Privacy Policy — Color Identifier
Last updated: 17 August 2026
This policy explains what Color Identifier ("the app", "we", "us") does with your data. It is written to be read, not to be survived.
Controller (responsible for your data under the GDPR):
1. The short version
The app has no accounts. You never create one, and we never ask for your name, email address or phone number.
Almost everything stays on your phone. Your scan history, your palettes and your onboarding answers never leave the device.
One thing does leave your phone: the photo you scan. It is sent to our processing service, which forwards it to OpenAI to generate the written description of the lighting and finish. It is not stored on our servers.
We run no analytics, no advertising and no tracking of any kind. There is no advertising ID, no cross-app tracking and no third-party analytics SDK in the app.
2. What we process, and why
2.1 Photos and camera images
What. When you identify a color, the app either captures a photo with your camera or reads one you select from your photo library.
On your device. The color measurement itself — extracting the dominant colors and matching them against the bundled catalogs — runs entirely offline on your phone. No network connection is needed for it, and none is used.
Sent off the device. To produce the written description of the shot (the lighting, the surface finish, a material guess and a colour name), the image is transmitted to our processing endpoint at openai-secure-proxy.vercel.app, which forwards it to OpenAI for analysis. The request contains the image and the colour values already measured on your device. It contains no name, no email address, no account identifier and no advertising identifier.
We do not store the image on our servers. It is held in memory only for as long as the request takes and is then discarded. OpenAI processes it as our sub-processor under its API terms, which state that API inputs are not used to train its models, and retains it briefly for abuse monitoring before deletion.
If this request fails — you are offline, the service is down — the app keeps working. You simply do not get the written description. The colour values and matches are unaffected.
Where the photo file itself lives. The captured image stays in your app's private storage on the device, so your scan history can show a thumbnail. It is not uploaded anywhere else and is removed when you delete the scan or uninstall the app.
Legal basis: Art. 6(1)(b) GDPR — performing the service you asked for.
2.2 Scan history and palettes
Every colour you identify and every palette you build is stored on your device only, in the app's local database. We have no copy and no ability to see it. You can delete individual scans, clear the whole history, or delete palettes from inside the app at any time; uninstalling the app removes all of it.
Legal basis: Art. 6(1)(b) GDPR.
2.3 Your onboarding answers
During setup the app asks what you use colours for, which paint brands and colour formats matter to you, how often you match colours and how much a mismatch has cost you. These answers are stored on your device only and are used to reorder the catalogs and colour formats shown in your results. They are never transmitted.
Legal basis: Art. 6(1)(b) GDPR.
2.4 Purchases and subscriptions
Subscriptions are sold and billed by Apple (App Store) or Google (Google Play). We never see, receive or store your payment details.
To check whether your subscription is active, the app uses RevenueCat, which processes a randomly generated, app-specific user ID together with the purchase receipt, the store country and basic device and app-version information. RevenueCat cannot identify you personally from this, and neither can we.
Legal basis: Art. 6(1)(b) GDPR (managing your subscription) and Art. 6(1)(f) GDPR (our legitimate interest in preventing purchase fraud).
2.5 Support email
If you contact us using the feedback option, your message and email address reach us through your own email app. We use them only to answer you.
Legal basis: Art. 6(1)(f) GDPR.
2.6 What we do not collect
No name. No email address unless you write to us. No location. No contacts. No advertising identifier. No device fingerprint. No usage analytics. No crash analytics. No cross-app or cross-site tracking. The app contains no advertising SDK and no analytics SDK.
3. Permissions the app asks for
PermissionWhyIf you refuseCameraTo read colours live and take photos to analyseYou can still identify colours from photos in your libraryPhoto libraryHandled by the system photo pickerNothing else is affected; the app never gets access to your whole library, only to the picture you pick
The app deliberately declares no media storage permission on Android — it uses the system photo picker, which grants access to the single image you choose and nothing else. The microphone permission that ships with the camera library is explicitly removed from the app, because the app never records audio.
4. Who else is involved
RecipientWhat they getWhereTheir policyOpenAI (via our endpoint)The photo you scan, and the colour values measured on your deviceUSAhttps://openai.com/policies/privacy-policyVercel (hosts our endpoint)The request, in transitUSA / EUhttps://vercel.com/legal/privacy-policyRevenueCatAnonymous app user ID, purchase receipt, store country, device and app versionUSAhttps://www.revenuecat.com/privacyApple / GoogleYour purchase, billed under their own termsGlobalApple / Google privacy policies
We do not sell your data, and we do not share it with anyone for advertising.
International transfers. Some of these providers process data in the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
5. How long things are kept
Photos sent for description: not stored by us; held in memory for the duration of the request. OpenAI's own retention applies to its copy.
Scans, palettes and settings on your device: until you delete them or uninstall the app.
Purchase records at RevenueCat: for as long as your subscription and the applicable tax and accounting obligations require.
Support emails: until your request is resolved, plus any statutory retention period.
6. Your rights
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. You may withdraw consent at any time without affecting processing that already happened.
In practice, most of your data is not ours to hand over: it is on your phone, under your control. You can view and delete all of it inside the app, and uninstalling removes the rest.
For anything held by our processors, write to us at the address above. You also have the right to lodge a complaint with a data protection supervisory authority in your country of residence.
7. Children
The app is not directed at children under 16 and we do not knowingly process their data. If you believe a child has used the app and provided data, contact us and we will delete what we hold.
8. Security
Traffic between the app and our endpoint is encrypted with HTTPS. Everything the app stores locally sits in the operating system's private per-app storage, which other apps cannot read. No system is perfectly secure, but we keep the amount of data that could ever be exposed close to zero by design: we simply do not collect most of it.
9. Changes to this policy
If we change how the app handles data, we will update this page and the "last updated" date above. Material changes will be announced in the app before they take effect.
10. Contact
efeatdigital@gmail.com