Your photos. Your choices.

Photos and clothing searches

Choosing and preparing a crop happens on your device. When you choose to upload it, the prepared crop goes to the app’s authenticated search service. Selecting a photo or changing its preview does not automatically upload a replacement. The service receives the prepared image you choose to upload; using the whole-photo frame can include the whole selected photo.

Uploading and allowing processing are separate steps. Before starting a photo search, the app asks you to confirm that the crop excludes faces and that you have the right to use the image. These are your confirmations, not automatic face detection or a check of image rights.

The configured service can send the prepared crop to Google Gemini or Anthropic to describe its clothing. The current live product-search route sends generated descriptions, market and price filters to SerpAPI Shopping; follow-up searches can also send a continuation token. That shopping route does not send the crop bytes. Which services are enabled for the beta still needs confirmation; provider names on the crop review do not establish their retention or training practices.

Search records can include the uploaded crop’s reference, clothing descriptions, your market and filters, search progress, returned products and when results were observed. Removing an uploaded crop is separate from removing a local copy or search results.

• Review the providers shown for the uploaded crop before allowing its search.
• Use Remove uploaded crop to request removal from the search service. If the outcome is uncertain, check its status rather than sending the action again.
• Use the separate local photo controls for copies kept on this device.

Accounts, preferences and search history

Sign-in uses the configured Firebase authentication service and supported Apple, Google or email-code sign-in methods. The app and backend use your account identifier to keep account requests, preferences and saved records together. Account identity records can include an email address, linked sign-in methods and account dates.

An anonymous app session still has an identifier. It is different from anonymous statistics. Account quiz answers and preferences are also different from preferences or local history stored only on a device.

Signing out does not delete your account. Device preferences, local photos and account data have separate controls.

Saved items and updates

Account saved items can retain the selected product, search source, observed price and other details available at the time it was saved. Update watches can retain the item being checked, its schedule, later observations and change history. Whether a source can be checked depends on the enabled service and source availability.

Notifications involve separate choices: account permission, notification preferences and this device’s operating-system permission. A saved item or watch does not grant all of them. Explicit device registration sends a push token to the backend for the configured Apple or Google push service.

Notification queues and delivery records can describe attempts and outcomes. A reported send does not prove that you saw or opened a notification.

Purchases and subscriptions

The app uses the configured app store and RevenueCat integration to handle purchases and restore access. The backend keeps account-linked entitlement, purchase-event and search-allowance records so it can decide what access is available.

If a purchase or restore is uncertain, the app checks the existing transaction or access status. It does not automatically purchase again. Account deletion does not cancel a store subscription; manage the subscription separately in its store.

The operator still needs to confirm the enabled store and RevenueCat services, their own retained records and what can be erased through those services.

Optional product analytics

Optional analytics can record allowed feature-use events, timestamps, app version, session references, experiment information and permitted quiz-answer choices. These records can be linked to an account. They should not all be described as anonymous or as counts only.

The app’s event format excludes email addresses, photo pixels and arbitrary preference values. Sending requires both the saved choice on this device and confirmed account permission under the matching notice. An unknown or declined choice keeps sending off.

Disabling analytics stops sends on this device and requests removal of recorded analytics activity. Measurement associated with visits from saved updates is handled separately. The app reports unconfirmed removal honestly and offers a status or retry action where available.

Exports, public shares and retailer links

An account export is an authenticated copy of the data the service can include. It can contain your account email address. The app shows a summary first; opening the system share sheet requires a separate action and creates a temporary private file on the device.

Clearing the review or removing the temporary file does not remove copies saved by another app or person. The share sheet closing does not confirm delivery.

A public share link makes its selected preview available to people who have the link. It is different from a private account export. Shared-link records can include the public preview, expiry, source binding and referral or attribution information. Revocation cannot retrieve a copy someone already saved.

Opening a reviewed retailer link takes you to that retailer’s service. The retailer handles what you do there under its own terms and privacy information.

Keeping and deleting data

The app displays the uploaded crop’s service expiry time and the scheduled account-erasure time returned by the service. Crop expiry, search-history retention and account deletion are separate processes. The deployed retention periods, maintenance schedule, provider copies, logs and backups still need operator confirmation.

The current account-deletion review uses a 72-hour grace period. Requesting deletion withdraws uploaded photos, stops running searches and pauses affected activity. You can cancel while the service reports the request as pending. Once erasure begins, it cannot be cancelled.

Cancellation does not restore withdrawn photos, stopped searches, shared links, notifications or disconnected Apple access. Deleting the app’s account does not delete your Apple or Google account, and it does not cancel a store subscription.

Final account erasure removes data through the configured service handlers and performs account-scoped local cleanup. The app does not report completion while that cleanup is unconfirmed. Some technical deletion records and aggregate usage or budget records may remain. The exact retained records and their periods must be confirmed before publication.

Your controls and privacy questions

Use You to review account privacy choices, optional analytics, exports and account removal. Device photo permissions and store subscriptions also have controls in the relevant device or store settings.

For access, correction or other privacy questions, use the verified app privacy contact published with this notice. App support and waitlist email preferences are separate routes; leaving the waitlist is not an account-deletion request.

The responsible operator must complete the applicable rights, request process and complaint route before this notice is published. No response deadline or legal basis has been assumed in this draft.

Details awaiting operator review

These open details are part of this draft. A contact address alone does not settle how app data is handled.