Consent and privacy

The upload experience identifies Aabhas and displays photo-processing consent with Privacy and Terms links. In the public and pilot shared theme release, new consent starts unchecked and requires an explicit choice. Merchant preselection is removed. Older published extensions may still honor the legacy default; confirm the deployed release before promising the new behavior.

The public release public-theme-contract-44f5841 and private Pilot release pilot-theme-contract-44f5841 were activated with compatible backends on 2026-10-14 IST. The pilot storefront showed unchecked consent and disabled upload/reuse before acceptance; the operator confirmed consent and generation. Live withdrawal/recovery, result export and Safari/device acceptance remain unverified. Other custom app identities were not updated by this release.

The release offers Standard and Compact wording through the app block, not arbitrary HTML. Both identify the processing purpose and link the policies. See consent templates.

Photo-processing consent and Shopify analytics consent are separate. A customer can permit photo processing while Shopify Customer Privacy still prevents analytics events.

Remembered consent

After the customer confirms consent, the browser can remember that decision for the device. Browser clearing, private browsing, storage restrictions, or a changed template, version or policy URL can require a new decision. v1 remembered choices never automatically grant v2 consent. For a signed-in Shopify customer, the matching version and policy links can be restored from a server receipt. Anonymous choices stay on the device; they are not proof of a saved server receipt.

A server-recorded withdrawal takes precedence over stale device acceptance when synchronization succeeds. Network/offline failures can delay synchronization. Withdrawing consent does not erase previously stored media; use the separate deletion process.

Storage modes

Mode	Customer-media behavior
persist	Permitted input, prepared media, and results can be retained and referenced according to policy.
no_store	Customer input and output media are not persisted on the server; saved result history is unavailable. Minimal operational, billing, audit, and trace metadata may remain. Device-side photo reuse is separate.

Never infer storage policy from the widget appearance. The policy configured for the store is authoritative.

Photo Reuse On The Device

The widget can retain the cropped photo and an available reuse reference in the storefront’s browser localStorage. Prepared-photo reuse in no_store can also use IndexedDB. These are device/browser caches, not permanent share links or a promise of server-side photo deletion.

The current reuse caches have a two-year expiry checked when read. They can be removed earlier by clearing site data or by browser storage controls; this is not a scheduled deletion guarantee. Reuse also depends on valid crop/preparation metadata, consent and, where needed, a still-valid server reference.

For persist, ask Aabhas to confirm your store’s configured media retention, deletion process and any backup/soft-delete behavior before publishing an exact deletion period. Do not equate an expiring read URL with deletion of its media. Do not claim “nothing is kept” when device reuse or server retention is enabled. Custom share/download code must not introduce undisclosed storage or transfer.

Confirm Retention And Access Before Writing Storefront Copy

The Core source default is persistent media, 17,520 hours (730 days), and Studio visibility enabled. It is not confirmation of your shop’s live policy and not a guaranteed deletion deadline. Aabhas must verify your mapped organization, resolved policy, retention job execution and storage backup/soft-delete behavior. The retention sweep exists; a running production schedule has not been verified for this handover.

Retained media may be available to authorized organization administrators, staff permitted by job visibility policy, and authorized platform operators. Studio visibility is policy-controlled and does not itself grant access. Do not claim that only the shopper can see retained media without a store-specific access review.

Suitable interim copy is factual rather than an exact deletion promise: “Your photo is processed to create a virtual try-on. This browser may remember it for reuse. See our Privacy Policy for storage, access and deletion details.” Adapt that text to your verified policy; it is not a legal-compliance certification.