WonderEdit — AI Photo Editor for iPhone

1Introduction

Welcome to WonderEdit ("we," "our," or "us"). This Privacy Policy explains how S Wave Digital LLC collects, uses, discloses, and safeguards your information when you use our WonderEdit mobile application (the "App"). Please read this Privacy Policy carefully.

Our Contact Information

Legal Name: S Wave Digital LLC

Email: hello@s-wavedigital.com

Address: 9225 Bay Plaza Blvd, Suite 417 PMB 1084, Tampa, FL 33619

2Information We Collect

2.1 Personal Information You Provide

Starting with WonderEdit 1.3.4, you can create images, buy credits, and restore purchases without registering a personal account. If you choose to recover an earlier account, we process the sign-in information associated with it:

Email address (for email sign-in or an email shared through Sign in with Apple)
Password (for email sign-in; credentials are hashed and managed by Firebase Authentication)
Sign in with Apple information (the identifier and any name or email Apple shares; we do not receive your Apple Account password)

Without personal registration, Firebase still uses a technical authentication identifier to secure requests. An app-specific identifier derived from a verified App Store transaction connects purchases, credit balances, and restoration. It does not give us your Apple Account email or password.

2.2 Automatically Collected Information

Device Info

Device identifier (IDFV)
Device model
OS version
App version

Usage Data

Credit balance
Subscription status
Number of images generated
Feature usage

Technical Data

IP address (temp)
Auth tokens (JWT)
Error logs
Crash reports

2.3 User-Generated Content

We process the images you choose to provide, the prompts and editing instructions you submit, and the images generated in response. Selected images and generated results may contain faces. We do not scan your entire photo library.

Local Gallery

Starting with WonderEdit 1.3.4, new creations are saved in the app's local gallery. Some edits also keep a local copy of the selected original for comparison. Saving or sharing to Photos or other destinations is a separate user action.

Interrupted Download Recovery

New creations are not continuously backed up to an account cloud gallery. Our server holds a private delivery copy of the generated result until the app confirms a successful local save. See section 5.3 for retention details.

Earlier app versions may store account gallery images in Firebase. Available older cloud images remain accessible through optional existing-account recovery. Downloading an older image does not automatically delete its cloud original.

AI Processing Permission: Before your first AI request, we ask permission to send your selected images, prompts, and editing instructions to Google for generation or editing. See section 4.2 for consent controls.

2.4 Payment Information

We use Apple's In-App Purchase system. We do NOT collect or store your payment card information. Apple processes all payments and provides us only with transaction IDs, purchase confirmation, subscription status, and product IDs.

2.5 Product Analytics

We use Google Analytics for Firebase to understand aggregate product usage, creation reliability, credit exhaustion, and purchase-funnel performance.

Analytics events may include an app-instance identifier, app and device information supplied by Firebase, account state, feature or preset category, model tier, credits used, latency, coarse error category, and checkout step. Starting with WonderEdit 1.3.4, analytics also use a pseudonymous, app-specific identifier derived from a verified App Store transaction to associate activity with the same purchase identity and reduce duplicate user counts. This identifier also connects the purchase wallet; it is not an email address or a hardware identifier. TestFlight and development activity are excluded from normal production analytics collection; explicitly enabled diagnostic tests are marked as test traffic. We do not include prompts, uploaded or generated images, face templates, email addresses, raw transaction identifiers, fraud-prevention device identifiers, or raw error messages in product analytics events. We do not use this information for third-party advertising or cross-app tracking.

2.6 Information We Do NOT Collect

Your full photo library

Precise location

Contacts

Microphone

Health data

Browsing history

2.7 Face Data and Biometric Information

Photos containing faces: The following practices apply across all editing features, not only portrait presets.

The face data WonderEdit processes consists of face-containing photographs that you choose to submit and generated or edited images that may depict faces. Prompts and editing instructions may also describe a person's appearance. We use this content to carry out your requested image transformation, such as a portrait, hairstyle, headshot, outfit, or artistic edit, and to deliver and display the result.

WonderEdit does not identify or authenticate people from their faces and does not extract or store separate faceprints, facial-recognition templates, face geometry, or biometric identity records. We do not sell face-containing images or use them for advertising or marketing.

With your AI-processing consent, selected photos and instructions are sent to Google for the requested processing. The AI model analyzes image content to generate a result. Sections 4.1 and 4.2 identify the recipients and consent controls, and sections 5.1, 5.3, and 6.4 explain storage, retention, and deletion.

3How We Use Your Information

To Provide Services

Account authentication
Image generation
Credit management
Customer support

To Improve Services

Analyze usage patterns
Debug errors
Develop features
Optimize performance

For Security

Prevent abuse
Detect fraud
Protect access
Maintain integrity

4How We Share Your Information

4.1 Third-Party Service Providers

Google / Firebase

Authentication, Processing, Storage & Analytics

Data Shared

Optional account details, technical user IDs, tokens, credit and purchase records, selected photos and instructions in generation requests, generated delivery copies, older cloud images, image metadata, and pseudonymous product-usage events

Image storage: US-CENTRAL1

RevenueCat

Purchase & Subscription Management

Data Shared

App user ID, product IDs, purchase status, subscription status, and StoreKit transaction information

United States

Google Gemini API

AI Image Generation

Data Shared

Selected images, prompts and instructions, and generated results, which may contain faces

Google facilities globally

Apple Inc.

In-App Purchases

Data Shared

Purchase transactions

Global

For WonderEdit 1.3.4, selected photos and prompts pass through our Firebase Cloud Function to the Gemini API. Older app versions may use Firebase AI Logic. Generated results pass through our delivery service before being saved locally. Google therefore processes face-containing images when those images are submitted or generated. Apple and RevenueCat receive purchase-related information; WonderEdit does not send them face-containing photos for purchase processing. WonderEdit does not include image bytes, face templates, or prompts in its product analytics events.

Our configured Gemini project has active billing. Under Google's paid-service terms, submitted content and responses are not used to improve Google's general products. Google separately retains prompts, context, and outputs for 55 days for abuse monitoring and required legal/regulatory disclosures. Authorized Google personnel may review flagged content, and abuse-monitoring data may support policy-enforcement models. See Google's terms and abuse-monitoring policy.

4.2 AI Processing Consent

Before we send personal data to Google Gemini API for AI image generation or editing, we show an in-app permission prompt that explains:

What data is sent: selected images, text prompts, and generation instructions.
Who receives it: Google (Gemini API and Firebase processing and delivery services, as described in section 4.1).
Why: to generate or edit the image you requested.

You can decline. You can also change this permission any time in Settings → AI Privacy. Disabling consent stops future AI requests until you enable it again; it does not retroactively erase content already processed. Use the deletion controls or contact us for deletion requests.

4.3 We Do NOT Sell Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5Data Storage and Security

5.1 Where We Store Your Data

Firebase / Google Cloud Storage: Generated-image delivery copies and older account images are stored in the US-CENTRAL1 region. Database and account records use Firebase.
Google Gemini: Google's terms permit transient storage or caching in countries where Google or its agents maintain facilities; we do not promise US-only Gemini processing.
Your Device: The local gallery is stored in the app's storage. Credentials and preferences use iOS Keychain and app storage. Exported copies and system backups follow your destination and device-backup settings.

5.2 How We Protect Your Data

Encryption

HTTPS/TLS, Firebase-managed credentials, and authentication tokens

Access Controls

Firebase Security Rules, role-based access, short-lived tokens

5.3 Data Retention

Selected input photos in the generation request: Our generation service processes these in memory and sends them to Gemini; it does not persist the input photo bytes or raw prompts in its job database or delivery object, or add them to a new account cloud gallery. Google's separate retention is described below. Some originals are also saved locally for before/after comparison.
Local original photos and generated results, including faces: Kept in the app's gallery until you delete them or delete the app. Deleting an app copy does not delete your original Photos-library image, exported copies, or copies retained in backups.
Private generated-image delivery copy: Kept while awaiting a successful local save and acknowledgement, then removed from active server storage when acknowledgement and cleanup succeed. An unacknowledged result has no fixed automatic expiry, so an interrupted download can recover; it is not an ongoing cloud-gallery backup. Contact us if you want an undelivered server copy deleted.
Older account cloud images: Kept until the relevant cloud image or original account is deleted. Deleting only a downloaded local copy does not delete the older cloud original.
Deleted Google Cloud Storage objects: The bucket's soft-delete policy retains a recoverable copy for seven days after removal from active storage. These copies are no longer served through the normal app gallery or delivery path.
Google Gemini abuse-monitoring records: Google specifies 55 days for prompts, context, and outputs under its abuse-monitoring policy. App-side deletion does not itself delete Google's separately retained records.

Optional account records are kept while the account is active and removed when its deletion completes, subject to the exceptions in section 6.4. Job and purchase records may remain without image bytes or raw prompts to support credit accounting, purchase restoration, refunds, and abuse prevention. The separate purchase wallet is preserved when an optional earlier personal account is deleted. Pseudonymous analytics records follow the configured Firebase retention settings.

6Your Privacy Rights

6.1 Access and Control

AccessCorrectDeleteExportObjectWithdraw AI Consent

Email us at hello@s-wavedigital.com to exercise your rights.

You can withdraw AI processing consent in Settings → AI Privacy.

California (CCPA)

Right to Know
Right to Delete
Right to Opt-Out (we don't sell data)
Right to Non-Discrimination

European (GDPR)

Right to Access
Right to Erasure
Right to Portability
Right to Lodge a Complaint

6.4 Deletion

Delete individual local images in Gallery. To delete an earlier personal account, use:

Settings → Account → Delete Account

Type "DELETE" to confirm. This removes that earlier account's authentication record, profile, cloud images, and account records when cleanup succeeds. If cloud cleanup fails, the account stays active so you can retry. Storage-object removal remains subject to the seven-day soft-delete period in section 5.3. This action does not erase the separate App Store purchase balance, all pending purchase-wallet delivery copies, exported copies, every local gallery copy, or Google's independently retained abuse-monitoring records.

Apple may retain App Store purchase records under its own obligations. A device-only promotional-credit eligibility marker remains in iOS Keychain for fraud prevention. It contains a Boolean and one-way account fingerprint—not an email address, image, or prompt—and is not used for advertising or cross-app tracking.

RevenueCat may retain limited purchase, subscription, and entitlement records under its processor retention requirements so purchases can be validated and restored. Contact us if you want us to submit a separate deletion request for those records.

If you cannot access an earlier account or need help deleting an undelivered cloud image, contact hello@s-wavedigital.com. We will verify the requester's ownership before handling a cloud-data deletion request. Withdrawing AI consent and deleting local images are separate actions.

7Children's Privacy

WonderEdit is NOT intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

COPPA Compliance: If you believe a child under 13 has provided us with personal information, contact us at hello@s-wavedigital.com. We will remove such information under our control from active storage within 48 hours. Storage soft-deletion and third-party records remain subject to sections 5.3 and 6.4.

8Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons.

Material Changes: For significant changes that affect your rights, we will provide at least 30 days' notice before the changes take effect.

9Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:

S Wave Digital LLC

9225 Bay Plaza Blvd
Suite 417 PMB 1084
Tampa, FL 33619

Email

hello@s-wavedigital.com

Response Time: 5-7 business days