This explains what the Mosaic iOS app collects, who processes it, how long we keep it, and exactly what goes and what stays when you delete your account. It is short on purpose; every sentence describes what the app actually does.
The controller under the GDPR, and the veri sorumlusu under Turkey's KVKK:
Yunus Çağlıyan — an individual developer. Mosaic is built and published by one person, not a company.
For any privacy request or question: yunuscagliyan97@gmail.com
When you pick a photo of a room, it is uploaded from the app to our server. The server sends it to an AI image model to be edited and stores the result against your account. Both the original you uploaded and the generated image are kept as your history.
The model is Google's nano-banana-2, running on Replicate, a platform based in the United States. Your photo reaches the model through a signed link that expires after 15 minutes. This is the one step where data leaves the European Union, and it is described separately below.
Our own infrastructure — authentication, database, file storage and the API — runs in Google Cloud's europe-west1 (Belgium) region.
| Data | Why | Where from |
|---|---|---|
| Email address | Account identity | Apple or Google sign-in |
| Display name | Shown in the app | Apple or Google sign-in |
| Account id | Every API call is made as it | Created by Firebase Authentication |
| Uploaded room photographs | The input to the model | Your camera or photo library |
| Generated images | The output, kept as your history | Produced by the model |
| Purchase records | Entitlement and credit balance | Apple, via transaction ids |
We never receive payment details. Apple runs the transaction from end to end; all that reaches us is a transaction id, which we ask Apple about. Card numbers, billing addresses and the like never come near us.
The ads SDK also links GoogleAppMeasurement and Google's on-device conversion measurement library. The app never calls them itself, but they ship inside the binary and collect their own identifiers — which is why we name them rather than claim the app carries no analytics.
The image model runs on Replicate, outside the European Union. Every time you generate an image, your room photograph is transferred out of the EU for that step. The transfer is made because it is necessary to perform the service you asked for (GDPR art. 49(1)(b); KVKK art. 9): generating an image requires the photograph to reach the model, and without the model there is no output to produce.
Apple and Google likewise operate global infrastructure and are subject to their own transfer safeguards.
Free accounts see banner, interstitial and rewarded ads through AdMob. Personalised ads use the advertising identifier (IDFA), which iOS only permits once you have allowed tracking in the system prompt.
In the EEA and the UK, Google's consent form is shown first. Declining does not remove ads — it makes them non-personalised. The way to have no ads at all is a subscription.
Your photographs and generated images are stored privately; they have no public address. The app reaches an image through a signed link that expires after one hour, and there is no other route to it.
You can delete your account from inside the app, on the Settings screen. When you do:
If you signed in with Apple, the app also asks Apple to revoke its access, so Mosaic disappears from the "Sign in with Apple" list in your Apple account settings.
Exactly one thing stays: your purchase records, with the account id removed from them. They are a sales record, kept for 10 years to meet tax and accounting obligations. They are also what lets someone who is still paying for a subscription sign up again and recover it with "Restore Purchases".
Deletion cannot be undone. Signing up again gives you a brand-new account with no history.
Your preferences, your favourites list (ids only) and an image cache of up to 1 GB live on your phone alone. None of it is uploaded, and deleting the app removes all of it.
Depending on where you are, the GDPR and/or the KVKK give you the right to:
You can exercise the right to erasure immediately, from inside the app. For anything else, write to the address above. We answer within 30 days. If our answer does not satisfy you, you may complain to the Turkish Personal Data Protection Board under the KVKK, or to the supervisory authority in your country under the GDPR.
Mosaic is not directed at children and we do not knowingly collect personal data from them. If a child's data has reached us, write to the address above and we will delete it.
If we change this policy we will publish it on this page and update the effective date. We will tell you inside the app if a change is significant.