# Morph — Privacy Policy **Effective date:** 26 August 2026 **Policy version:** 2026-08-26-full-experience-v9 **WAQAS HAFEEZ ARAIN**, the seller and developer identified on Morph's Apple App Store product page, is the app provider, operator, and data controller for the server-side processing described here ("MORPH," "we," or "us"). Morph makes a face-analysis app that produces an editorial scorecard, a labeled visual simulation, and a recommended grooming/skincare protocol. This policy explains exactly what we collect, how we use it, who we share it with, and the choices and rights you have. We wrote it to be specific rather than generic — because most of your data never leaves your device. The contact section below must provide a working operational rights channel before public release. The repository and beta use `privacy@morph.app`, but that address must not be treated as operational until the domain has working mail service. ## The short version - **Your face analysis runs on your device.** We do **not** upload your face scan or depth data to analyze it. - **Morph is for adults.** Before face analysis, you must confirm that you are 18 or older. Onboarding asks for and stores your date of birth as a date-only value in the app's private storage on your device, together with the optional gender you select. The consent screen's **Agree & enable full experience** action repeats that adult confirmation without a checkbox. Those profile details are not sent to us or included in analytics. If you sign in, the server consent receipt includes the policy version and named purposes—but no birth date, age, gender, or identity document. - **Cloud image use is disclosed once and currently unavailable.** The checked Release has no approved external morph or scoring provider and uses its labeled on-device illustration. If a reviewed cloud morph processor is enabled later, Morph will identify it in a new Terms version before use and send one portrait only after you accept that version and request the feature. The full-experience agreement already names Gaussian reconstruction: selected multiview photos and the trained server copy are isolated to your job and deleted from the GPU worker within 24 hours. If you are signed in, the validated clean Gaussian bundle may be copied to private account storage. - **You can use Morph without an account and without any cloud features.** - **You grant permission once, then control each transmission by using the feature.** Nothing uploads merely because you agree. - **Face-data terms are in one agreement.** Section 5 of the Terms of Use describes face photos, depth, landmarks, geometry, derived measurements, optional appearance models, recipients, permission, and deletion periods. - **Private report backup contains no scan media.** If you sign in, you can deliberately save a selected comprehensive report for your own cross-device access. The backup contains the score, available display-level ratios, evidence labels, editorial, protocol, and unmeasured ledger—not a portrait, frame, landmark set, depth map, mesh, texture, Gaussian, or profile. - **Report sharing is deliberate and portrait-free.** If you create a web link, Morph previews the boundary first and uploads only the report fields listed below. Anyone you give the capability link to can read that snapshot until you revoke it or its 1-, 7-, or 30-day expiration is reached. ## What we collect and where it lives ### On your device only (not sent to us) - **Local profile and adult eligibility.** Morph stores the date-only birth date and optional gender selection you enter during onboarding in the app's private on-device storage. It uses the birth date to admit only adults and stores whether the consent screen's disclosed primary action confirmed that you are 18 or older under the current consent version. These fields are not sent to us, included in product analytics, or used as measured face-analysis evidence. - **Camera photos and optional depth.** With your permission, Morph uses camera photos as evidence for a study. New general metric face studies use the recommended ScanLab guided front-camera capture with TrueDepth face-geometry data; there is no basic-photo face-measurement fallback. The internal Photo Ratio Baseline may analyze a guided set of camera photos or photos you explicitly select from your library, entirely on device, to show supported scale-free 2D proxies and visible-plane angles only; only the neutral front is required. It creates no rating, depth, or millimetre measurement and is not offered in ordinary Release. The Gaussian option is a separate front-camera appearance capture. Current-session face tracking and optional depth improve its frame selection, camera poses, and private optimizer seed; it does not read, run, or require a previous ScanLab study. Its generated splat is not a measurement surface. Local reconstruction is available on compatible iPhones running iOS 26 or later; cloud reconstruction remains subject to separate availability and consent. A focused Skin study may still use one standardized RGB portrait, and approved research may assign another explicit method. Morph does not switch to the rear camera. In the schema-3 Gaussian flow, you may carry that same physical front camera around your head with your arm; observed back, crown, and under-jaw photos can then enter the appearance reconstruction after a closing-front tracking check. Those regions remain unobserved for the separate ScanLab metric study. “Recommended” is a product choice; Morph has not established an empirical accuracy winner. Each study records the method and evidence it actually used. - **Your studies.** Complete studies, portraits, raw measurements, and source evidence are stored locally on your device (in the app's private database). A display-level derived report leaves the device only if you accept the full-experience agreement and choose **Save private cloud copy**. Reviewed Studio 3D control values are stored with the same local study and replayed from its captured mesh. A completed visual simulation may also be saved with the exact study so reopening it does not request and charge for the same render again. These records remain on your device until you delete them or the app. - **Gaussian evidence and local copy.** During the standalone Gaussian capture, Morph writes one protected front-camera video, its camera-calibration sidecar, and a bounded set of sharp source keyframes. Before selection, an internal founder build moves the complete take into **Files › Morph › Gaussian Takes** so a failed package cannot erase the recording. These archived takes never enter Photos, device backup, or any upload; they remain only on that iPhone until you delete them in Files. Under the full-experience agreement, only reconstruction JPEGs selected for a submitted job may leave the device. The cleaned 3DGS PLY is then stored locally and the upload staging copy of the selected source views is removed. In an internal experiment, Morph may also save a small report of dimensionless visible-outline ratios derived only from that exact PLY. The report is bound to the PLY's SHA-256, is not a rating or anatomical measurement, and is deleted with the local study. An abandoned temporary recording that was not successfully archived is removed automatically; a saved take is owner-managed and is not removed with the study. While you are signed in, Morph may restore that cleaned PLY entry from your private account bundle. - **Scan Set and local processing.** A Scan Set links the same session's Gaussian, TrueDepth and targeted head, hair and skin photographs. Local Gaussian processing keeps derived masked photos, training checkpoints and its output in private app storage excluded from backup. Targeted photographs keep their original image, capture time and quality/source metadata locally; selecting cloud Gaussian processing does not upload those additional photos. These private processing files are removed with the local Gaussian study. The separately retained Files take remains owner-managed as described above. Linking captures does not make an unregistered Gaussian a calibrated measurement surface. Missing or unsupported measurements remain unavailable. ### Stored on our servers (only if you choose an account, cloud feature, or website subscription) - **Account identifier.** If you use *Sign in with Apple* or *Sign in with Google*, we store the provider user identifier and, if the provider supplies it, your email — to manage your account, purchases, disclosed connected features, private report backups, and private Gaussian assets. Signing in does not upload or synchronize your studies or local profile; a private report copy is created only after you choose the save action. - **Website billing and support history.** If you subscribe on Morph's website, we store your Stripe customer, subscription, product, price, invoice, status, billing-period, currency, amount-paid, and amount-refunded identifiers or values. We calculate and display your lifetime net support total (amounts paid minus refunds) by currency on your signed-in website and in app versions that support this account field. We do not receive or store your full payment-card number, CVC, or bank credentials. - **Beta application and permission.** If you ask to test a prerelease build, we store your application status, optional note, decision, reviewer, and decision time. Billing status and contribution amounts are not used to approve beta access; a payment does not purchase or guarantee a TestFlight invitation. - **Privacy-minimized product events.** Under the full-experience agreement, Morph may store coarse events such as whether a scan completed, a screen opened, a fixed paywall offer loaded, or any plan action started during its first week. Events use a random per-launch session and contain no portrait, geometry, measurement, score, plan text, email, account ID, transaction ID, or persistent device identifier. Failed deliveries may remain in protected on-device retry storage for up to 30 days; accepted server events expire after 90 days. - **Cloud consent receipts.** If you sign in, Morph stores each disclosed purpose, its accepted/revoked state, policy version, and timestamp. Consent version 9 records the adult confirmation and full-experience Terms acceptance made through **Agree & enable full experience**. It contains no birth date, numeric age, signature image, or identity document. - **Waitlist / order details.** If you join the kit waitlist or place a kit order, we store the email and order preferences you provide. - **Gaussian job metadata.** If you request cloud reconstruction, we store an account-scoped job identifier, processing state, and failure reason so only your account can poll or download that result. This metadata is deleted with your account. - **Account Gaussian asset.** We store one validated Gaussian bundle in private object storage. It contains the cleaned PLY, Gaussian quality report, capture receipt, front preview, and manifest—never source photos, raw depth, the point-cloud seed, checkpoints, or a raw working PLY. We also store its owner, filename, byte sizes, SHA-256 integrity hashes, source, byte-range metadata, and primary-selection state in the same account data plane. It is retained until you delete the asset or your account. - **Private study-report backup.** If you choose **Save private cloud copy**, we store the same exact portrait-free report fields described for shared snapshots below. The copy is linked to your account so you can reopen it on another signed-in phone. It is not publicly readable and contains no capability token. Unknown fields are rejected, including portraits, frames, raw landmarks, depth, mesh, texture, Gaussian data, local profile/demographics, email, and account identity inside the report snapshot. - **Shared report snapshot.** If you explicitly choose **Create & share link**, we store the report's study number, capture date and method label, score and dimension values, evidence/model labels, editorial, coverage and unmeasured ledger, admitted finding text, saved protocol and its cited sources, and any saved visual-scenario label. The exact snapshot cannot contain a portrait, angle photo, capture frame, raw landmark, ScanLab mesh or texture, Gaussian model, local profile/demographics, email, or other account identity. The application database stores only a domain-separated hash of the random 256-bit link token; the HTTPS URL itself is necessarily processed when the link is opened. The page is unlisted and marked not to be indexed, but it is a bearer capability: anyone who receives or forwards it can read the snapshot while it is active. ### Processed but not stored - **Cloud morph image (currently disabled).** The checked Release has no approved external image processor. If a reviewed processor is enabled, a new accepted Terms version must name it before one chosen portrait may pass through the authenticated Morph API for a requested visual simulation. Morph processes the request in memory and does not store the portrait. - **No cloud scoring.** Ratings, measurements, and scorecard editorial are produced on device. Morph does not send your portrait to a cloud analysis provider for scoring. - **Grounded cloud coach (currently disabled).** If approved and enabled, Morph sends the selected approved language-model processor only a bounded text packet containing up to four rounded, named measurements with evidence labels, approved Stack action IDs, fixed preferences, your question, and a short local conversation window. It does not send a portrait, pixels, raw landmarks, mesh, raw geometry, score, percentile, birth date, gender, email, or raw account ID in the model prompt. The OpenRouter free-router candidate requires no-data-collection and zero-data-retention routing and fails rather than using a route that does not accept those settings. Morph retains only bounded operational metadata, not the question or response text. The exact processor, routed host, terms, training, transfer, retention, and deletion posture remain activation gates. - **Report narration (currently disabled).** If approved and enabled, Morph sends the selected approved language-model processor display-ready deterministic findings, evidence/method/limitation text, source IDs, and IDs for already selected actions. It does not send portraits, pixels, raw landmarks, geometry, demographics, local profile fields, or the unredacted study. The narrator cannot change a value, score, action, or action order. OpenRouter requests require no-data-collection and zero-data-retention routing, have no paid or alternate-provider fallback, and request/response text is transient in Morph. ### Temporarily stored for Gaussian reconstruction - **Selected multiview photos.** If you submit a released Gaussian cloud reconstruction while signed in under the full-experience agreement, Morph sends only the selected RGB checkpoints, their camera calibration, and one point-only seed made during that same Gaussian capture—not a previous scan, raw depth stream, or metric mesh—to a private GPU worker. - **Trained 3DGS model.** The worker uses the fixed calibrated camera poses, subject masks, same-session seed, and the approved fVDB pipeline to create a full-head-and-shoulders PLY from the selected views. It does not run COLMAP, generate unseen anatomy, or infer a link to another study. The selected photos and server worker copy of the model are automatically deleted within 24 hours. A successful result may be promoted to your private account storage before the worker copy is deleted. Account deletion removes that durable copy and also requests immediate worker deletion; the 24-hour worker expiry remains the fallback if the worker is temporarily unreachable. - **Experimental Gaussian outline analysis.** Only when the internal worker flag is enabled, the same private worker may derive canonical renders, 25/50/75 opacity surfaces, dimensionless visible-outline ratios, and guide segments from the completed PLY. Morph returns only the bounded JSON report to the app; the portable render sidecar remains in the job-isolated worker directory and is deleted with the job or by the same 24-hour expiry. The report is not used for scoring, population comparison, diagnosis, hidden anatomy, advertising, or analytics. ## How we use data - To analyze your face and produce your scorecard and editorial copy on device. - To generate your labeled visual simulation on device, or through a future reviewed cloud processor only after that processor is named in a newly accepted Terms version and receives release approval. - To train and return a photorealistic Gaussian appearance model only when you submit a released job while signed in. - To provide report narration or grounded plan explanations only after the full-experience agreement, provider approval, authentication, and any disclosed entitlement or allowance. - To recommend a protocol and present the kit. - To measure coarse product reliability and funnel behavior through the privacy-minimized product events disclosed in the full-experience agreement. - To serve a portrait-free report to recipients only after you deliberately create an expiring web link. - To restore a selected portrait-free report to your signed-in devices only after you deliberately save that report. - To administer a website subscription, grant the corresponding release access, provide a billing portal, and display your net lifetime support total. - To review a separately requested beta application without using payment as a condition or reward. - To contact you about the kit/waitlist if you ask us to. We do **not** use your data for advertising, we do **not** sell your data, and we do **not** track you across other companies' apps or websites. ## Sources and legal bases We receive server-side data directly from you, from Apple or Google when you choose their sign-in, from Apple when it supplies signed purchase/subscription state, from Stripe when it supplies website payment and subscription events, and from processors that return the feature you requested. We do not buy face data or scrape it from public sources. Where GDPR, UK GDPR, or a similar law applies, we rely on: - **contract** to provide an account, subscription access, a requested backup, report share, or order; - **consent**, granted by the single full-experience agreement, for analytics, cloud AI, cloud text generation, cloud reconstruction, and biometric processing where consent is required; - **legitimate interests** to secure the Services, prevent abuse, maintain privacy-minimal operational records, and establish or defend legal claims, balanced against your rights; and - **legal obligations** for tax, accounting, sanctions, court orders, consumer rights, and incident response. You may decline the agreement and not use Morph. You may also reset and withdraw the entire agreement in Settings. Required on-device face processing and new connected requests cannot occur without the current agreement. ## Consent, including AI consent Before on-device face processing, one disclosed **Agree & enable full experience** action confirms that you are 18 or older, electronically signs and accepts the unified Terms—including its face-data notice, permission, and destruction schedule—acknowledges this Privacy Policy, and explicitly permits the named purposes that may: 1. send a portrait to any future reviewed cloud morph processor, which is not enabled in the checked Release, and 2. send selected multiview photos to the Gaussian GPU worker for 3D reconstruction, and 3. send bounded report facts or a bounded plan question to an approved language-model processor, and 4. save a selected portrait-free derived report to your private account, or 5. send privacy-minimized product events. Morph stores a separate receipt for each named purpose so every server route can fail closed, but there are no feature-by-feature acceptance controls. Nothing is uploaded merely because you agree: each transmission happens only after you deliberately invoke its corresponding feature. You can review the documents or withdraw the entire agreement at any time in **Settings → Full experience agreement**. Withdrawal stops new processing and connected requests and revokes the server receipts; it does not erase earlier authorized processing or local studies you have not deleted. ## Sharing - **Apple** — when you use Sign in with Apple, authentication is handled by Apple under Apple's privacy policy. We receive only an opaque identifier and, if you permit, your email. - **Google** — when you use Sign in with Google, Google authenticates you and we receive the verified provider subject plus email/profile claims Google makes available. Signing in does not upload the local profile or studies. - **Cloud morph processor** — none is approved in the checked Release. Before enabling one, Morph must identify the reviewed processor in this policy and in the contextual consent disclosure. Morph never uses one for scoring. - **Our private Gaussian GPU worker** — only when you enable Gaussian cloud reconstruction and are signed in. It temporarily stores the selected views, capture seed, checkpoints, and working model for no more than 24 hours. - **Supabase** — hosts the single account database and private object storage used for portrait-free private report backups and the durable validated Gaussian bundle. The Morph API exposes private backups only to their authenticated owner, plus account-owned Gaussian metadata and the cleaned PLY entry. - **OpenRouter and its routed model host** — are the only configured text-model processor, using `openrouter/free`, for optional text-only narration, coaching, and source-grounded educational answers. OpenRouter may select a different eligible third-party model host per request. Morph requires support for the exact structured-output parameters, denies data-collection routes, and requires zero-data-retention routing; if no eligible free route is available, the optional feature fails and the deterministic report remains available. There is no paid-model or alternate-provider fallback. This candidate is not release-approved. The contextual consent must identify this routing before activation, and a different payload or routing policy requires updated review and disclosure. - **fal.ai** — is the currently configured candidate for optional cloud visual simulation. It is release-disabled, receives no score or measurement job, and cannot be enabled until its exact provider/data terms and the product's privacy, safety, quality, deletion, and cost gates pass. - **Stripe** — hosts website subscription checkout and the billing portal and processes payment method, billing identity, taxes, renewal, cancellation, and refunds. Stripe sends MORPH the bounded billing and contribution records described above; it does not send us full card or bank credentials. Website checkout is linked to the same authenticated MORPH account used in the app. - **Shopify** — may process shipping and fulfillment data only if the deferred physical-product checkout is separately approved and enabled. That path must remain disabled until the commerce/privacy review defines guest-order access, retention, returns, and deletion. - **People you choose to share a report link with** — can read the exact portrait-free snapshot disclosed before publication. They do not need a Morph account. Do not post or forward the link more broadly than you intend; revoke it in the report-sharing screen if it reaches the wrong recipient. Before a disabled processor is enabled, MORPH must verify that its contract and technical configuration limit use, protection, retention, training, and deletion consistently with the disclosure presented in the app and this policy. A credential or routing flag alone is not approval. ## International transfers MORPH and its processors may process server-side data in the United States and other countries where they operate. Those countries may have different privacy laws. Where required, we will use an adequacy decision, standard contractual clauses, another approved transfer mechanism, or your explicit consent. A public launch in the EEA, UK, or another region requiring a local representative or additional transfer disclosure is blocked until those details are published. ## Retention and deletion - **On-device studies** stay until you delete a study or remove the app. Signing out does not silently delete local studies. Eligibility and consent state stay until you withdraw consent or remove the app. - **Account data** (identifier, consent receipts, orders, and any durable Gaussian asset) is retained until you delete the relevant data or your account. - **Website billing and support records** in MORPH's account database remain until you delete your account. Account deletion deletes the Stripe customer to stop future website renewal and removes MORPH's account-linked billing and contribution rows. Stripe or other financial processors may retain transaction records for their legal, tax, fraud-prevention, and accounting obligations. - **Private study-report backups** remain until you delete an individual backup, reset the full-experience agreement, or delete your account. Resetting the agreement deletes every private report backup associated with your account. It does not delete the separate local study on your phone. - **Shared report snapshots** become inaccessible after the 1, 7, or 30 days you select. Revoking a link deletes its server row immediately. Expired rows are deleted when the link is next requested or when you next open the report-sharing manager; deleting your account cascades deletion of every remaining shared-report row. A recipient may still retain screenshots or copies made while the link was active. - **Product events** expire from the server after 90 days. Failed consented deliveries expire from protected on-device retry storage after 30 days; withdrawing analytics consent purges the pending queue immediately. - **Delete your account and server data** any time in **Settings → Account → Delete account**. This permanently removes your account and account-linked records from our servers and immediately cancels a Stripe website subscription. It does not cancel an App Store subscription. Local studies remain under your separate on-device delete controls. - The server does not retain the cloud morph portrait or returned image after processing. The completed copy saved in your on-device study remains until you delete that study or the app. - Gaussian-worker evidence and working output expire within 24 hours. The downloaded cleaned PLY remains on your device until you delete the Gaussian or the app. The private account bundle remains until you delete the asset or account and, where it is Biometric Data in MORPH's possession, no longer than three years after your last interaction. Cloud reconstruction must remain release-disabled until object-first enforcement of that maximum period is deployed and verified. ## Your rights Depending on where you live, you may have rights to know or access data, correct it, delete it, obtain a portable copy, restrict or object to processing, withdraw consent, and appeal a denied request. You may also complain to your local regulator. Because most study data is on your device, use the study export or deletion controls there. For server data, use in-app account/data controls or contact us. We may need to verify your account before fulfilling a request. For California and similar U.S. state laws, Morph does not sell personal information, share it for cross-context behavioral advertising, or process it for targeted advertising. We do not use sensitive personal information to infer characteristics beyond the user-requested app function. We will not discriminate against you for exercising a privacy right. An authorized agent may submit a request where local law allows, subject to verification. If a state-law appeal is denied, you may contact the regulator identified in our response. Morph's appearance study does not make a decision that produces legal or similarly significant effects. It does not perform face recognition or use a face template to identify you. The score and editorial logic are described in the app, remain subject to capture/evidence limitations, and can be contested through local feedback without affecting an account or entitlement. ## Children Morph is for users **18 and older** and is not directed to children. The app stores a date-only birth date in its private on-device profile and requires a disclosed 18+ confirmation in the consent screen's primary action before face analysis; it does not transmit that date or request an identity document. It is a **cosmetic and entertainment** product and does not provide medical, psychological, or diagnostic advice. Scores and morphs are stylized estimates, not assessments of worth. ## Security Session tokens are stored in the iOS Keychain. Transport uses HTTPS in production. Secrets are held only on our servers and are never shipped in the app. ## Changes We'll update this policy as the app evolves and revise the effective date above. If a material change expands face-data collection, purpose, recipient, or retention, we will present a new version before that processing and request new consent where required. We will not use a privacy-policy edit to authorize a materially different biometric purpose. ## Contact Questions or requests: **privacy@morph.app** Public release is blocked until this address receives mail and any required regional representative is identified.