Privacy Policy
Last updated: 8 September 2026 · Baca dalam Bahasa Malaysia
The short version
- The room photograph you choose is sent to Google, which renders the redesigned version. That is the core of what the app does, and it is the only thing that leaves your phone.
- Google does not use it to train or improve its models, and we do not keep a copy. It reaches Google through a relay we run, which passes it along and writes nothing down.
- Location data is removed from the photograph before it is sent.
- There is no account. No name, no email, no sign-in. Your saved rooms sit on your phone and nowhere else.
- The relay keeps a tally of your redesigns under a random identifier your phone invents, so the trial allowance cannot be reset by reinstalling. A count, not a history — no photographs, and nothing about you.
- If you subscribe, RevenueCat handles it and receives an anonymous identifier it generates for your device — not a name, and not anything you typed.
- There is no analytics, crash-reporting, advertising, or tracking software in the app of any kind.
1. Who we are
Norra AI is a mobile application that photographs a room and renders how it could look in a different style. It is operated by huddles.ai, based in Malaysia.
Norra AI has no user accounts. There is no sign-in, no profile, and no database of ours holding a name, an email address, or anything you typed. When you ask for a redesign, your app sends the photograph to a relay we operate, which passes it to Google’s rendering service and hands the result back.
The relay exists for one reason: it keeps the key to Google’s service on our side, instead of shipping it inside the app where it could be extracted and spent by anyone. Your photograph is in the relay only for the seconds the render takes, and no copy of it is written.
Two identifiers exist, and neither is a name. Subscribing involves Apple and our subscription provider, RevenueCat, which knows your device by a random string — section 2.5. The relay counts renders against a second random string your phone generates — section 2.6. They are created separately, are never joined to each other, and neither is anything you typed.
huddles.ai is the data controller for the information described here. You can reach us about anything on this page at info@huddlesai.com.
2. What the app handles
2.1 The room photograph
When you take or choose a photograph, the app asks permission to use your camera or your photo library. It only ever receives the one image you select. It does not browse, scan, index, or upload your photo library.
Before that photograph is sent anywhere, the app:
- strips its metadata, so the GPS coordinates, camera details and timestamp your phone attached to the file are not transmitted;
- resizes it so its longest edge is no more than 1536 pixels, which means less of the original picture leaves your phone than your camera captured.
2.2 The redesign
The resized photograph is sent to our relay, together with a written instruction describing the style, the room type, and whether to redesign, rearrange, or repaint. The relay forwards both to Google, which returns a rendered image; the relay hands it straight back, and the app writes it to its own private storage on your phone.
We do not keep a copy of either image. Both exist on the relay only in memory, for the seconds the render takes, and neither is written to a disk or a database of ours. The relay runs on Cloudflare’s network, which section 4 lists alongside the others.
2.3 Your rooms — on your device only
The before and after images of every room you save are stored only on your device, in the app’s private storage. So are your style, room type and mode preferences, and the app’s own record of how many redesigns you have left.
No image is uploaded to us, and no saved room ever leaves the phone. Deleting the app deletes all of it, and it is not recoverable — unless your phone’s own encrypted backup includes it, which we have no access to. The allowance is the one thing counted in two places, on the phone and on the relay, for the reason 2.6 gives.
2.4 Sharing a room
If you share a redesign, the app hands the image to your phone’s own share sheet and takes no further part. Where it goes from there is between you and whichever app you chose.
2.5 Subscription information
Purchases are processed by Apple. We never see your card details, your name, or your Apple Account.
Our subscription provider, RevenueCat, records whether your subscription is active. Because there is nothing to sign in to, it knows you by an anonymous identifier it generates on your device — a random string, not a name and not anything you typed. It also receives your App Store transaction and basic device and app information: the platform, the app version, the country of your store.
That identifier exists so a subscription you paid for can be restored to your device, and it is attached to the device rather than to you. It is one of the two identifiers described in this policy; the other is the render tally in 2.6, which is generated independently and never linked to this one.
2.6 The device identifier and your allowance
The first time it runs, the app generates a random identifier and sends it with each render. It is not your device’s serial number, not an advertising identifier, and not anything Apple or we can trace to you — it is a random string your phone made up.
Against that identifier, and nothing else, the relay stores how many redesigns have been made, when the recent ones happened, and which subscription tier the device last held. That is the entire record. It is what keeps the trial allowance from being reset by deleting and reinstalling the app, and what makes the weekly subscription allowance come to the same number however you count it.
No photograph is stored against it. It is never joined to a name, an email address or an Apple Account, because we hold none of those. It is a different identifier from the RevenueCat one in 2.5, and the two are not linked to each other.
2.7 What we do not collect
No accounts. No names or email addresses. No analytics. No crash reporting. No advertising or attribution software. No location. No contacts. No device advertising identifiers. No tracking of you across other apps or websites.
The app makes two kinds of network request and no others: the render described in 2.2, and the subscription check described in 2.5.
3. Why it is used
| What | Why | Legal basis (UK/EU GDPR) |
|---|---|---|
| The room photograph | To render the redesign you asked for | Performance of a contract |
| Style, room type and mode | To tell the renderer what to produce | Performance of a contract |
| Saved rooms, on your device | To show you your lookbook | Performance of a contract |
| Redesigns remaining and render times, on your device | To apply the trial allowance and the subscription allowance | Performance of a contract |
| The device identifier and its tally, on our relay | To apply the same allowance on our side, so reinstalling cannot reset it | Legitimate interests — preventing abuse of a trial allowance |
| Subscription status | To provide paid access | Performance of a contract |
A photograph of the inside of someone’s home can be revealing, even when nothing in it is obviously personal. That is why the app strips location data before sending, keeps saved rooms on the device, and asks for no account to attach any of it to.
4. Who it is shared with
Four providers, each for one purpose. Each is required to protect the data to a standard consistent with this policy, and none of them may use it for their own purposes.
| Provider | What they receive | Purpose |
|---|---|---|
| Cloudflare | The photograph and the instruction, in transit through the relay we run on their network; the random device identifier and its tally, stored there; and your IP address, as with any request your phone makes to a server. | Hosting the relay that carries the render and counts the allowance |
| The resized room photograph, with its location metadata already removed, and the written instruction describing the style. Because the request reaches Google from our relay rather than from your phone, Google is given the relay’s address and not yours. | Rendering the redesigned room | |
| RevenueCat | An anonymous identifier it generates for your device, your App Store transaction, and basic device and app information | Knowing whether your subscription is active, and restoring it |
| Apple | Payment and purchase information | Processing payment |
Google does not use this content to train or improve its models. Norra AI uses the paid tier of Google’s API, under terms that prohibit it. Google may retain a request briefly to check it against its safety policies, as described in its API terms. We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law.
5. What else is in the photograph
A picture of a room often contains more than the room. We take that seriously, and there is one thing only you can do about it.
Check the frame before you send it. Photographs of people — who have not agreed to this policy — and of documents, screens, letters, medication, or anything else identifying should be kept out of shot or cropped before you choose the image. Norra AI is a tool for photographing rooms, not the people in them.
- Whatever is in the frame is sent to Google along with the rest of the picture, by way of our relay. Nobody here looks at it and nothing retains it, but it does pass through equipment we run — and once it has been sent, we cannot remove it after the fact.
- The renderer is instructed not to put people into a redesign, but that is an instruction to a model, not a filter, and it says nothing about what was in your original photograph.
If you believe a photograph of you has been submitted to Norra AI by someone else, contact us at info@huddlesai.com. We will help where we can, though you should know we hold no copy of any photograph and no account to trace it to.
6. Where your information goes
We are based in Malaysia; Cloudflare, Google and RevenueCat are based in the United States. So a photograph you send for rendering, the device identifier described in 2.6, and the subscription identifier described in 2.5, are transferred outside your country and outside Malaysia. Our relay is deliberately placed close to Google’s service rather than close to you, so a render is normally handled in the United States wherever in the world you are. These transfers are covered by Standard Contractual Clauses (with the UK Addendum where applicable). You can request a copy of the relevant safeguards from info@huddlesai.com.
7. How long it is kept
| Data | Retention |
|---|---|
| The photograph sent for rendering | Not retained by us at all — it crosses the relay in memory and is never written down; held by Google only as long as its API terms allow |
| Saved rooms, before and after | On your device until you delete them or uninstall the app |
| Preferences, allowance and render times | On your device until you uninstall the app |
| The device identifier and its tally, on our relay | Render times count for seven days and the remembered subscription tier for one day; the lifetime tally is kept indefinitely, since a tally that expired would defeat the allowance it exists to enforce |
| The anonymous subscription identifier and its record | Held by RevenueCat for as long as the subscription record is kept |
| Subscription records | Held by Apple, as required for tax, accounting, and legal purposes |
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to our use of your personal data, to portability, to withdraw consent, and not to be discriminated against for exercising these rights.
Because there is no account, these rights are unusually simple to exercise here — and unusually limited in what we can do for you, because almost nothing about you exists to act on. The exception is the anonymous subscription identifier in 2.5: write to us and we will ask RevenueCat to delete the record attached to it.
- Delete everything: delete individual rooms in the app, or uninstall it. That removes every photograph, render and preference the app holds. It does not cancel a subscription — that is done in your Apple Account settings.
- Stop the transfer: stop asking for redesigns. Nothing leaves your phone unless you request a render.
- Anything else: email info@huddlesai.com. We will respond within the period required by law — one month under UK/EU GDPR, 45 days under California law, and 21 days for a data access request under the Malaysian PDPA.
Malaysia. Under the Personal Data Protection Act 2010 you may request access to and correction of your personal data, limit its processing, and withdraw consent. You may also lodge a complaint with the Personal Data Protection Commissioner.
UK and EU. You have the right to complain to your supervisory authority — in the UK, the Information Commissioner’s Office at ico.org.uk.
California. The categories of personal information involved are user content (your photograph), identifiers (the random device identifier in 2.6 and the subscription identifier in 2.5), and internet activity (the requests that carry them). They are collected from you directly and used only for the purposes set out in section 3. We do not use them to build a profile, and there is no “sale” or “sharing” of them as California defines those terms.
9. Security
Data in transit is encrypted. Rooms saved on your device are stored in the app’s private storage area, protected by your device’s own encryption (iOS makes app data readable after you first unlock it following a restart, as it does for every app). Because there is no account, there is no password to steal. What the relay holds is a random identifier and a count of renders — no photographs, no names, and nothing that would identify you were it ever exposed. No system is perfectly secure, and we cannot guarantee absolute security.
10. Children
Norra AI is not intended for children. You must be at least 13 years old to use it. We do not knowingly collect data from children. If you believe a child has used the app to send a photograph, contact us — though note that we hold no copy of it and no account it could be traced to, so the only effective step is to delete the app on that device.
11. Changes
We update this policy when the app changes. If a change is significant we will tell you in the app before it takes effect. The “last updated” date at the top always reflects the current version.
12. Contact
info@huddlesai.com