This Privacy Policy explains how Eyko LLC ("we", "us", the "Publisher") collects, uses, and protects your information when you use the Decoro mobile application (the "Application"), an AI-powered interior design tool. We have designed Decoro to be privacy-friendly: most of your data stays on your device, and the photos you upload are processed to generate a result but are not permanently stored on our servers.
Contact: [email protected]
The data controller is Eyko LLC, a company registered in Wyoming, United States. For any privacy request, contact us at [email protected].
| Category | Examples | Where it is processed / stored | Purpose |
|---|---|---|---|
| Account data | Email address and a unique identifier, provided via Apple or Google Sign-In (Apple may relay a private, anonymized email). | Supabase (EU region, Ireland). | Create and secure your account; authenticate requests. |
| Your photos (User Content) | Photos of rooms or outdoor spaces you choose to upload. | Transmitted to Google (Gemini API) for processing. Not permanently stored on our servers; processed transiently to produce your Render. | Generate your AI redesign (Render). |
| Renders | AI-generated images produced from your photos. | Stored locally on your device. | Let you view, compare, save, and share your results. |
| Assistant messages | Text you send to the AI design assistant. | Transmitted to Anthropic (Claude API) for processing; not retained by us for profiling. | Provide conversational design help. |
| Onboarding & preferences | Optional first name, goals, style preferences, priority room, situation, app settings. | Stored locally on your device. | Personalize your experience. |
| Attribution data | Creator/referral code and acquisition source, if you enter or select one. | Supabase (EU) and RevenueCat. | Credit the creator who referred you; measure acquisition. |
| Subscription data | Purchase status, receipts, plan, renewal/expiration, subscriber attributes. | Apple and RevenueCat. | Manage your subscription and entitlements. |
| Usage / generation logs | Your account identifier, generation timestamps, and quality level. | Supabase (EU). | Enforce fair-use quotas and protect the Service against abuse. |
| Anonymous analytics | Product events such as screen reached, plan selected, language, platform — without any user identifier. | Supabase (EU). | Understand aggregate usage and improve the Application. |
We do not use your photos to train our own AI models. Your photos are sent to our AI Providers (Google) only to generate your requested Render, and are processed under those providers' API terms. We do not sell your personal data.
For users in the European Union, we rely on the following legal bases:
We share data only with the service providers needed to operate the Application:
| Provider | Role | Location |
|---|---|---|
| Supabase | Authentication, database, hosting of backend functions | European Union (Ireland) |
| Google (Gemini API) | AI image generation from your photos | United States / global |
| Anthropic (Claude API) | AI conversational assistant | United States |
| Apple | Sign-in, in-app purchases, notifications, app distribution | United States / global |
| RevenueCat | Subscription management | United States |
| Expo | Application build and delivery infrastructure | United States |
Each provider processes data under its own terms and only as necessary to deliver its service. We do not authorize them to use your personal data for their own independent purposes.
Some of our providers are located in the United States. Where personal data of EU/EEA users is transferred outside the EEA, such transfers are protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an equivalent mechanism.
We use encrypted communications (HTTPS/TLS), access controls, and server-side secrets that are never exposed in the Application. Most sensitive data stays on your device. However, no system is completely secure, and we cannot guarantee absolute security.
Depending on where you live, you may have the right to access, rectify, erase, port, restrict, or object to the processing of your personal data, and to withdraw consent. EU/EEA users have these rights under the GDPR. California residents have rights under the CCPA/CPRA, including the right to know, delete, and opt out of the "sale" or "sharing" of personal information — note that we do not sell your personal data. To exercise any right, contact [email protected]; we aim to respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority.
You can delete your account at any time from Settings > Delete my account in the Application. This permanently deletes your account and associated server-side data. You can also clear local data via Settings > Reset all data, and remove everything by uninstalling the Application. Subscription records held by Apple and RevenueCat are governed by their respective policies.
The Application is intended for adults and is not directed to children under 16 (or the minimum age required in your country). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this Privacy Policy from time to time. Material changes will be indicated by updating the "Last updated" date and, where appropriate, through an in-app notice. Continued use of the Application after the changes take effect constitutes acceptance of the updated policy.