Cravely AI — Last Updated: October 3, 2026
Cravely AI operates the Cravely AI mobile application. This policy describes how information is processed to edit photos, verify purchases, maintain credits, and protect the service from abuse.
Information processed
Photos, prompts, and brand content. When you request an image or upscale, the selected photos, reference images, logos, editing instructions, and any brand details included in that request pass through our backend to the relevant image provider. This can include business names, social handles, or contact details you choose to put in an image. We do not receive your entire photo library.
Purchase and account records. We verify Apple-signed app and purchase records and maintain a private service account identified by Apple's app-specific transaction identifier. These records include transaction and product identifiers, subscription periods, credit balances, and redemption history. They do not provide us with your Apple Account password, payment card details, or Apple Account email address. You do not need to create a separate username or password.
Device verification and request records. Apple App Attest verifies requests from the app. We store its public verification key and counters, request identifiers, timing, result status, credit charges, and provider request identifiers. During migration, an app-specific device identifier may be stored to prevent duplicate credit or promotional claims. The backend uses a hash of the request IP address to limit device-registration attempts; hosting providers may also retain operational network logs.
Local information. Project images, preferences, and brand kit details are saved on your device. Some app settings and legacy credit state may also use Apple's iCloud key-value storage. Brand content is transmitted when you include it in an editing request.
Why we process information
We use this information to generate and upscale images, deliver results, verify purchases, restore eligible access, maintain accurate credit balances, refund failed image jobs, provide support, and prevent unauthorized use and duplicate charges. We do not use it for cross-app advertising tracking or sell your information.
Service providers
Information We Do Not Collect
These services may process information in countries other than your own. Their retention practices are separate from the local project storage and temporary delivery storage described here.
Storage, retention, and security
Requests use HTTPS. Provider API keys remain on our backend. Purchase, credit, and verification records are restricted to backend access. Generated and upscaled delivery files are stored in a private bucket and retrieved through short-lived links.
Delivery results are available from our backend for up to 24 hours. Expired result files are removed during subsequent generation cleanup; actual storage may last longer if no new generation runs. Your saved project copies remain on your device until you delete them. Source photos and prompts are forwarded for processing rather than saved in our application database; image providers and hosting services have their own operational retention practices.
Purchase, credit, device-verification, and request records are retained to operate the service, preserve purchase history, investigate abuse, and meet applicable recordkeeping obligations. Deleting the app removes its local storage but does not automatically delete these backend or provider records. No security measure guarantees absolute protection.