Privacy Policy

Your email address, if you create an account. You can use the product without one; a guest session has no email attached to it.

Your confirmation that you are 18 or older. Not your birth year, and not your date of birth — the answer to that one question is all the threshold requires, so it is all we keep.

Your questionnaire answers: hair texture, how much styling time you have, and the style you picked.

The photographs you upload: one selfie, and optionally one inspiration image.

Ordinary technical data: which pages you opened, which buttons and links you tapped (with the words on them and where a link leads), taps that got no response or were repeated quickly, errors the page ran into (with the access codes in photo links removed), and how fast pages loaded. We do not read what you type into any field, and no image is sent. A salted hash of your IP address is used only to cap free generations per network and to stop the same network from voting twice on a shared preview or collecting the same reward twice; we do not store raw IP addresses.

One cookie of our own, coifly_free_used, is saved in your browser after a free preview. It holds the id of the account that used that preview, so the same browser does not get a second free one. It lasts 400 days, scripts on the page cannot read it, and it is not used for ads or analytics. Clearing your browser's site data removes it.

Two more cookies of our own are used for shared previews. coifly_voter holds a random id for your browser, so one browser counts as one vote on a shared preview and a person's own votes do not earn them a reward. If you vote without signing in, it is also what links your vote to the account you sign in with afterwards, so the voting bonus goes to that account. It lasts 180 days. coifly_ref holds the code of the most recent shared link you arrived from, so the person who shared it can get a reward if your first free preview is made; it lasts 30 days. When you vote, we keep that browser id and the salted hash of your IP address with your vote (and with the bonus, if you claim one) for 30 days, then remove them. When you share a preview, we keep the same two for 30 days from the last time we see them, for the same check. Scripts on the page cannot read either cookie, and neither is used for ads or analytics.

Uploaded photographs are deleted within 24 hours of processing. This is enforced by a scheduled job that deletes the files from storage, not merely the database rows pointing at them. If you use Coifly without an account, this applies without exception.

An inspiration image is deleted as soon as the hairstyle has been read from it, usually within seconds. Our database physically refuses to store the extracted style description until that deletion has been recorded.

Generated results are deleted on the same 24-hour schedule unless you press save. Saved results are kept until you delete them or close your account. If you have an account, you can choose to keep a selfie under “Your photos” so you can use it again. A photo you keep there is not on the 24-hour schedule: it stays until you remove it or close your account. The original used for any single preview is still deleted within 24 hours, account or not.

An inspiration photo is never used for a face. It is read for hair attributes — length, curl, layering, colour — and nothing else; no facial data, embeddings, landmarks or identity information is extracted or stored from it.

We do not score, rate or rank anybody's appearance. There is no attractiveness metric in this product and no database column that could hold one.

We do not sell personal data, and we do not use your photographs to train models. Our AI provider is used under paid terms that exclude your content from training.

Coifly does not store biometric identifiers — such as a face template or a scan of face geometry — as defined in laws like the Illinois Biometric Information Privacy Act (740 ILCS 14).

To change only your hair, a vision model marks five points on the face in your photo. Those coordinates are used only in memory to align your own face back onto the result, and are discarded when that request finishes. They are never stored, and they are not used to recognise, identify or verify you.

Our infrastructure providers process data on our behalf: Supabase (database, authentication, file storage), Vercel (hosting and the AI gateway that routes generation requests), Google (image generation, reached through that gateway), our Merchant of Record (payments — they receive your payment details, we do not), Cloudflare (bot protection), PostHog (usage analytics: pages, taps, page errors and load speed), and Sentry (error reporting).

Only three of those ever receive a photograph: Supabase, Vercel and Google. Analytics, error reporting and bot protection do not. Session replay, which records the screen, is switched off in both our error reporting and our analytics, because on this product the screen has your face on it. Analytics records what you tapped, not what the screen showed.

When you tap a booking or product link, you leave for that partner's site and their own policies apply. We record that the click happened; we do not share your photographs or answers with them.

Coifly does not sell third-party products. Booking and product links are a convenience that takes you to another site; anything you buy there is between you and that partner.

Our servers and storage are outside Korea. Data is transferred to the providers below over the network, in the course of serving your requests; there is no transfer by any other means. Declining the transfer means the service cannot be used, since every step that handles a photograph runs on them.

Supabase (United States): email, questionnaire answers, photo files, generated results — for database, authentication and file storage, kept for the periods described under photo retention above.

Vercel (United States): web requests and the routing of generation requests — for hosting and the AI gateway, kept only while a request is being served.

Google (United States): the photographs sent for generation and for locating the face — for image generation, under paid terms that do not use your content to improve its products, including training. Google may log them for a limited period, solely to detect and prevent abuse and to meet legal obligations.

Our Merchant of Record (United States): what is needed to take payment. Payment details are collected by them directly and never reach us. Their name is shown on your checkout and on your receipt.

Cloudflare, PostHog and Sentry (United States): bot protection, usage analytics and error reporting respectively. PostHog receives the pages you open, the buttons and links you tap with their labels, page errors with photo access codes removed, and page load speed. No photographs are sent to any of them.

Meta (United States): advertising measurement. When an ad tracking tag is active, Meta receives the pages you visit on this site, your browser's user agent and IP address, and Meta's own cookies (_fbp, _fbc). When you buy, the purchase amount and plan are sent from our server with those cookies so Meta can tell which ad led to it. No photographs and no questionnaire answers are sent. The tag does not run for visitors in Europe. You can limit ad tracking in your browser settings or in your Meta ad preferences.

You can delete any saved result at any time, and you can delete your account, which removes everything attached to it.

You can ask for a copy of your data or its deletion by writing to the address below. Depending on where you live, you may also have the right to object to processing or to lodge a complaint with a supervisory authority.

If you live in a US state with a consumer privacy law, such as California, you can ask to know what personal information we hold about you, and ask for it to be corrected or deleted.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Send requests to support@trycoifly.com. We respond within 30 days, and we will not treat you differently for exercising these rights.

Coifly is not for people under 18. You confirm you meet that threshold before you can generate anything, and we record the confirmation rather than your age.

Coifly does not knowingly collect personal information from children under 13. If we learn that we have, we delete it.

Data protection officer: the operator of Coifly, at support@trycoifly.com.

Write to that address for access, correction, deletion or to object to processing, and we will respond within 30 days.

If you are in Korea you may also contact the Personal Information Infringement Report Centre (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).