Privacy Policy

Last updated: 27 August 2026

This policy explains how Clothby ("we", "us") handles personal data — both on the website at clothby.app and in the Clothby mobile app. We keep it short and honest.

The two are separate: you can browse the website without an account, and the app collects nothing until you create one. Sections below say which one they apply to.

Who we are

Viktor Kraus, established in the Czech Republic, is the data controller for the information described below. Contact: [email protected].

What the website collects, and why

There are three things, and that is all:

• Your email address, if you join the waitlist — plus the date you joined and a marker that you came from this page. We use it solely to tell you when Clothby launches and to invite you to early access. Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the box on the form. You can withdraw it at any time.
• Anonymous usage statistics — page views, referrer, browser and device type, country. No cookies, no identifiers, nothing that points back to you. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in knowing whether the site works.
• Server access logs — like every web server, ours records the IP address, time, requested page and browser string of each request. These exist to keep the site running and to defend against attacks and abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). They are deleted within 14 days.

No names, no tracking profiles, no advertising cookies, no data broker anything. We do not sell, rent or share your email with anyone, and we will not send you unrelated marketing.

What the app collects, and why

The app needs an account, so here it is more than three things. Nothing below is sold, rented or used for advertising, and there is no advertising SDK in the app.

Your account. Email address and password (stored only as a hash), your username and optional display name, and your profile picture if you set one. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — without an account there is no app.

Your wardrobe. The photos you take or upload of your clothes, plus the attributes derived from them (category, colours, material, warmth, formality and so on), the outfits you build, and your saved sizes. This is the product. Legal basis: contract (Art. 6(1)(b) GDPR).

Styling preferences. Year of birth, preferred clothing department (women's / men's / unisex), favourite styles and colour season. These shape what the app suggests. They are optional — the app works without them. Legal basis: contract, and consent where you volunteer them.

What you post. Posts, comments, likes, follows and stories, if you use the social part of the app. Legal basis: contract.

Approximate location — only while you use the app, and never stored. If you allow it, the app asks the operating system for a coarse position (accurate to roughly a city, not a street) and sends the coordinates to a weather service so the styling can match today's temperature. We do not save the coordinates anywhere, and they are not sent with any identifier that points to you. Deny the permission and everything else still works. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw in system settings.

Subscription. If you subscribe, we store which product you bought, the store transaction identifier and the expiry date — enough to know that your subscription is valid. We never see your card; payment happens entirely inside the App Store or Google Play. Legal basis: contract.

Usage and diagnostics. Which screens and features you use, crashes and errors, your app version, device model and operating system version. These records include your user ID, so they are linked to your account rather than anonymous — we would rather say so than pretend otherwise. We use them to fix what is broken and to see which features matter. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). There is no third-party analytics SDK; the data goes to our own database.

AI usage records. For each AI request: the operation, the model, token counts and estimated cost. This is how we keep the bill under control and stop a single account from being abused. Legal basis: legitimate interest.

What the app does not collect: contacts, calendar, health data, precise location, browsing history, phone number, and no advertising identifiers (no IDFA, no Advertising ID). We do not track you across other apps or websites.

Your photos and artificial intelligence

This deserves its own section, because it is the part people care about most.

When you add a garment, its photo is sent to Google's Gemini API, which recognises what the item is and describes it. The photo also goes to our own background-removal service, running on our hardware — not a third party.

Google currently processes these photos on its free API tier, and Google's terms for that tier allow it to use the content to improve its models. We are telling you this plainly rather than burying it. If that is not acceptable to you, do not upload photos of people — the app only needs the garment.

When the app builds outfits, it sends only the descriptions of your items along with the weather and occasion. Your name, email and user ID are never sent to any AI provider.

Automated suggestions

Outfit suggestions are generated automatically from your wardrobe, the weather and your preferences. They are suggestions about clothes — they produce no legal or similarly significant effect on you, so this is not automated decision-making in the sense of Art. 22 GDPR. You can ignore every one of them.

Cookies (website)

This site sets no cookies at all — which is why you see no cookie banner. Our analytics (below) works without them, and we use no advertising or third-party tracking cookies.

Website analytics

For the website we use Umami, an open-source analytics tool that we host ourselves on our own server — not a third-party service, and the data never leaves our infrastructure. It uses no cookies, stores no personally identifiable information, and cannot follow you across other websites. It tells us aggregate numbers only, never who you are.

The app's usage data is separate and is described above; unlike this, it is linked to your account.

Fonts and external content (website)

All fonts, images, scripts and styles are served from our own domain. This page loads nothing from Google, Meta or any other third party, so simply visiting does not disclose your IP address to them.

Who processes data for us

All of these operate under data processing agreements or equivalent terms:

• Supabase — our database and file storage, hosted in the EU (Ireland, eu-west-1) and protected by row-level security. Holds the waitlist emails and, for the app, your account, wardrobe and photos.
• Cloudflare — sits in front of the website as a CDN and security layer, so it processes the IP address and request data of visitors in transit. Cloudflare operates under the EU Standard Contractual Clauses and serves European visitors from European data centres.
• Google (Gemini API) — receives photos of your garments for recognition, and item descriptions when outfits are generated. Google is based in the United States; transfers rely on the EU Standard Contractual Clauses. See the AI section above for what Google may do with the photos.
• Open-Meteo — receives an approximate latitude and longitude to return the weather. No identifier of you is sent with it.
• Resend — delivers our transactional emails (confirmation, password reset, account deletion), so it processes your email address.
• Apple and Google Play — handle payment and give us back a receipt to verify. They are independent controllers for the payment itself, under their own policies.

Background removal runs on our own hardware, not a third party. Access to the data itself is limited to us.

How long we keep it

Website. Waitlist emails: until Clothby launches and you have been invited, or until you ask us to remove them — whichever comes first. Server logs: 14 days.

App. Your account data stays for as long as the account exists. Delete the account and everything goes immediately and permanently — wardrobe, photos, posts, comments, usage records. There is no grace period and no backup we restore from. You can do it inside the app under Settings, or on the web at clothby.app/delete-account.html, no installation needed.

One exception, and it is anonymised rather than kept: records of clicks on affiliate links survive deletion with the link to you removed, because they underpin commission accounting we have to keep. They cannot be connected back to you afterwards. Analytics events older than 90 days are purged automatically.

Children

Neither the website nor the app is directed at children under 16, and we do not knowingly collect their data. If you believe a child has submitted an email address or created an account, tell us and we will delete it.

Security

Everything travels over HTTPS only, on the website and in the app alike. The database is access-restricted and protected by row-level security, so one account cannot read another's data. Your photos live in private storage and are served through short-lived signed links. If you ever spot a security problem, please write to [email protected] — see also security.txt.

Your rights (GDPR)

You can ask us at any time to:

• access the data we hold about you, or get a copy of it (portability);
• correct it if it is wrong;
• delete it ("right to be forgotten") — you can do this yourself at any time on the delete your account page, no app required;
• restrict or object to our processing;
• withdraw your consent, which is as easy as giving it — withdrawal does not affect processing that already happened.

Email us and we will handle it within 30 days, free of charge. You also have the right to lodge a complaint with a supervisory authority — in the Czech Republic, the Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.cz.

Changes to this policy

If this policy changes materially, we will update the date above and, where the change affects waitlist subscribers, tell them by email.

Contact

Questions or requests: [email protected]

By joining the waitlist you consent to us storing your email for the purpose described above. This is a pre-launch waitlist page; a full policy covering the app — wardrobe photos, account data and AI processing — will accompany the app at launch. See also our Terms of Service.