Privacy policy
Last updated 25 October 2026
There is no account
Loxa has no sign-up, no login and no password. The app generates a random identifier on your device the first time it runs, and uses it for two things: counting how many photos you have left, and telling our billing provider which subscription is yours. It is not linked to your name, your email address or your Apple ID.
That identifier survives reinstalling
It is kept in the iOS keychain rather than in ordinary app storage, which means deleting Loxa and installing it again gives you back the same identifier — and with it the credits you paid for. That is deliberate: there is no account to recover from, so anything that forgot the identifier would lose a purchase permanently. It is removed when you erase or reset the device, or if you ask us (below).
Your photos
Before anything is sent, your photo is checked on the device itself, using Apple’s own face detection, to see whether there is a face in it. The same check estimates the rough shape of the face — oval, round and so on — so the cuts that often suit it can be shown first. Both happen on your phone, and neither answer is sent anywhere; you can clear the face shape from your profile. Before the first photo is sent, and again before the first time you ask which cuts suit you, the app tells you where it is going and asks you to agree. If you decline, nothing is sent. Your photo is then made smaller, sent to our server, passed to an image model to be restyled, and returned to you.
Asking us which cuts suit you is a separate thing you choose to do. One or two photos are sent to our server and shown to a model that answers with a face shape and a short list of cuts, each with a sentence saying why. That answer replaces the estimate your phone made, and you can clear it from your profile like any other. The photographs are not kept; the answer is, for up to seven days, so that asking the same thing twice does not mean a second call.
Our AI providers
The app asks you to agree before a photo is sent to “our AI providers”. These are they, and only these. When we change providers or models, this list changes and the date at the top of this page with it.
Google (Google Cloud) — restyles your photo when you try on a cut or colour, and adds makeup to a finished look when you ask it to.
OpenRouter — does the same when Google will not answer, and reads your photo for “What suits me” when opencode cannot be reached. We ask it to send a request only to providers that do not collect data.
opencode — reads your photo for “What suits me”.
None of them is given anything about you beyond the photo and what you asked for — the style, or the names of the cuts in our catalogue: no identifier, no name, nothing that says which request belongs to whom. We do not keep the photograph and we do not use it to train anything. How a provider handles a request on its own systems is set out in that provider’s own privacy terms.
What happens to them afterwards
The photo you sent is not stored on our server. The generated image is saved on your device, together with the photo it was made from so that you can compare the two later, and a copy of it is held by us for up to thirty days so that repeating the same request does not cost you a second credit — after that it is deleted automatically. A profile picture is kept on your phone and is sent only when you press Try On with it, like any other photo you choose; it is not stored on our server either. We do not use your photos to train anything, and no human at Loxa looks at them.
What we count
We keep a tally of how often each cut and colour is chosen, so we know which ones to make next. It is a running total per style, with no identifier attached — the tally cannot say who picked what, only that a cut was picked. We use no analytics or advertising SDKs, we do not use the advertising identifier, and we do not track you across other apps or websites.
Keeping the service fair
To stop one person minting free photos without limit, and to keep the service from being flooded, the server counts how many new devices and how many requests come from one network address. The address is turned into a one-way hash first and only the hash is used, the counters expire within two days, and they are never stored next to a device identifier or a photo.
When something goes wrong
When the app hits an error — a screen that fails to draw, a photo that will not open, a restyle that does not come back — it sends us a short report so we can fix it: what the error was, where in our code it happened, which version of the app and of iOS you are on, and the last few screens you visited. It carries no identifier and never your photo; anything resembling image data is stripped out on your phone before the report is sent. Reports are deleted after thirty days. We do use your random identifier at the moment a report is sent, to stop a single misbehaving phone flooding us, but it is not saved next to the report and we cannot tell whose report it was.
Purchases
Subscriptions and one-off purchases are handled by Apple and by RevenueCat, our billing provider. We never see your payment details. We ask RevenueCat only whether a purchase happened, so we know how many photos you are owed.
Notifications
If you turn on daily style ideas, the notifications are scheduled on your device. Nothing is sent from our servers and we do not know whether you opened one.
Where this happens, and how it is kept
Our server runs on Cloudflare’s network, which is worldwide, so a request is handled near you and the cached result is held on that network. The models run on our AI providers’ infrastructure. That means your photo may be processed outside the country you are in, including in the United States. Everything travels over an encrypted connection, the cached result is reachable only by a key derived from the photo itself — so nobody can ask for yours without already having it — and access to the systems that hold any of it is limited to the people who run Loxa.
Your rights
Because there is no account, most of what we hold is a number of credits attached to a random identifier. You can still ask us what that is, ask us to correct it, or ask us to delete it, and if you are in the UK or the EU you can complain to your data protection authority. We handle your photo to provide the app you asked for, and we keep the credit count to run the subscription you bought — those are the two reasons we process anything, and we do not process anything for advertising.
Children
Loxa is not for people under 16. We do not knowingly hold a photo or a purchase from anyone younger, and if we learn that we have, we will delete it.
Deleting your data
Deleting a look in the app removes it and the photo it was made from. Deleting the app removes every generated photo, every original and your profile picture from the device, but keeps the identifier so a reinstall does not cost you what you paid for. Erasing the device removes that too. Cached results expire on their own within thirty days, and a suitability answer within seven. To have us delete the identifier and everything attached to it, write to apps@blankhexadecimal.com. The Help & contact row in the app’s profile opens an email to that address with your identifier already in it, which is the one thing we need to find it. Deleting it ends any credits attached to it, including bought ones, because there is nothing else that could identify them as yours. Error reports cannot be deleted on request, because nothing in them says they are yours — that is the same reason they are safe to keep at all, and they expire within thirty days regardless.
Changes to this policy
If what the app does changes, this page changes with it, and the date at the top says when. We will not quietly start collecting something this page says we do not.
Who to write to
Loxa is operated by BLANK HEXADECIMAL, S.L., Calle Illescas 46, piso 11, puerta 1, 28024 Madrid, Spain, which is the data controller for the purposes of data protection law in Spain. Write to apps@blankhexadecimal.com.