Privacy Policy
This Privacy Policy explains what personal data the mugshot.world website and mobile app (the "Service") process, why, who it is shared with, and what rights you have. It also serves as our information notice under Article 10 of the Turkish Personal Data Protection Law (KVKK) and as our transparency notice under the GDPR.
In short
- Signing in is optional. You can use the comparison features without an account. If you sign in with Google, we receive your name, email address and the address of your profile picture from Google; we never see your Google password.
- Your content is yours. People and images you add are tied to your account and are not shown to other users or visitors unless you make a person "Active".
- No ads, no profiling. We do not sell your data or use it for advertising. The mobile app contains no advertising or analytics tools and does not track you across other apps and sites. The website uses Google Analytics for pseudonymous usage statistics only if you allow it (see Cookies).
- Deletion is in your hands. You can permanently delete your account and content at any time: in the app, My Account → Settings → Delete my account; on the website, the "Delete my account" button in the Account window.
1. Data controller and contact
Data controller: mugshot.world. For any privacy question, request or complaint: info.lineapp.store@gmail.com
2. What data do we process?
- Account information
- When you sign in with Google, Google sends us your Google account ID, name, email address and the address (URL) of your profile picture (requested scopes:
openid,email,profile). We do not keep a copy of your profile picture; only its address is stored and the image is loaded directly from Google. We cannot access your password or any other data in your Google account. - Bookmarks
- The people you save as bookmarks.
- "My People" content
- For each person you add: name, height, gender, country, optional birth and death year, short biography, social media usernames, outfit images, outfit names, the style, pose, body and makeup descriptions you choose or type for an outfit, and image editing settings (crop, offset, profile picture framing). On the website, the name field of the new-person form is pre-filled with the name of your Google account; you can change it.
- Images you upload
- When you upload an image, its background is removed automatically on our own server; your image is not sent to a third-party AI service for this. We store the processed image and a copy of the original you uploaded (re-encoded, without metadata such as location/EXIF) for our editing and moderation tools; both are deleted with the outfit.
- Community data
- If you join the Community: your membership status, the time you accepted the rules, the contributions you submit (new person drafts, outfit additions, changes to details or profile pictures, deletion requests), moderator decisions and notes, and an activity log (who did what, when). Your name and email address are not shown to other users. Other signed-in Community members can, however, see unpublished community drafts and outfits awaiting review (see section 4).
- Share previews
- When a share link is opened or shared, our server generates a preview image of the people on it (name, height, outfit image) and keeps it in a cache.
- Reports
- If you report a person: the reasons you select, your note and (if you are signed in) your account.
- Technical data
- Server logs: IP address, request date and time, requested address, browser or app and device type, and error logs.
- Stored on your device
- In the mobile app: your session key (iOS secure storage) and language preference. On the website: your session key, language preference and a few interface preferences (see Cookies).
Data we do not process: The app does not access your location, contacts, microphone or camera, and does not use your advertising identifier. From your photo library it only receives the images you choose.
3. Why we process data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the Service: sign-in, bookmarks, My People, image processing, reviewing community contributions | Performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)) |
| Security, abuse prevention, debugging, keeping the Service running | Legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)) |
| Website usage statistics (Google Analytics) | Consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)); you can withdraw it at any time, see Cookies |
| Legal obligations, requests from authorities, establishing or defending legal claims | Legal obligation and legal claims (KVKK Art. 5/2-ç, e; GDPR Art. 6(1)(c), (f)) |
We do not sell your data and do not use it for advertising or profiling, and we do not make decisions about you based solely on automated processing.
4. Who can see your data?
- Not shown to others: People you add under "My People" start out inactive (called "Passive" on the website). Inactive people are not listed, searchable or shareable and are not shown to other users. Image files are served from unguessable addresses that do not require signing in, so anyone who already has the address of an image could open it.
- Everyone: If you make a person "Active", they become public. Their name, height, details, social media usernames, outfit descriptions and images are shown to all visitors and can be shared by link. If you keep the name suggested from your Google account, that name becomes public with the person. Only add another person's photo or information with that person's permission.
- Other Community members: Signed-in members of the Community can also see unpublished community drafts and outfits awaiting approval.
- Service moderators: For support, to review community contributions, handle reports and enforce the rules, administrators can access all content, including inactive people and original uploads, and the account that made a contribution.
- Our infrastructure providers: Providers that host our servers and storage may technically access data to the extent needed to run the Service.
- Authorities: Where we are legally required to, or on a valid request, to the extent the law allows.
5. Third-party services
The Service interacts with the independent services below. They are subject to their own privacy policies.
| Service | Purpose | What reaches them |
|---|---|---|
| Google (OAuth) | Sign in with Google | You interact with Google directly on the sign-in screen. We only receive the profile information listed in section 2. |
| Google Analytics (website only, if you allow it) | Pseudonymous usage statistics (page views, device and browser type, approximate location) | Cookies and similar identifiers, browser and device information. According to Google, Google Analytics 4 does not log IP addresses. |
| flagcdn.com | Country flag images (web and mobile) | Your IP address, device information and which country flag is requested |
| Wikimedia Commons (website only) | Gemini logo | Your IP address, browser information |
| Google Gemini, ChatGPT, Grok | Independent AI tools we send you to for creating outfit images | The Service does not send data to these tools by itself. The prompt text we prepare (gender, height, age, body, makeup, pose and outfit description; it contains no names) is copied to your clipboard; on the website, the ChatGPT option also appends that text to the ChatGPT address. The mobile app checks whether the Gemini app is installed on your device so it can open it. You decide which photo to upload there and what to do with it; that data is subject to the respective service's policy. |
6. Cookies and on-device storage
- Session cookie: A signed first-party cookie used during Google sign-in; it is required for the security of the sign-in flow.
- Browser storage (website): Your session key, language preference, cookie choice and a few interface preferences (e.g. community view, upload speed measurement) are kept in your browser's local storage. Fonts are served from our own server.
- Google Analytics (website only, only with your consent): When measurement is turned on, the website asks you on your first visit. If you choose “Accept”, Google Analytics is loaded and uses its cookies (e.g.
_ga); if you choose “Decline”, it is not loaded, no request is sent to Google and the site works the same. Your choice is stored in your browser. You can change it or withdraw your consent at any time via the “Cookies” link at the bottom of the page; when you withdraw it, the Analytics cookies are deleted. - Mobile app: The app itself uses no cookies or advertising identifiers. Google sign-in runs in the system browser, which uses the signed session cookie described above. Your session key and language preference are kept in iOS secure storage (Keychain); the session key is removed when you sign out, and stored values may remain in the Keychain after you delete the app.
7. Retention and deletion
- Account and content: Kept while your account is open.
- Deleting your account: Deletion takes effect immediately in the live system: your account record, bookmarks, every person under "My People" and their images (including original uploads and share previews), your community membership and the unpublished community drafts you created are permanently deleted. Backup copies, if any, are cycled out in their regular rotation (within 30 days at most).
- Community contributions: What you added to the shared Community database (published contributions, and additions or changes you made to other people's entries, including outfits added to inactive entries) is part of that database. When your account is deleted it stays, detached from your name and account (anonymised); your account identifier in moderation records is replaced with "deleted". If you want a specific contribution removed, write to us.
- Deleting items one by one: When you delete one of your own people or outfits under "My People", its records and image files are removed as well. Deletions made through the Community go through moderator approval and are kept in the moderation records so that they can be reverted.
- Reports: Kept in our moderation records for as long as needed.
- Server logs: As long as needed for security and debugging (typically a few weeks).
- Google Analytics: According to the retention setting in Google Analytics (14 months at most).
8. Security
Connections are encrypted with HTTPS. In the mobile app, your session key is kept in iOS secure storage. Access to the administration panel is limited to authorised accounts. Uploaded images are checked for type and size and re-encoded. No method is completely secure; in the event of a breach we will meet our legal notification obligations.
9. International transfers
Some services we use (e.g. Google) and our infrastructure providers may process data outside Turkey, for example in the European Economic Area or the United States. Transfers are made with safeguards that comply with applicable law.
10. Your rights and how to exercise them
Under KVKK Art. 11 and, if you are in the EU or UK, the GDPR, you have the right to:
- find out whether your data is processed and request information about it, including the purposes and whether it is used accordingly,
- know the third parties to whom it is transferred, in Turkey or abroad,
- have incomplete or inaccurate data corrected,
- have your data erased or destroyed, and have corrections and erasures notified to third parties that received the data,
- receive a copy of your data (portability),
- object to processing, and object to a result against you that arises solely from automated analysis,
- claim compensation if you suffer damage from unlawful processing.
You can delete your account directly in the app or on the website. For other requests, write to info.lineapp.store@gmail.com from the email address linked to your account; we will verify your identity and answer within 30 days at the latest, free of charge. If you are not satisfied with our answer, you may lodge a complaint with the Turkish Personal Data Protection Board (kvkk.gov.tr) or the data protection authority in your country.
11. Children
The Service is not directed to children under 13 and we do not knowingly collect personal data from them. If we learn that we hold data of a child under 13, we delete it. Users under 18 should use the Service under the supervision of a parent or legal guardian.
12. Changes
We may update this policy. The current version is always on this page and the "Last updated" date at the top changes. We will announce material changes in the app or on the website.
13. Contact
mugshot.world
Email: info.lineapp.store@gmail.com
Help and FAQ: Support · Terms of Use