This policy explains what data Pyro: Roast Master ("the App") processes, why, who it is shared with, and how you can delete it. Short version: there is no sign-in, we don't sell your data, nothing is sent to an AI service until you allow it, and your photos are never used for face recognition or to train AI models.
1. What we collect
- Photos you send to be roasted. Only photos you choose to send from the camera or your photo library. Photos can show faces; see §2 for exactly how face data is handled.
- Text and chat messages. The situation you type or dictate, any follow-up messages you send in a chat, and the roasts Pyro writes back. Stored on our backend, bound to your anonymous device identifier.
- Anonymous device identifier. A random identifier generated on first launch and stored in your iOS Keychain. We use it only to associate your chats and roasts with your device. We do not link it to your name, email, phone number, or any other personal identifier, and it is never sent to the AI services in §5.
- Subscription identifier. If you subscribe to Pro, RevenueCat issues an anonymous app user ID we use to verify your subscription state. Apple is the source of truth for the subscription itself; we never see your Apple ID.
- Diagnostic telemetry. Sentry (crash reports) and PostHog (product analytics). Both are configured to redact text content, photo bytes, and identifiers — see §6.
2. Photos and face data
Photos you send may show faces — yours or someone else's. This section describes everything the App does with that face data.
- What face data we collect. Only the photo you choose to send, and a short text description of what is visible in it. We do not create face geometry, faceprints, face templates, or any other biometric identifier; we do not perform face recognition or identify anyone; and the App does not use Face ID or the TrueDepth camera.
- How it is used. With your permission (see §5), the photo is sent to a third-party AI model that (a) writes a neutral text description of what is visible — clothing, hair, facial expression, pose, setting — so Pyro can write your roast and keep the chat in context, and (b) checks whether anyone pictured appears to be under 18, so Pyro never roasts a minor. Face data is never used to identify a person, to link a face to a name or account, for advertising, or to train any AI model.
- Who it is shared with. Only the AI services listed in §5 (OpenRouter, which routes the request to Google, Anthropic, or OpenAI), and only after you allow it. Every request goes through Zero Data Retention endpoints, so these services do not keep the photo after answering and do not use it for training. Face data is not shared with anyone else and is never sold.
- Where it is stored. The photo and its text description are stored on our backend server, bound to the roast they belong to, and on your device, so your roasts and chats stay available to you.
- How long it is kept. Until you delete it: delete a single roast (and its photo) by long-pressing the roast bubble and selecting Delete, delete everything via Settings → Delete my data, or email pyro@thunder.red (processed within 30 days). Deleting removes the photo and its description from our server and your device.
3. What we do NOT collect
- We do not collect your name, email address, phone number, or any other sign-in credential. The App has no sign-in.
- We do not access contacts, location, calendar, or health data. The App asks only for the Camera and Photo Library (to pick a photo to roast) and the Microphone (for dictation). Dictation runs on your device; audio never leaves your phone and is not stored.
- We do not collect biometric identifiers (see §2).
- We do not sell, rent, or share your personal data with advertisers.
4. Retention and deletion
Photos, roasts, and chats persist until you delete them. You can:
- Delete an individual roast (and its photo) by long-pressing the roast bubble and selecting Delete.
- Delete all your data (photos, roasts, chats, anonymous identifier) via Settings → Delete my data. The action is irreversible.
- Email pyro@thunder.red with a deletion request — we will process it within 30 days of receipt.
5. Third-party AI services and your permission
Pyro's roasts are written by third-party AI models. Before the App sends anything to them, it shows a prompt that explains what is sent and to whom, and asks for your permission. Nothing is sent unless you tap "Allow". You can withdraw permission at any time in Settings → AI data sharing; the App then sends nothing until you allow it again.
What is sent:
- Photos you choose to send, including any faces in them (see §2).
- The text you type or dictate, and your chat messages.
- Earlier messages and photo descriptions from the same chat, so replies stay in context.
- The heat level you picked (Mild, Medium, or Savage) and your app language.
No name, email, phone number, location, Apple ID, or device identifier is sent with these requests.
Who it is sent to:
- OpenRouter — the gateway that routes each request to one of the models below.
- Google (Gemini) — describes photos.
- Anthropic (Claude) — writes roasts and chat replies.
- OpenAI (GPT) — backup, used only when the models above are unavailable.
How it is protected: every request is restricted to Zero Data Retention endpoints, so these services process your data only to answer the request and do not keep it. Under their commercial terms they do not use your prompts, photos, or Pyro's outputs to train their models. These providers are bound to protect your data in a way that is the same as or equal to the protection described in this policy.
6. Diagnostic telemetry redaction
- Sentry is configured with redaction that strips message bodies, photo URLs, and request payloads. We receive stack traces, OS version, app version, and an anonymous device identifier — never user content.
- PostHog has autocapture disabled; we send only structured product events (e.g. "roast completed", "subscription started") with no text content or photo data, identified by the same anonymous device identifier.
7. Subscriptions and payments
Pro subscriptions are processed by Apple via In-App Purchase. We never see your Apple ID or payment details. RevenueCat receives entitlement events from Apple; we look up your subscription state by the anonymous app user ID described in §1.
8. Children
The App is rated 17+ and is not intended for children under 17. We do not knowingly collect data from users under 17. If you believe a minor has used the App, email pyro@thunder.red and we will delete their data.
9. Your rights
You can at any time:
- Allow or withdraw sharing with AI services via Settings → AI data sharing.
- Delete your data via Settings → Delete my data.
- Restore Pro purchases via Settings → Restore Purchases.
- Email pyro@thunder.red for a data export request, deletion confirmation, moderation report follow-up, or any other privacy concern.
Depending on where you live, you may have additional statutory rights (such as access, correction, portability, or objection). Contact us at the address above to exercise them.
10. International data transfers
Our processors (OpenRouter, Google, Anthropic, OpenAI, Sentry, PostHog, RevenueCat) process data in the United States. By using the App you acknowledge that your data is processed there.
11. Changes to this policy
We will post material changes on this page and update the "Effective" date above. If a change affects what is sent to AI services or to whom, the App will ask for your permission again.
12. Contact
See also: Terms of Service · AI content disclosure