Tunado privacy policy
Last updated: 14 October 2026
Tunado: Car Wrap & Rims AI ("Tunado", "we", "us") is an Android app made by Fida ur Rehman, trading as fida.pk, in Pakistan. He is responsible for your data under this policy. This policy explains what data Tunado uses, why, who processes it for us, how long we keep it and how you can delete it. It covers the Tunado app (package pk.fida.tunado) and the website tunado.app.
Tunado runs on its own server and its own database. Tunado data is not shared with, or combined with, any other fida.pk app.
Questions: fidaktk@gmail.com
1. The short version
- You choose a photo of your car. We send it to our server and to our AI processing partners to make the looks you ask for. Nothing else is done with it.
- Your scan (the photo and the car outlines we make from it) is deleted after 7 days. Your looks are deleted after 90 days.
- You don't need an account. Tunado signs you in anonymously. Signing in with Google is optional and only needed to buy.
- No ads, no advertising ID, no analytics, no selling of data, no tracking across other apps or websites.
- You can delete your account and data in the app (Settings > Your data > Delete my account and data) or on the web: tunado.app/delete-account
2. What we collect and why
| Data | Where it comes from | Why we use it |
|---|---|---|
| Photos you choose of your car | You take or pick them in the app | To find your car and make the looks you ask for |
| Car outlines (masks) made from your photo | Our server and our AI partners | To change only your car and leave the rest of the photo as it was |
| Your looks (the AI result, a small preview and, when you share, a copy with number plates blurred) | Our server | To show them in your Garage and let you share them |
| Designs you upload for "Your design" | You | To check the image and put it on your car for that one look |
| Business wrap text (name, phone, website), Pro only | You | To letter that one look. The text is sent to our AI partner and is painted into the result picture. |
| Account ID (a Firebase user ID) | Firebase Authentication, made when you first open the app | To keep your credits, Pro and looks together. The app shows it in Settings so you can quote it to us. |
| Email address of your Google account, only if you sign in with Google | Google Sign-In | To link your account across phones and to record purchases. We store only the verified email, not your name, photo or phone number. |
| Purchases (Google Play order number, product, amount, a one-way hash of the purchase token, the date) | Google Play | To add credits or Pro exactly once, and to handle refunds and accounting |
| Credits and Pro status (balance and the history of credits added, spent and refunded) | Our server | To run your wallet |
| Install ID: a random number the app makes when it is installed. It is not your phone's hardware ID or advertising ID. | The app | To limit free results and daily scans per phone. Our server stores only a keyed one-way hash of it. |
| Play Integrity result | Google Play Integrity, only when you ask for a free result | To check that a free result comes from the real Tunado app on a real phone. Used for nothing else. |
| Notification token, only if you allow notifications | Firebase Cloud Messaging | To tell you when a look is ready or didn't work |
| Crash reports (where the app crashed or froze, phone model, Android version, app version, a crash report ID) | Firebase Crashlytics | To find and fix crashes and freezes. Nothing else: no usage analytics, and no photos. |
| Reports you send about a look (for example "wrong car" or "offensive or inappropriate") | You | To give your credit back and to check and improve results |
We do not collect your name, phone number, location or contacts. Photos are re-encoded on our server, which removes their EXIF data, including any GPS location. We do not store IP addresses. Our server sees your IP address while it answers a request, as any website does.
On your phone the app keeps your photos, your Garage list, your settings and the install ID in the app's own storage. Deleting your account clears them. Uninstalling the app removes them too.
3. Who processes your data for us
We share data only with these service providers, only to run Tunado, and never for their own advertising.
| Provider | What they get | What for |
|---|---|---|
| Runware | Your photo and crops of it, the outline of your car, your chosen look, an uploaded design if you use one, and business wrap text if you use it | AI image generation (the new paint, chrome, design, rims or lettering) and cutting the car out of the photo |
| fal.ai | Your photo, crops of results, and an uploaded design if you use one | Finding cars, wheels, windows, number plates and people in the photo; checking uploaded designs and results for people, faces, animals and nudity |
| Cloudflare (R2 storage) | Photos, outlines and looks | Storing them for the times in section 4. Files are private, and the app gets links that expire after 15 minutes. |
| Google (Firebase Authentication, Cloud Messaging, Crashlytics) | Account ID, Google email if you sign in, notification token, crash reports | Sign-in, "look ready" notifications, crash reports |
| Google Play (Billing, Play Integrity) | Purchase details; the integrity request for free results | Payments; checking free results |
| Our server host | Everything in section 2 that is stored on our server | Running the Tunado server and its database |
How long Runware and fal.ai keep data, from their own documents (checked 13 October 2026):
- Runware makes the pictures available for download for 7 days, and says it never uses data sent through its API to train or improve models (Zero Data Retention). Its general privacy notice covers account data and has no revision date.
- fal.ai does not store our requests (we ask it not to, with its
X-Fal-Store-IOsetting), and the files it makes for us expire within about an hour (data retention, media expiration). Its privacy policy (updated 22 July 2026) does not say whether API data is used for training. - Beyond this, each provider keeps data for the time its own policy states. We do not use your photos or looks to train AI models, and we don't ask our providers to.
We don't sell or rent your data, and we don't share it with advertisers, data brokers or other fida.pk apps. We disclose data to authorities only when the law requires it.
Your data may be processed in countries other than yours, because these providers run servers in several countries. We only use providers that protect it as described here.
4. How long we keep it
| Data | Kept for |
|---|---|
| Your photo and its outlines (a scan) | 7 days, then deleted automatically |
| Your looks, their shared copies and their records | 90 days, then deleted automatically |
| An uploaded design | Only until that look is finished, failed or cancelled; then deleted. Its colour summary is removed from the look's record by the time the look is deleted. |
| An image you choose for "Your design" | When you choose an image for Your design, it is checked for people and animals and not stored; only a fingerprint of the file and its colour summary are kept for 24 hours, so the same image isn't checked twice. |
| Business wrap text | Removed from our records when the look ends. It remains painted into the result picture until the look is deleted (90 days). |
| Your account (account ID, credits, Pro and wallet history) | Depends on the account: • Signed in with Google: kept until you delete it. • Not signed in, with credits, Pro or purchases: kept until you delete it, because credits never expire. • Not signed in, with no credits, no Pro, no purchases and no activity for 12 months: deleted automatically, with its sign-in account. |
| Purchase records (order number, product, amount, date) | Kept after account deletion with your account ID and email removed, for refunds, accounting and so a purchase is never credited twice |
| Hashed install ID and the count of free results used | 12 months, also after account deletion, so free results can't be taken again by deleting the account. It holds no name, email or account ID. |
| Failed Play Integrity checks (hashed account ID, hashed install ID, the reason) | 30 days |
| Notification token | Until you turn notifications off or delete your account |
| Crash reports | Up to 90 days, in Firebase Crashlytics |
5. Deleting your data
In the app: Settings > Your data > Delete my account and data. This deletes at once, from our server: your credits, Pro, looks and their pictures, your scans and their photos, your notification token and your Tunado sign-in account. Then it clears Tunado's data on the phone. This can't be undone, and purchases can't be restored to a new account afterwards.
On the web: at tunado.app/delete-account, sign in with the Google account you used in Tunado and confirm. If you never signed in with Google, use the in-app option, or email us your Account ID (Settings > Your data) from the app. If you no longer have the app, your scans and looks are deleted after 7 and 90 days anyway. Requests by email are answered within 30 days.
Uninstalling the app does not delete data on our server, but your scans and looks still expire after 7 and 90 days. An account that never signed in with Google and holds no credits, Pro or purchases is deleted automatically after 12 months without activity.
6. Your choices and rights
- Notifications are off until you allow them, and you can turn them off at any time.
- Signing in with Google is optional.
- Depending on where you live (for example under the GDPR in the EU and UK, or under data protection laws in Brazil, Turkey and the Gulf), you can ask to see, correct, export or delete your data, and object to how we use it. Write to fidaktk@gmail.com. You can also complain to your local data protection authority.
- We use your data because it is needed to provide the service you asked for (your looks, your wallet and purchases), and for our legitimate interest in keeping free results fair and the app working (Play Integrity, crash reports).
7. Children
Tunado is not made for children and is not meant for anyone under 13. We don't knowingly collect data from children under 13. If you believe a child has used Tunado, write to us and we will delete the data.
8. Security
Connections to our server are encrypted (HTTPS). Stored photos and looks are in private storage and are shared only through links that expire after 15 minutes. Access to our server and database is limited to the people who run Tunado.
9. AI results
Every result is an AI preview, not a photo of a real wrap. Each result carries a visible AI label and "AI-generated" metadata in the file (IPTC "digital source type"); Pro removes the Tunado mark but never the AI label or metadata. Tunado never creates or changes people or animals: people in your photo are left exactly as they were. If a result shows something offensive or inappropriate, report it from the result screen; you get your credit back and we review it.
10. Changes
If we change this policy, we will update the date at the top and, for important changes, tell you in the app before they apply.