Private by design
Privacy, retention and deletion
What Mestoria keeps, why, for how long, and how to delete it. Written to be read in one sitting.
In one paragraph
Mestoria is a visual diary. You write or speak your day, and a painter turns it into a page with you in it. To do that, Mestoria keeps three things about you: your diary (words, and pictures painted from them), two photos of your face kept as three small crops, a random install id for this device, and, if you make an account, the email address you sign in with. Your words and your photos go to one outside company, OpenAI, to be painted and transcribed, and nowhere else. Nothing is sold, nothing is used for ads, nothing is used to train a model, and Mestoria does not use facial recognition and never identifies anyone. You can delete your photos and your server backups from inside the app, at once, with no one to ask.
What Mestoria keeps, and why
| What | Why | Where it lives |
|---|---|---|
| Your diary: the words you write or speak, and the pictures painted from them | It is your journal. The words are also what the painter reads to paint the day. | On your device. A backup of the whole journal (the newest 14 snapshots) rests on Mestoria's server, keyed by your install id, so a lost phone is not a lost diary. You can switch the backup off in You. |
| Two photos of your face, kept as three small crops: your face from the front, your face from the side, and a small copy of the whole front photo for your build | So the painter can paint you, and not a stranger. The painter reads the shape of your face from the crops; no photo ever appears in a page as a photograph. | The crops are cut on your device. The originals never leave your phone. The crops rest on Mestoria's server, tied to your install id and to nothing else, readable by no one but the paint job. |
| Your voice, while it is being transcribed | To turn a spoken entry into words. | Nowhere, after transcription. Mestoria's server passes the recording to OpenAI and keeps no copy. The words that come back are your diary. |
| A random install id | To find your backup and your photos on the server. It is a random string, not your name, email or phone. | On your device and beside your backup and crops on the server. |
| Your email address, if you make an account | To sign you in, to find the same journal in the app and on this site, and to answer you when you write. Never for marketing, never shared. | On Mestoria's server, beside your account. Deleting the account deletes it. |
| The record of your photo consent: the version of the words you agreed to, and the time | So that consent given is consent kept on record, as some states require. | Beside your crops on the server. It is destroyed with them. |
| Two chosen colors (skin tone, hair color) and whether your photos show glasses | They ride along with every painting so the person in your pages is colored like you. | On your device, inside your journal's settings, and in your backup. |
| At launch in the stores: purchase records and crash reports | To honor what you bought and to fix what breaks. | With Apple or Google (purchases), RevenueCat (purchase records) and Sentry (crash reports). None of them receive your diary or your photos. |
Who else sees it
One company paints and transcribes for Mestoria: OpenAI. Every painting sends your entry's words and your three crops to OpenAI's image model; every spoken entry sends the recording to OpenAI's transcription model. OpenAI acts as a processor for Mestoria under its data processing addendum: it does not train on what Mestoria sends, and it keeps a copy for up to 30 days for abuse monitoring, then deletes it. Mestoria's own server is the only other place your data touches. No analytics service, no ad network, no data broker.
The retention and destruction schedule
This is the schedule the server enforces, once a day, from the dates on the files themselves. It is also the schedule published for the states whose biometric and privacy laws ask for one.
| Data | Kept until | Destroyed when |
|---|---|---|
| Reference photos (the three crops) and the consent record | The earliest of: you remove them, 12 months pass without a painting on this device, or 3 years pass since your last use of Mestoria on this device | At once when you tap Remove my photos in You. Otherwise by the daily sweep the day the limit passes. Deletion is permanent: the files are removed from disk, and there is no copy elsewhere. |
| Journal backups on the server | The newest 14 snapshots, until you erase them or 3 years pass since the last snapshot | At once when you erase them in You (which also switches the backup off); otherwise by the daily sweep. The 15th-oldest snapshot is removed each time a new one lands. |
| Voice recordings | Not stored after transcription | Mestoria keeps none. OpenAI holds its copy for up to 30 days for abuse monitoring, then deletes it. |
| Words and crops sent to OpenAI for painting | Up to 30 days at OpenAI | Deleted by OpenAI after its abuse-monitoring window. Never used for training. |
| Deleted pages and journals on your device | 90 days in Recently deleted | Restore brings them back; Delete forever, or 90 days, removes them. |
| Your diary on your device | As long as you keep it | Delete the app, or use Mestoria's own delete and export tools, whenever you like. |
| Deletion requests made by email rather than in the app | Answered within 7 days | Everything above that belongs to the install id you name. |
How to delete
- Your photos. In the app: You, then Remove my photos. The three crops and the consent record leave the server that instant. Pages already painted stay as they are; new pages are painted without your likeness until you add photos again.
- Your server backups. The same sheet offers "Remove photos and erase server backups", which removes every snapshot and switches the backup off. Your phone keeps its own copy of the journal, and Export keeps a file.
- Everything. Do both of the above, then delete the app. Nothing else about you exists on the server.
- By email. Write to the address below with your install id (You, then Account, shows it) and Mestoria deletes the same things within 7 days.
Your face, in plain words
Mestoria keeps reference photos so the painter can paint you. The painter reads the shape of your face from three small crops. Mestoria does not use facial recognition, never compares your face to anyone else's, never identifies anyone from a picture, and never lets anyone else do so with your crops.
Before the first photo is kept, the app shows one screen that says what is kept, where it goes, and how long, and asks you to confirm that the photos are of you and that you agree. That tap is recorded with the version of the words you saw. If you ever want the record gone, Remove my photos destroys it with the crops.
Only upload photos of yourself. Mestoria is a diary of your own days; it is not for painting other people from their photos.
Consumer health data
A diary can contain anything, including how you feel and how your body is doing, and a photo of a face is an image of a person. Washington's My Health My Data Act, and laws like it, call some of this consumer health data. Mestoria collects it only because you wrote it or chose the photo, uses it only to paint and to keep your diary, shares it only with OpenAI to paint and transcribe as described above, never sells it, and deletes it on the schedule above or at your request. The consent screen before your first photo is your consent for the photos; writing an entry is your choice to keep that entry. You can withdraw at any time by deleting, as described in How to delete.
What Mestoria never does
- Sell your data, or share it for advertising. There are no ads.
- Use your words, your voice or your photos to train any model, or let anyone else do so.
- Use facial recognition, or identify anyone.
- Read your diary. Mestoria's server passes entries to the painter and stores encrypted-in-transit backups; no person at Mestoria opens them except to answer a deletion request you make yourself.
- Knowingly keep the data of anyone under 13. Mestoria is for people 13 and over; if Mestoria learns a user is younger, that user's data is deleted.
The rest
Do Not Track. Mestoria has no tracking to turn off, so it does not respond to Do Not Track signals; there is nothing to respond to.
Changes. When this page changes, the version date at the top changes, the app shows the new photo words before any new photo is kept, and the change is noted here for a year.
Law. Mestoria is operated from Massachusetts, and Massachusetts law applies.
Contact. Mestoria is made by Pancake Studio LLC in Boston, Massachusetts. Write to [email protected] or call 617-701-7766. Deletion requests by email are answered within 7 days.
Terms. The terms of use say how the app and the plans work.