Who we are
MuseTip (甲想 in Chinese) is an AI nail stylist app built and run by independent developer En Chen (陈恩, "we"). It is distributed through the Apple App Store.
What we process and why
- Photos you pick or take (nail inspiration, your hand, and the clue pictures you give "Create with Muse" or "Match my outfit" — an outfit or any picture): sent through our server to AI services to analyse the design, design a set for you and draw it onto your hand; not stored on our server. Your hand photo is also kept on your phone so every look can reuse it.
- Pictures you upload as stickers or pieces in the Nail Studio: a picture on a transparent or plain background is cut out on your phone and never leaves it; any other photo (a manicure on a hand, say) is sent through our server to an AI service, which picks out the pieces in it and draws each on its own, and is not kept. Each piece is then sent to an AI service to get a short name, so you and Muse, the app's AI stylist, can refer to it, and is kept in My pieces on your phone.
- Nail profile (length, preferred shape, skin tone): stored on your phone; sent with analysis, chat and design requests so advice fits your hands. When Muse designs a set for you, the names and techniques of looks you saved or had done go with it, as a guide to your taste.
- Text you type (edit requests, chat, the sentence and tags you give a design): sent to AI services to carry out the request; not stored.
- Looks you share (the nail-tip image and the Nail Card text, never your hand photo): uploaded when you open the share screen so friends can open the same look; anyone with the link can view it. We count how often the link is opened and tried on.
- Usage counts: which entry on Home you tap and how far the hand-photo and design steps get (never the pictures or the text), with a random install ID, a free-allowance identifier and, when signed in, the account ID. Raw records are kept for at most 90 days and linked records are removed on account deletion. Aggregates that cannot be linked to a person may be retained.
- Account, purchases and usage: the account ID and email Apple gives us when you sign in with Apple (you can choose to hide your email when you sign in, and we then get only the relay address Apple makes; we do not ask for your name); the point packs or subscription you bought (transaction ID, product and number of points, from Apple and RevenueCat, never your payment details); and how many points you used. The phone also keeps a random device ID to count free points and pictures drawn ahead each day, bound to an Apple-verified device key to prevent forged allowance identities. We use these to keep what you bought on your account so it comes back when you sign in on another phone, to work out how many points you have left, to stop a purchase being counted twice, and to find your account and answer you about it when you write to support. We never use your email for marketing. The account and usage are in our database, purchase records also at RevenueCat, the device ID in your phone's keychain (it survives deleting the app). Completed deletion removes the account (including email), linked raw usage and event records, Sign in with Apple authorization and the RevenueCat customer profile. We retain only the store, purchase environment, transaction identifier, product, points, relevant transaction dates and refund status, without the account link, to prevent duplicate credits and handle refunds, for at most 2 years after deletion. These transaction identifiers are not described as fully anonymous. A random receipt records deletion progress, without the account link after completion, for at most 30 days; incomplete progress records expire 30 days after initiation and can be retried during that window. Daily cost aggregates that cannot be linked to a person may be retained.
- Purchase support records: support reference, account, product, transaction identifiers, purchase time, check results and handling notes, used to investigate unconfirmed purchases, refund disputes and goodwill credits. We do not ask for passwords, payment card details or complete receipts. Linked cases and notes are removed on account deletion. Cases are eligible for daily deletion 90 days after resolution or 180 days after creation; scheduling may add less than one day. Minimal compensation ledger entries and pseudonymous deduplication identifiers follow transaction retention, at most two years after account deletion; deleting a case does not permit duplicate compensation.
- Settlement recovery records: task identifiers, execution state, success or failure and relevant times, plus pending signed receipts and request identifiers on your phone. They let us confirm points or refunds after network/database failures without charging a retry twice. No photos, generated images or model inputs/outputs are stored in these server records. Resolved execution records remain for at most 90 days; minimal unresolved accounting facts remain until reviewed. Linked records are removed on account deletion. Local signed receipts expire after 30 days and are cleared on the next startup or foreground retry; unconfirmed charge request identifiers remain until confirmation or account deletion.
- Device security records: an Apple-verified device public key, free-allowance identifier, attestation environment, assertion counter and last-used time, plus digests of consumed challenges. We use these to verify our app, prevent changes to allowance identities and reject replayed proofs. Minimal device security records remain after account deletion until the daily cleanup following 90 days without use (less than 91 days). Challenge digests remain until the daily cleanup after one day (less than two days). They contain no account ID, email or operation content and are pseudonymous, not described as fully anonymous.
- Technical logs (request time, IP address, errors, possibly a short excerpt of request text): our request logs are kept for at most 90 days, with account-linked records removed on deletion. Daily IP/device abuse counters are cleared by the next daily cleanup, normally within 48 hours. Providers keep their own technical logs under their respective retention policies.
- Crash reports: provided to us by Apple when you choose to share analytics with app developers in your iPhone settings; beta testers' TestFlight feedback is provided by Apple too.
Apart from the email provided through Apple sign-in described above, we don't collect your name, phone number, contacts or precise location, don't use the advertising identifier (IDFA), and don't track you across apps.
Camera and photos
Used only when you take a hand photo, choose an inspiration picture, give a clue picture for a design, or upload a sticker or piece in the Nail Studio. You can turn access off at any time in Settings → MuseTip.
Asking before anything goes to an AI service
The first time your photos or what you write to Muse need to go to the AI services below, the app tells you who receives them and why, and sends nothing until you tap Allow. If you don't allow it, the parts that need no AI (such as making nails by hand in the Nail Studio) still work. You can withdraw or give permission again any time under Me → Privacy.
Service providers
Supabase (server, storage, database), OpenAI (reading inspiration and clue pictures; designing sets from your clues, including drawing one straight from your clue pictures; image generation and editing, including taking the manicure you had on off your hand photo, and picking the pieces out of a photo you upload in the Nail Studio; checking whether the nails in your hand photo are already done; writing the Nail Card), Alibaba Cloud Model Studio / Qwen (chat and text edits; naming your pieces; reading pictures — including checking your hand photo — designing and writing the Nail Card when OpenAI is unavailable), Replicate (locating each nail in the hand photo), RevenueCat (recording and checking in-app purchases — whether a subscription is active and how many packs were bought; it receives the payer ID and purchase records, never your payment details), and Apple (App Store and TestFlight distribution, in-app purchase payments, Sign in with Apple, crash reports, beta feedback). Each processes data under its own privacy policy; some of their servers are outside mainland China. We never sell, rent or trade your information or use it for advertising.
Your choices
- Delete a saved look by long-pressing it in Saved.
- Withdraw your permission for the AI services under Me → Privacy; the app asks again before the next request.
- Delete your account under Me → Account → Delete account. Try-ons left in it are lost; if you have a membership, cancel it in your App Store subscriptions too — deleting the account does not stop Apple charging you.
- Erase all MuseTip data on the phone under Me → Privacy → "Erase MuseTip data on this phone", or by deleting the app.
- To remove a shared look, send us its link and we will delete it.
- We answer other requests within 15 business days.
Children
MuseTip is not directed to children under 14.
Changes
We update this policy and its effective date when features change, and tell you in the app about significant changes.
Contact
Email support@musetip.app. On the beta you can also take a screenshot in MuseTip and choose "Share Beta Feedback".