Privacy policy

This privacy policy applies to On My Nails (onmynails.com) and its related services, including our apps (the “Service”), operated by TEXTINTEL FZE, Starcamp Global, DWTC The Offices One, Office Number 01.03, Dubai, United Arab Emirates (“we”, “us”, “our”). We are the data controller of the personal data described in this policy.

Questions about this policy or your data: support@onmynails.com.

• Account data: an account identifier, your handle and optional display name, your time zone, and, if you sign in, your email address and the sign-in method you use (Google, Microsoft or an email code). Without signing in, your account exists only as a session in your browser.
• Hand photos and generations: the photos of your hand you choose, and the images the Service draws on them or takes as snapshots from the live camera. See section 3.
• Designs: the styles and concepts you make, the art you upload for them, your saves, collections and remix history.
• AI style requests: the text prompt and the optional reference photo you give the AI style generator.
• Public content: what you publish (looks, styles, concepts), the collections you make public, your handle, display name and earned badges.
• Payment data: details of your Plus subscription, such as the plan, dates, status and the payment provider’s customer, subscription and payment identifiers. Card details are taken by our payment provider on its own pages and never reach us.
• Technical and usage data: such as IP address, browser and device information, and, with your consent, how you use the Service (see section 12).
• Communications: messages you send us, and the reports and blocks you make.

We do not collect your location (location data is removed from photos before upload), your contacts, advertising identifiers, or any measurement or template of your hand’s geometry.

• Converted on your device. Before a hand photo is uploaded, your browser re-encodes it and removes its metadata, including any location.
• Drawn on your device. Your nails are found and the set is drawn in your browser. No third party receives your hand photos: they are stored only in our private storage, so you can compare before and after and reuse them under Recent hands.
• Never public. Your original hand photos are never shown to anyone else. If you publish a look, only the crop of the result you approve becomes public.
• The camera stays on your device. Live try-on processes the camera video in your browser. The video is never uploaded or stored. Only a snapshot you choose to take is saved, as a generation in your account.
• No biometric template. The outlines of your nails are worked out for each photo or frame, on your device, only to draw the set. We do not create, store or match any hand-geometry template or other biometric identifier.

We ask for the camera only when you open live try-on, through your browser’s own prompt. You can withdraw it at any time in your browser’s settings.

• to provide the Service: keep your work, draw sets on your photos, make AI styles, and show what you publish;
• to run your account, keep you signed in, and bring the work of a browser session into your account when you sign in;
• to count the free daily and total limits, and to process payments and manage Plus;
• to check public content before it is shown, handle reports and blocks, and award badges;
• to send service messages, such as sign-in codes and the confirmation of an account deletion (we send no marketing email);
• to provide support and respond to your requests;
• to keep the Service secure and prevent fraud and abuse;
• with your consent, to measure and improve the Service;
• to comply with legal obligations.

We process personal data to perform our contract with you (providing the Service and Plus), on the basis of your consent where we ask for it (analytics and marketing cookies, the camera), for our legitimate interests in operating, securing and improving the Service and keeping public content safe, and to comply with the law. Where processing is based on consent, you can withdraw it at any time; this does not affect processing that took place before.

We do not sell your personal data. We share it only as follows, under contracts that require recipients to protect it:

• Hosting and infrastructure: Cloudflare hosts the Service, its database and file storage, and sends our emails.
• AI style provider: when you use the AI style generator, your prompt and optional reference photo are sent to the image provider that makes the style (fal.ai by default; the AI tab names the active provider). It never receives a hand photo.
• Content checks: before published images and public text are shown, they are checked automatically by fal.ai (an image check) and Cloudflare Workers AI (a classification check). Items the checks cannot decide, and reported items, are reviewed by our staff, who see the item and the reason given in a report.
• Payments: Stripe processes Plus payments on the web and sends receipts. App store purchases are processed by Apple or Google.
• Sign-in: Google and Microsoft, when you choose to sign in with them.
• Analytics: Google (Google Analytics) and PostHog, only under the cookie choices described in section 12.
• Everyone: what you publish is public and may be indexed by search engines while it is visible.
• when required by law, or to protect our rights, our users or the public;
• in connection with a merger, acquisition or sale of assets, under this policy.

Only what you choose to publish becomes public: looks (the cropped result), styles (their cover and art), concepts, the collections you make public, and your handle, display name and badges. Publishing requires a signed-in account. Published items are checked before anyone else sees them. You can unpublish them at any time. Original hand photos, camera video, AI prompts and reference photos are never public. See the community guidelines.

Your data may be stored and processed in countries other than your own, including the United States. Where we transfer data internationally, we use appropriate safeguards as required by applicable law.

We keep personal data only as long as needed for the purposes above:

• account data, designs, generations and hand photos: while your account exists, or until you delete them;
• uploads that are never used: up to 24 hours;
• camera video: never stored;
• sign-in codes: until used or expired;
• accounts that never signed in: deleted with their content after 30 days without activity;
• IP addresses used to limit the creation of new accounts: up to 24 hours;
• records we must keep to comply with legal obligations (for example, tax and payment records), resolve disputes or enforce our agreements: for the period the law requires or allows.

Drafts and preferences stored in your browser stay on your device (see section 12).

You can delete your account at any time in Settings. Deletion removes your account, sign-in identities and sessions, uploads, hand photos, generations, looks and their public copies, collections, saves, blocks, badges, and the styles, concepts and art you made. A Plus subscription billed by Stripe is cancelled at once; a subscription bought in an app store must be cancelled in that store.

Exception. A published style or concept that other people’s concepts or generations use stays available to them, with the author shown as anon. It can no longer be edited, and it leaves lists and search. Reports you filed are kept without your identity.

Deleted data is removed from our storage within 7 days, except records we must keep by law.

We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, and private images served only to their owner through short-lived links. No method of transmission or storage is completely secure.

We group the cookies and browser storage we use into three categories.

Strictly necessary. The session cookie (onmynails.session_token) keeps you signed in, or keeps the work of a browser session that has not signed in yet, until you sign out or the session expires. The omn_cookies cookie remembers your cookie choice for 1 year. Your browser also stores, on your device only, a few preferences in local storage (tours seen, the last hand view, hand, skin tone and shape, and the mirror setting), the unsaved drafts of the generator and editors in IndexedDB (removed when you save, or after 7 days), and the files the try-on needs in the browser cache. The Service needs these to work, so they are always on and do not need your consent.

Analytics. Google Analytics, a web analytics service provided by Google LLC (Google Ireland Limited for users in the European Economic Area and Switzerland), and PostHog, a product analytics service provided by PostHog, Inc. (EU Cloud), help us understand how the Service is used and improve it. Google Analytics uses the cookies _ga and _ga_<id>, kept for up to 2 years; PostHog uses a cookie and browser storage named ph_<key>_posthog, kept for up to 1 year. They receive information such as the pages you visit, the actions you take (for example, saving a style or starting a generation), your browser and device, and an approximate location derived from your IP address. They do not receive your email address, your photos, your designs or any other content you make, and we do not record your sessions. These requests are sent through our own domain. Google and PostHog may process this data outside your country, including in the United States. See how Google uses information from sites that use its services and PostHog’s privacy policy.

Marketing. Lets Google Analytics measure the campaigns that bring visitors to the Service, using Google’s advertising signals and the _gcl_<id> cookies, kept for up to 90 days. We do not show ads on the Service.

Your choice. If you visit from the European Economic Area or the United Kingdom, analytics and marketing cookies are off until you allow them in the cookie notice. Elsewhere, they are on until you turn them off in the cookie notice’s settings; if your browser sends a Global Privacy Control signal, marketing starts off. You can change your choice at any time with Cookie settings at the bottom of our pages, or in Settings, Privacy; turning a category off deletes its cookies in this browser.

Stripe sets its own cookies on its hosted checkout and billing pages, which are not part of onmynails.com.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent. You can delete your photos, designs and account yourself in the Service. To exercise any other right, contact us at support@onmynails.com. We may need to verify your identity first. You may also lodge a complaint with your local data protection authority.

The Service is not directed at children and is not intended for anyone under 13. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us at support@onmynails.com and we will delete it.

We may update this policy from time to time. We will post the updated version here and change the date above. If a change is significant, we will tell you in the Service before it applies.

TEXTINTEL FZE, Starcamp Global, DWTC The Offices One, Office Number 01.03, Dubai, United Arab Emirates. Email: support@onmynails.com