Privacy, in plain language.

What stays on your iPhone

Projects you keep—including local source images, result images, RoomPlan or guided-capture artifacts, depth estimates, and raw depth or confidence rasters—stay in the app’s protected local storage. You can delete a project from Designs or use the iOS share sheet to export a result. FurnishFit does not request Photos-library access. iOS backups and exported copies have their own settings and retention behavior.

What is sent when you start a design

FurnishFit sends the reviewed hero room image; derived architecture, object, and generation masks; bounded room surfaces, openings, dimensions, camera calibration, and capture-quality metadata; Keep or Remove choices; exact Keep identifiers; your style or written brief; request identifiers; and authentication evidence through a Cloudflare-hosted service. Raw LiDAR depth, raw confidence rasters, and on-device relative-depth output stay on the iPhone.

The Cloudflare Llama planner receives a geometry-only room summary, the brief, and Keep identifiers—not the room photo. OpenAI’s pinned GPT Image 2 snapshot receives a generated prompt, four ordered PNG references, a separate alpha edit mask, and one output request. Cloudflare’s Moondream detector receives the composited candidate image and fixed furniture-category queries. FurnishFit’s solver, protection masks, compositor, and validators—not a model—decide whether a result is accepted.

Provider handling

The service uses Cloudflare Workers and Workers AI plus the OpenAI Images edit endpoint. FurnishFit does not bind an R2 bucket, KV store, Durable Object, analytics SDK, or crash SDK to the design graph, and Worker observability is configured off. Cloudflare still processes ordinary network and security metadata needed to deliver and protect the service.

The dedicated OpenAI project has API input/output sharing, feedback sharing, evaluation and fine-tuning sharing, and organization API-call logging disabled. FurnishFit does not claim Zero Data Retention. OpenAI’s published controls state that API image inputs and outputs are not used for training and may be retained for up to 30 days for abuse monitoring; potentially unlawful child-safety content may be retained for manual review.

Service records and lifetimes

FurnishFit does not write room or result image bytes, raw depth, masks, scene documents, free-text briefs, raw AppTransaction payloads, raw App Attest key identifiers, or bearer tokens to its D1 database. It stores pseudonymous verification, request, settlement, and security records needed to protect the one included design.

App Attest challenges are valid for 5 minutes and bearer sessions for 1 hour. A spatial job expires after 30 minutes and becomes eligible for deletion 24 hours later. An included-design lease expires after 15 minutes; terminal lease and provider-spend rows become eligible for deletion after 30 days. Spatial project and operation fingerprints are conditionally deleted after 30 days. Registered App Attest keys are conditionally deleted after 180 days without verified use.

The pseudonymous paid-download principal and one-design settlement lot use a rolling 2,555-day deadline from verified activity and are deleted only after related dependencies clear. Aggregate provider-spend counters currently have no automatic deletion. A daily cleanup at 04:17 UTC removes eligible records after their deadlines; deletion may occur on the next successful cleanup rather than immediately.

Paid-download verification

FurnishFit has no login or user-facing account. The U.S. app price is $2.99, with one successfully completed design included and no In-App Purchase or subscription. At launch, the app obtains Apple’s signed AppTransaction and produces App Attest evidence. The service verifies that evidence before accepting an included design request. Only an accepted result settles the included design; failed, cancelled, timed-out, provider-error, moderated, and validation-rejected requests release the reservation.

Apple processes payment-card details; FurnishFit does not receive them. Apple decides App Store refunds. A verified refund or revocation may end access to an unused included design.

Advertising and tracking

FurnishFit has no advertising SDK, third-party analytics SDK, or App Tracking Transparency prompt. It does not combine app data with data from other companies for targeted advertising and does not share data with brokers. Security and fraud-prevention processing is not used to build an advertising profile.

Your controls

• You review the capture and intentionally start each design before room content is sent.
• You can revoke Camera access in iOS Settings.
• In Designs, use the ellipsis menu and choose Delete design to remove the project’s local images, metadata, and owned capture artifacts together.
• Uninstalling the app removes locally stored projects, subject to iOS backup behavior.

There is no FurnishFit account to delete and no public self-service endpoint for pseudonymous service records. For a privacy question or rights request, email cameronbrady101@gmail.com. Do not email a private room photo. FurnishFit may need the request identifier shown by the app and bounded Apple purchase or security evidence to locate records.

Children

FurnishFit is not directed to children under 13 and does not knowingly collect personal information from children.

Changes

This policy may change when the production data flow, providers, purchase verification, or retention practices materially change. The latest version will remain available here.

Contact

For privacy questions, email cameronbrady101@gmail.com.