Your design.Your data controls.

Drey operates Drey and acts as controller for this service. Contact privacy@drey.studio for privacy requests.

• Anonymous or registered account identifiers, session data and your email if you protect an account.
• Tattoo ideas, placement, size, style, notes, project decisions and artist briefs.
• References, body photos, masks, generated designs and try-on outputs only when you choose to create or upload them.
• Credits, generation state, error category, timing and cost records. Raw prompts, photos and private media URLs are excluded from telemetry.
• Screen and completion events in the product flow and a one-way technical fingerprint of an app error. Raw stack traces remain on the device.
• One-way security digests and limited network/device signals used to prevent free-use abuse.
• A share recipient’s selection, note and a blinded browser identifier used to update that response. No name or email is requested.
• If you submit in-app feedback, its category, optional rating and message. This content is not sent to an AI or analytics provider.
• If you join the closed beta, your email, 18+ confirmation, tattoo time horizon, segment, phone platform, and separate research and anonymous-benchmark consents. The form does not request a body photo.

• Contract/service performance to save projects and provide design, try-on, brief, sharing and account features.
• Legitimate interests and, where applicable, legal obligations for security, abuse prevention, troubleshooting and credit integrity.
• Separate explicit consent before an optional reference or body image is sent to an external AI processor.

AI-transfer consent is separate from this notice and is requested immediately before the relevant operation. If you decline, local photo placement remains available.

Live AR runs the camera on your device; Drey does not upload the camera view unless you explicitly save, upload or share a capture. We access only the library item you select. Uploaded images are re-encoded and location/EXIF metadata is not retained.

Drey may send a prompt and an approved reference for design generation, or an approved composite body image for AI realism, to fal.ai. Provider request input/output storage is disabled and the provider media copy is configured to expire after one hour. Drey copies completed output into private storage. We do not use your content to train models.

• Supabase for authentication, database and private storage.
• Vercel for web/API hosting and operational network logs.
• fal.ai only for AI generation and image operations you approve.
• Apple or Google for app distribution and, once enabled, store purchase receipts.

These providers may process data outside your country. Transfers use appropriate contractual and technical safeguards; image transfers requiring consent occur only after that consent. We do not sell personal data or share it for behavioral advertising.

• Active projects and private media remain until you delete an item or your account.
• Share links expire after your chosen 1, 7 or 30 days and can be revoked immediately.
• Raw product/reliability events are retained for no more than 180 days and account-linked rows are removed with account deletion.
• Beta contact records are kept for at most 24 months; closed invitations are pruned after 90 days. The secure management link returned after signup stays in the URL fragment and can permanently delete the contact record at any time.
• Account deletion covers identity, projects, credits and private media. Temporary storage failures are retried by a durable queue.
• Limited financial or security records required by law or fraud defense are deleted or de-identified when that purpose ends.

Start deletion in Profile or on the web account-deletion page.

Depending on applicable law, you may request access, correction, deletion, portability, restriction or objection, and withdraw consent. Email privacy@drey.studio. We may request only the information needed to verify your identity and account.

Drey is for users aged 18 or older. Authorization controls restrict private media and data is encrypted in transit. No system can guarantee absolute security.

Material changes update the date above and may also be announced in the app. We will update this notice and store disclosures before enabling a new processing purpose or provider.