 9).

How long we keep it: photos 90 days in our storage (deleted automatically); the emailed copies stay in our order mailbox until we delete them. Your answers, result, email, usage records and visitor record (including the checkout details used for ad measurement) stay in our database until you ask us to delete them. Invoices and payment records for 8 years, and our accounting books for 10 years, where German tax and commercial law requires it (§ 147 AO, § 257 HGB). Email us at tom@colorella.app to see, correct or delete your data.

8. What we never do

• In the app, we never upload your calibration photos, and we never store the photos the AI features send. (The colour test website stores your photos for up to 90 days, as described in section 7a.)
• We never sell your personal data for money. Ad measurement with Meta (sections 4 and 7a) can count as "sharing" or "targeted advertising" under some US state laws; see section 15.
• We never use your data to train AI models, and our provider does not train on what we send it under our API agreement.
• In the app, we never link your activity to other companies' apps or websites unless you tap Allow in Apple's tracking prompt (see section 4), and never in the EU, the EEA, the UK or Switzerland. On the colour test website, Meta ad measurement works as described in section 7a.

9. Legal bases

Where the GDPR applies: your account, your profile backup, purchase handling and the AI features you actively use are necessary to perform our contract with you (Art. 6(1)(b) GDPR). App usage analytics (our own event store and PostHog, including masked session recordings) and, outside the EU, the EEA, the UK and Switzerland, Meta ad measurement run on your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you give by continuing past the app's first screen (section 4). You can withdraw it at any time in Settings → Your data → Share anonymous usage data; withdrawing does not affect processing that already happened. The start-up contact of Meta's SDK, Google's Firebase Analytics SDK (section 4), website delivery and protecting our AI features against abuse rest on our legitimate interest in running, measuring and securing the service (Art. 6(1)(f) GDPR).

Colorella measures the colour of your skin, hair and eyes. Photos of your face and colour values like these can count as sensitive data under Art. 9 GDPR. We process them only to work out your colours, never to identify you or to infer anything about your background. Before the daily look or Check first sends a photo to our provider, the app tells you so, and continuing past the page before the camera or tapping Turn on (section 2) is your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time in Settings → Your data → AI opinions; photos are then no longer sent.

10. How long we keep things

On your phone: your measurement, your palette, your saved scans, your looks and your kept photo stay until you delete them or delete the app. On our servers: your account, your profile backup, your event records, your AI usage counters and your purchase records stay while your account exists and are erased when you delete your account in the app. The account does not expire on its own, so if you delete the app without deleting your account first, these records stay until you ask us to delete them. PostHog keeps app events and masked session recordings for the retention period of our PostHog plan. Google keeps Firebase Analytics data for at most 14 months. Photos sent to the AI features are not stored by us at all; our provider is not permitted to use them to train its models, and retains them for up to 30 days for abuse-monitoring purposes only, under our API agreement. The periods for the colour test are in section 7a.

11. Your rights

In the app, under Settings → Your data, you can export the data held in our database and on your phone as a machine-readable file (Art. 15/20 GDPR) and delete everything on your phone. Settings → Account → Delete my account erases your account, your profile backup, your event records and your AI usage counters on our servers, and the data on your device (Art. 17 GDPR). It does not remove usage data already sent to PostHog or the customer record RevenueCat keeps for your purchases; write to us and we delete those by hand. If anything fails, contact us and we will complete it manually.

You also have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and the right to lodge a complaint with a data protection supervisory authority (Art. 77).

Withdrawing consent: where we rely on your consent, you can withdraw it at any time with effect for the future: in the app under Settings → Your data → Share anonymous usage data or Settings → Your data → AI opinions, in iOS Settings → Privacy & Security → Tracking, on the colour test by clearing this site's data in your browser (section 7a), for emails with the unsubscribe link, or by writing to us. Withdrawing does not affect processing that already happened.

Your right to object: you can object at any time to the use of your data, including your email address, for direct marketing such as colour tips and offers; we then stop using it for that. Where we rely on our legitimate interests (Art. 6(1)(f) GDPR), you can object for reasons arising from your particular situation.

You do not have to give us any data. Without a photo we cannot measure your colours, without an email address we cannot send you your guide, and without a payment we cannot unlock paid features; everything else is optional.

Your colour result is worked out automatically, but we do not make decisions about you that have legal or similarly significant effects based solely on automated processing (Art. 22 GDPR).

To exercise any right, write to tom@colorella.app or to our postal address above. The supervisory authority for us is Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany. You can also complain to the authority where you live or work.

12. Who receives data

Processors (they handle data only on our instructions under a data processing agreement): Google Ireland Ltd. / Google LLC (Firebase: authentication, database, analytics, the cloud functions our AI features run in, hosting of the colour test, Google Cloud storage), OpenAI Ireland Ltd., with processing by OpenAI, L.L.C. in the United States (the AI features in section 2 and the photo reading in section 7a), RevenueCat, Inc. (purchase management), PostHog Inc. (product analytics and masked session recordings in the app and on the colour test, EU hosting), Cloudflare, Inc. (website hosting and forwarding of emails sent to our addresses), Resend, Inc. (emails from the colour test, including the order emails in section 7a), Apple Distribution International Ltd. (iCloud Mail, where emails to our addresses, including the order emails in section 7a, are delivered).

Independent recipients (they decide for themselves how they use the data, under their own privacy policies): Apple and Google (App Store and Google Play purchases), Stripe Payments Europe, Ltd. and PayPal (Europe) S.à r.l. et Cie, S.C.A. (payments and fraud prevention on the colour test), Sovrn, Inc. (affiliate link redirects, section 6), and jsDelivr (cdn.jsdelivr.net) and Google (storage.googleapis.com), which deliver the face-check software to your browser on the colour test (section 7a).

Joint controller: for collecting and sending ad-measurement data through Meta's SDK, Pixel and Conversions API we are jointly responsible with Meta Platforms Ireland Ltd. under Meta's Controller Addendum (facebook.com/legal/controller_addendum). Meta is responsible for what it does with the data after receipt. You can exercise your rights against either of us, including with Meta directly.

Our database (Google Cloud Firestore) and the cloud functions behind the app's AI features are located in the United States. Transfers to the United States are covered by the EU-US Data Privacy Framework where the recipient is certified, and otherwise by the EU standard contractual clauses. Write to tom@colorella.app for a copy of the safeguards that apply to a particular transfer.

13. Children

Colorella is meant for people aged 16 and over. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has given us data, write to tom@colorella.app and we will delete it.

14. Security, changes and contact

We protect your data with encryption in transit, access limited to the one person who runs Colorella, and providers with recognised security certifications. The photos from the colour test are kept in a private, access-restricted storage area.

We update this page when what we do with your data changes. The date at the top shows the current version. Questions and requests: tom@colorella.app.

15. Notice for US residents

Depending on your state, you may have the right to know what personal information we collect, to get a copy, to correct it, to delete it, and to opt out of targeted advertising and of the "sale" or "sharing" of your personal information. We collect the categories described above: identifiers (random user ID, visitor ID, email address, IP address, Meta cookie IDs), commercial information (purchases), internet activity (app and test usage), photos you choose to send, and inferences (your colour season). We use them for the purposes described above and keep them for the periods in sections 7a and 10. We disclose them to the recipients in section 12. Meta receives identifiers and purchase events for ad measurement, which some states treat as sharing for targeted advertising.

To opt out in the app, turn off Share anonymous usage data or tap Ask App Not to Track in iOS. On the colour test, Meta ad measurement runs for visitors outside the EU, the EEA, the UK and Switzerland from the start; you can block it with your browser's tracking protection or by blocking cookies for test.colorella.app. For any other request, email tom@colorella.app. You can use an authorized agent; we may ask you to confirm your identity and the agent's authority. If we decline a request, you can appeal by replying to our answer, and we will respond within 45 days. We will not discriminate against you for using these rights. We do not knowingly sell or share the personal information of anyone under 16.