Halo Camera Privacy Policy

Updated: August 12, 2026
Effective: August 12, 2026

Halo Camera is developed and operated by TokFlowLab ("we," "us," or "our"). We value your privacy. This Policy explains how we process personal information when providing photography, video recording, Live Photos, AI photography guidance, Membership & Film, invitation and sharing rewards, feedback, and on-device model features, and how you can manage that information.

Before using cloud AI, please pay particular attention to Cloud AI and Generated or Synthetic Content, Third-Party Services, and Retention. You may disable any cloud AI modules you do not want and use only basic shooting, filters, and downloaded on-device features.

1. How We Process Information

1.1 Camera, Microphone, Photos, Videos, and Work

With your authorization, we use the camera for preview, photography, video recording, and Live Photos; the microphone for video audio and accompanying Live Photo audio; and Photos access to save photos, videos, and Live Photos, read content you select, and display and manage in-app work.

Your work and metadata such as capture time, location, filter, photographer, and aspect ratio are stored mainly on your device or in the system photo library. We do not scan work for advertising, profiling, or facial recognition, do not create a face database, and do not use work to train Halo or third-party models.

1.2 Cloud AI Images and Scene Parameters

When you enable cloud AI modules such as Director, camera position, composition, filter recommendations, or Master Retouch, the app sends the scaled images required for that processing. These may include the current viewfinder image, a selected photo, the original or a filter preview, the initial retouch result, and images needed for generative repair.

Information sent with an image may include:

• the current photographer, style intensity, candidate filters, target aspect ratio, and edit operations;
• device orientation, lens magnification, subject center or bounding box, subject type, and detection confidence;
• distance, angle, depth source, frame time, and other scene geometry used for position or composition;
• the random account identifier, request identifier, and status information needed to return results, avoid duplicate charges, roll back failed operations, rate-limit requests, and maintain security.

Cloud AI requests currently do not send device GPS coordinates as model-analysis parameters. We process this information only to complete photography guidance or retouching you request, settle Film usage, maintain security, and troubleshoot.

1.3 Optional Location Data

The app obtains shooting location only after you enable Save Location and grant location permission. Actual accuracy depends on device capabilities and your Precise Location setting in iOS and may include latitude and longitude, accuracy, timestamp, and a region name obtained through reverse geocoding.

Location is used to write the place and photo metadata to local work or the system photo library. It is not required for basic shooting or cloud AI recommendations. Reverse geocoding is provided by Apple system location services, during which Apple may process the location and network information needed for the query. After you disable Save Location or revoke permission, the app stops subsequent location collection. You must delete or modify location already written to work or the system photo library by editing the relevant item.

1.4 Device Motion and Scene Awareness

To provide the level, shooting-orientation detection, and composition assistance, the app processes device motion, orientation, and necessary scene information. This information is mainly processed locally in real time. When you use a corresponding cloud AI feature, we may send scene parameters necessary for that feature, but not complete raw sensor data or GPS coordinates.

1.5 Membership, Film, and Lifetime-Purchase Entitlements

Basic shooting does not require sign-in. The app creates a random account identifier to associate Film balance, membership tier, lifetime-purchase entitlements, model-download permission, failed-operation rollback, and Apple transaction verification.

To verify purchases, avoid duplicate credits, and handle refunds or revocations, we process signed transaction information from Apple, including product ID, transaction ID, original transaction ID, subscription expiration and revocation status, purchase time, and the App Account Token associated with the random account identifier. We do not receive your Apple Account password or complete payment-card information.

The server stores the random account identifier, Film balance and ledger, membership tier, permanent purchase entitlements, processed transaction IDs, pending reservations, and necessary timestamps.

1.6 Sign in with Apple and the Invitation Center

When you use the Invitation Center, sharing rewards, or redemption features, Sign in with Apple is required. We process the stable account identifier provided by Apple, the name and email you choose to provide (which may be an Apple private relay address), authorization code, and an encrypted refresh token to create and verify a Halo account, restore invitation records across devices, process rewards, and attempt to revoke Apple authorization when you delete the account. We do not obtain your Apple Account password.

We store invitation codes and relationships, valid invitation counts, Invitation Point usage, reward orders, Apple Offer Code issuance and redemption status, and related timestamps. When a friend completes their first successful cloud AI recommendation, we mark the invitation as valid. Necessary request, network, and timing signals may be used to prevent self-invitation, duplicate registration, and automated abuse.

1.7 Sharing Campaign Information

When you participate in a Share Halo for Rewards campaign and submit a public video link, we process:

• the random Halo account identifier and submitted video link;
• the platform, submission time, review status, rejection reason, and review time;
• reward Film, redemption codes, redemption status, and related Apple transaction IDs.

We use this information to access and manually review public content, verify campaign conditions, prevent duplicate rewards for the same link, issue rewards, and handle appeals. Reviewing a link does not give us ownership of the video. When you delete your Invitation Center account, corresponding submissions are deleted, although minimal de-identified records needed by law or to prevent duplicate rewards may be retained for the necessary period.

1.8 Feedback and Customer Support

When you submit feedback, we process the feedback text, optional phone number and email, app version, device class, iOS version, random account identifier, and submission time to investigate the issue, respond to you, and improve the service. Phone and email are optional and are not used for advertising.

When you contact us through App Store support or email, we process the contact details, message, and attachments you provide so we can respond and resolve the issue. Do not include unrelated sensitive personal information in feedback or attachments.

1.9 Network, Performance, and Security Logs

When you access Halo servers, server and network infrastructure may process IP address, request time, endpoint type, response status, duration, request and response size, basic device-system network information, and abnormal-behavior signals for network security, rate limiting, performance statistics, and troubleshooting, not advertising tracking.

Halo application-level performance metrics do not record complete images, request bodies, or complete query parameters, and common identifiers in paths are normalized. Infrastructure providing network access, security protection, or content delivery may still log IP addresses and other network data under its security rules.

2. Local Processing and On-Device Models

The following information is stored mainly on your device:

• photos, videos, Live Photos, the in-app album, and metadata;
• preferences such as filters, photographer, intensity, aspect ratio, location saving, and feature toggles;
• the local Film balance cache and random account identifier;
• credentials needed to maintain Invitation Center sign-in;
• on-device models you purchase and download.

When you enable a downloaded on-device composition model, its inference runs locally. That inference does not upload the image or deduct composition Film. Entitlement verification, model download, and other cloud AI modules enabled at the same time still require a server connection.

3. Cloud AI and Generated or Synthetic Content

To provide cloud multimodal analysis and Master Retouch, Halo servers transmit the scaled image, scene parameters, and prompt content needed for your request to Alibaba Cloud Model Studio (DashScope), which performs model inference or image editing on our behalf.

In normal production mode, Halo servers process complete AI images in memory and do not write complete request images to the business database. Memory is released after the request completes or fails. The model provider may retain input, output, or invocation records to provide the service, maintain security, and comply with law. Retention is determined by its service agreement, product configuration, and applicable law. Alibaba Cloud publicly states that it does not use customer data for model training.

For generative local repair, the user's device may download the result directly from a temporary Alibaba Cloud URL. Alibaba Cloud may therefore also process the IP address, request time, and temporary access credentials necessary for the download.

• Alibaba Cloud Privacy Policy
• Alibaba Cloud Model Studio privacy and compliance information

Do not intentionally display or submit unrelated sensitive information such as identity documents, bank cards, medical records, or private communications in cloud AI images. If an image includes another person, ensure you have the right to capture and process it.

4. System Permissions

4.1 Camera

Used for camera preview, photography, video recording, Live Photos, and images required by AI photography modules you enable. Shooting features do not work if permission is denied.

4.2 Microphone

Used for video audio and accompanying Live Photo audio. Features not dependent on audio remain available if denied, but videos or Live Photos may be silent.

4.3 Photos

Used to save photos, videos, and Live Photos; import content you select; and display and manage in-app work. You may use iOS limited photo-library access.

4.4 Location

Used to record the shooting place when Save Location is enabled. You may deny or revoke permission at any time without affecting basic shooting, filters, or AI recommendations.

4.5 Device Motion and Orientation

Used for the level, holding-orientation recognition, and position/composition guidance. Raw sensor data is mainly processed locally in real time.

Halo Camera does not currently request Contacts or advertising-tracking permission.

5. Third-Party Services

5.1 Apple StoreKit and the App Store

Provider: Apple Inc. and the relevant affiliates.
Purpose: Membership subscriptions, Film top-ups, on-device AI lifetime purchases, Restore Purchases, refunds, and transaction verification.
Information: Product and transaction IDs, subscription and revocation status, App Account Token, and information Apple lawfully processes to complete payment.
Note: Apple processes payment. We do not receive complete payment-account details.

• Apple Privacy Policy
• Apple Media Services Terms and Conditions

5.2 Sign in with Apple

Provider: Apple Inc. and the relevant affiliates.
Purpose: Create and verify a Halo account when you use the Invitation Center, sharing rewards, or redemption, and revoke authorization when you delete the account.
Information: Apple sign-in account identifier, the name and email you choose to provide, identity token, authorization code, and security nonce.

5.3 Apple Location and Geocoding Services

Provider: Apple Inc. and the relevant affiliates.
Purpose: Provide device location and region-name queries when you authorize and enable location saving.
Information: Location, query content, device, and network information necessary for location or geocoding.
Note: Halo does not send GPS coordinates as parameters for current cloud AI model analysis.

5.4 Alibaba Cloud Model Studio (DashScope)

Provider: Alibaba Cloud Computing Co., Ltd.
Purpose: Cloud multimodal analysis and generative image editing for Director, position, composition, filter, and Master Retouch features.
Information: Scaled images, retouch previews, scene and prompt parameters, model inputs and outputs, invocation time, and necessary security logs.
Processing: Information is transmitted through an encrypted network connection for model inference and the structured result or image is returned.

5.5 Alibaba Cloud Content Delivery and Object Storage

Provider: Alibaba Cloud Computing Co., Ltd.
Purpose: Distribute on-device models to devices that pass entitlement verification and potentially provide temporary downloads of generative-repair results.
Information: IP address, request time, requested model file or temporary image URL, temporary authorization parameters, response status, and necessary security logs.
Note: On-device model files do not contain your personal photos or account data.

We do not currently integrate advertising networks, Firebase Analytics, Firebase Crashlytics, or cross-app tracking SDKs. On-device inference frameworks run locally and are not listed as third parties receiving personal information. If this list changes materially, we will update this Policy and provide notice or obtain consent as required.

6. Retention

We retain personal information only for the shortest period necessary for the purposes described in this Policy:

• local photos, videos, Live Photos, models, and preferences: until you delete them, clear app data, or uninstall the app;
• complete cloud AI images on Halo servers: processed only transiently in memory for the request in normal production mode, released after the request, and not written to the business database;
• Alibaba Cloud Model Studio inputs, outputs, and invocation records: according to service configuration, agreements, and legal compliance requirements. Through contract and configuration, we require processing to be limited to providing services, maintaining security, and meeting legal obligations, not model training;
• application-level performance metrics: automatically deleted after five days and do not include complete images or request bodies;
• network-security logs: retained for the period necessary for cybersecurity, abuse prevention, and incident investigation. Where law requires network logs to be retained, the statutory period applies, after which they are deleted or anonymized;
• feedback: generally until 12 months after the issue is resolved, or until any dispute, security matter, or legal obligation is resolved;
• sharing-campaign records: until you delete the Invitation Center account or reward processing and a reasonable appeal period end. Minimal records needed to prevent duplicate rewards may be de-identified and retained for no more than three years;
• Sign in with Apple account, invitation relationships, and reward records: until you delete the Invitation Center account. Statutory, transaction, or anti-fraud records that cannot be deleted immediately will not be used for other purposes and will be deleted or anonymized when the necessary period ends;
• Film, Membership, lifetime-purchase entitlements, and Apple transaction records: while the entitlement remains valid and for the period needed to restore purchases, or for any statutory period applicable to refund revocations, tax, audit, or dispute handling.

Where a legally required retention period has not ended, or immediate deletion or anonymization is technically difficult, we will stop processing other than storage and necessary security measures.

7. Storage Location and Cross-Border Processing

We do not proactively provide cloud AI images to model services outside mainland China. Apple may process information related to the App Store, Sign in with Apple, and system services according to its global service architecture and applicable rules, as described in Apple's privacy notices.

If in the future we need to provide personal information under our control to an overseas recipient, before processing we will disclose the recipient's name and contact details, the purpose and method, information categories, and how you can exercise rights, and will obtain separate consent and complete applicable data-export procedures as required by law.

8. Information Security

We use access controls, transport encryption, sensitive-token encryption, transaction-signature verification, model-file integrity checks, rate limits, and Film preauthorization rollback to protect information. On-device model downloads require verification of the purchase entitlement and SHA-256 integrity validation.

No internet service is completely secure. If personal information is or may be leaked, altered, or lost, we will promptly take remedial measures. Where notification is legally required, we will describe the incident, possible impact, measures taken, and protective steps you can take through an in-app notice, email, or another reasonable method, and report to the relevant authority.

9. Sharing, Entrusted Processing, Transfers, and Public Disclosure

Except for providers listed in this Policy, with your separate consent, or as required by law, we do not sell personal information or use photos, videos, or feedback for advertising, profiling, or model training.

We contractually define the purpose, method, scope, duration, and security obligations of entrusted service providers and supervise their performance. Providers may not use information for purposes we have not entrusted to them.

If a merger, demerger, asset transfer, or change of operator occurs, we will notify you of the recipient's name and contact details and require the recipient to remain bound by this Policy. If the processing purpose or method changes materially, we will provide new notice and obtain necessary consent.

As a rule, we do not publicly disclose personal information. Where public disclosure is necessary, we will explain the purpose and information categories and obtain separate consent as required, unless otherwise provided by law.

10. Your Rights and Choices

To the extent provided by applicable law, you may inquire about, access, copy, correct, supplement, delete, restrict, or request transfer of personal information under our control, and may withdraw consent-based processing. Withdrawal does not affect processing conducted before withdrawal.

You can manage information by:

• viewing, changing, or revoking camera, microphone, Photos, and location permissions in iOS Settings;
• disabling individual or all cloud AI modules on the main camera screen;
• disabling location saving, process-image saving, or on-device model features in Settings;
• deleting photos, videos, and related location data in the system photo library or in-app album;
• managing or canceling subscriptions, restoring purchases, or requesting refunds through your Apple Account;
• signing out of your Halo account in the Invitation Center, which does not delete the server account;
• selecting Delete Account in the Invitation Center to delete the Invitation Center account, invitation data, and sharing submissions and attempt to revoke Sign in with Apple authorization;
• emailing tokflowlab@163.com to request access, copying, correction, supplementation, deletion, restriction, or transfer of server information directly under our control; withdraw relevant consent; or make a privacy complaint.

Deleting the Invitation Center account does not delete App Store purchase records held by Apple or automatically remove valid Film, Membership, or lifetime-purchase entitlements associated with the random purchase account, local work, or legally retained transaction records. If you also want feedback or other identifiable records deleted, state this in your email.

To protect accounts, transactions, and others' rights, we may ask for the random account identifier, relevant transaction details, or other minimum necessary material to verify identity. We generally respond within 15 business days after receiving a complete request. If the law provides otherwise or the request is complex, we will explain the progress and expected timeframe. We may lawfully refuse clearly repetitive or unreasonable requests or requests that infringe others' rights, and will explain why.

11. Protection of Minors

Halo Camera is not designed specifically for children. Users under 14 must not use cloud AI, Sign in with Apple, invitation and sharing rewards, feedback, or other online features that process personal information. They may use offline basic shooting under guardian guidance.

If we discover that we processed personal information of a user under 14 without guardian consent, we will stop the processing and delete or anonymize it as soon as legally required. A child or guardian may contact us using the email in this Policy.

If we provide an online service that processes children's personal information to users under 14 in the future, we will issue separate children's personal information processing rules and obtain guardian consent before processing.

12. Policy Updates

We may update this Policy due to changes in features, third-party services, or law. We will notify you of material changes through an in-app prompt, page notice, or another reasonable method. Where renewed consent is required, we will obtain it before the changed processing begins.

Older versions and update dates will be made available as required. If you do not agree to updated processing, you may stop using the relevant feature and exercise deletion or other rights under this Policy.

13. Contact Us

Personal information handler and operator: TokFlowLab
Personal information rights, complaints, and customer service: tokflowlab@163.com

You may also contact us through App Support on Halo Camera's App Store product page. After verifying necessary information, we will respond within the period required by applicable law or promised in this Policy.

If you believe our processing infringes your personal information rights, you may also file a complaint or report with a competent cyberspace, telecommunications, public security, market regulation, or other personal information protection authority.