PuzAI Privacy Policy

What PuzAI does not do

• No accounts. PuzAI does not ask for a username, email, phone number, or login of any kind. There is no server-side account because there is no server.
• No analytics. PuzAI does not include Firebase Analytics, Google Analytics, Mixpanel, Amplitude, Sentry, Crashlytics, or any other analytics or telemetry SDK. There are no tracking pixels, no install pings, no usage counters.
• No advertising. PuzAI shows no ads and links to no ad networks. The Android build explicitly removes the com.google.android.gms.permission.AD_ID permission.
• No network of PuzAI’s own. PuzAI itself has no server and makes no network requests of its own. The Android build declares no INTERNET permission, so the OS prevents PuzAI’s own network calls regardless of code. The iOS build sets NSAllowsArbitraryLoads = false and NSAllowsLocalNetworking = false. Static checks in scripts/privacy_audit.sh fail the build if any networking API surface is referenced. The one exception is the App Store / Google Play in-app purchase flow, which is handled entirely by Apple and Google — not by PuzAI (see Purchases below).
• No cloud sync. PuzAI does not use iCloud, Google Drive, Firebase Storage, or any third-party cloud. Projects and photos live in the app’s private sandbox on this device only.
• No third-party sharing. PuzAI does not share data with any third party because PuzAI has no data to share — see above.

What PuzAI stores on your device

The following data lives in PuzAI’s sandboxed app storage and is visible only to PuzAI on this device:

1. Project records — the project name, piece-count estimate, creation date, and a list of attached image file names. Stored as JSON files in the app’s Application Support / internal storage directory.
2. Imported photos — when you tap “Take photo” or “Choose from Library,” PuzAI copies the selected image bytes into its private images folder. Photos are never uploaded.
3. Sorting sessions and journal records — piece groups, progress, small derived thumbnails, and optional solve-journal records are saved locally so you can resume. These records remain in the app’s private storage and are removed with their project or when the app is uninstalled.

Deleting a project removes the JSON record AND recursively removes every photo in that project’s images directory. Uninstalling the app removes everything PuzAI ever wrote.

Camera and photo library access

PuzAI requests:

• Camera access — only when you choose a camera action to photograph puzzle pieces or the puzzle box. iOS prompts via NSCameraUsageDescription; Android prompts through the runtime camera-permission flow. Camera frames are processed on-device and are never uploaded. PuzAI does not run the camera in the background.
• Photo library access — only when you tap “Choose from Library.” iOS uses PhotosPicker (PHPickerViewController under the hood), which does NOT require library permission and returns only the photo you explicitly select. Android uses ActivityResultContracts.PickVisualMedia, which has the same single-photo scope.

On-device intelligence (Apple Foundation Models)

PuzAI includes an Apple Foundation Models implementation for short, on-device hint refinement on supported iOS 26+ devices. The current shipping UI does not invoke that optional implementation; it uses deterministic local hints. If the Foundation Models path is enabled in a future release, it is designed to receive only bounded text and numeric context such as a colour-family label, piece count, and optional region label — never photo bytes — and to fall back to deterministic hints when the on-device model is unavailable.

Current sorting, grouping, and region-hint processing runs locally on the device.

On Android, the equivalent on-device LLM path (Gemini Nano via AICore) is currently scaffolded but not wired. When it ships, the same data-handling rules will apply: only the small numeric/label context is sent to the on-device model; never the photo.

Purchases

PuzAI is free to download and includes a 3-day full-access trial. Starting that trial happens locally on your device and does not contact Apple or Google, create a subscription, or charge you. After the trial, a single one-time purchase at the store-displayed local price unlocks the app permanently. There is no subscription. Purchase, restore, receipt verification, refund handling, and localized price display are handled by Apple’s App Store (iOS) or Google Play (Android) through their own systems. PuzAI never sees or receives your name, payment card, or billing details, and no puzzle, project, or photo data is ever involved in a purchase. The developer receives only anonymous, aggregate sales figures from Apple and Google — never anything tied to you. Apple’s and Google’s handling of the transaction is governed by their own privacy policies.

Children and the Family Sharing tier

PuzAI does not target children under 13 and does not knowingly collect any data from anyone of any age. The app is age-rated 4+ in the App Store catalog because it contains no objectionable content; it is suitable for younger users but is designed for adults working on jigsaw puzzles.

Changes to this policy

If PuzAI changes a privacy-affecting behaviour (for example, if a future release adds an opt-in cloud-backup feature), this document will be updated with its effective date. Release checks include a static privacy audit, dependency and permission review, and a comparison against the store privacy declarations.

Trademarks

PuzAI is a trademark of Rizk Corsight, LLC. Apple and App Store are trademarks of Apple Inc.; Google Play and Android are trademarks of Google LLC. All other product and company names are used for identification only and remain the property of their respective owners.

Support and contact

For product support, purchase or restore help, privacy questions, or data-deletion questions:
Rizk Corsight — rizkcorsight@rizkcorsight.com

Source code transparency: PuzAI’s repository contains a scripts/privacy_audit.sh script that statically verifies the absence of network code paths. The CI workflow runs this check on every push and PR — a build that breaks the privacy guarantees cannot land.