Legal

Privacy Policy.

Last updated: 16 October 2026

1. Who we are

DressedByAI ("DressedByAI", "we", "us", "our") is a service operated by DressedByAI, a sole proprietor based in India, with a postal address at 308-B, Gali No.8, Laxmi Nagar, Brahmpuri, Jaipur, Rajasthan, India, 302002. For privacy questions, contact us at support@dressedbyai.com. That address is our privacy point of contact and is read by a person.

For users in the UK and EU, we act as the "controller" of your personal data under UK GDPR / EU GDPR. For users in India, we act as a "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 (DPDP Act).

2. What this policy covers

This policy applies to both of the places you can use DressedByAI:

  • The website at dressedbyai.com, including the free try-on page, which works without an account.
  • The DressedByAI mobile app for Android (package com.dressedbyai.mobile), published on Google Play.

Both share one backend and one database, so an account looks the same from either. A few things differ, and we say which is which rather than leaving you to guess: the free no-account try-on, the dba_tryon cookie and browser session recording are website only; device permissions, push notifications and location are app only.

The app itself contains no analytics SDK, no crash-reporting SDK, no advertising identifier and no third-party tracking code. That is not the same as saying your app activity stays between us, so we will not imply it: our server reports certain actions you take in the app — adding your first garment, generating suggestions, favouriting a look, rating a try-on, deleting your account — to our analytics provider PostHog, tagged with your account identifier. For style suggestions that report includes the text of your request and the city and weather used. Section 8 covers this.

3. Information we collect

On the website and in the app:

  • Account information — your email address and authentication tokens when you sign in via email (magic link) or Google Sign-In, where offered. We do not ask for your phone number or postal address. We ask only for your email address — though if you sign in with Google, Google also supplies the name on your Google account, and that name reaches our analytics provider along with your email (section 8).
  • Closet content — photos of clothing items you upload, plus any names, categories, colors, formality, season, style tags, notes, and quantity you provide.
  • Profile content— body profile (gender, height, body type, skin tone, age range, hair color/length where you provide them), and an optional profile photo used to generate personalised "Rumi try-ons".
  • Try-on photos — the photo of yourself you upload or capture for a try-on, and the garment photos or product links you pair with it. A photo of your face is sensitive information and we treat it as such.
  • Generated content — AI style suggestions and AI-generated try-on images derived from your inputs.
  • Usage and diagnostic data — server-side logs of requests to our API, and error reports when something fails, used for reliability, abuse prevention, and product improvement. Error reports carry the request that failed and a stack trace; we do not attach your identity to them.

In the Android app only:

  • Location— if you grant the permission, the app reads your device location once, while you are using it, and sends the coordinates to us so we can look up today’s weather and suggest outfits that suit it. We only need a city-level forecast, but we should be accurate about what is asked for: the app requests Android’s precise location permission and the reading can be accurate to within about a hundred metres. We do not track your movements, we do not store a location history, and the app never requests background location — it cannot read your location when it is closed. This is optional: there is a manual city picker and a built-in city list, so declining the permission leaves the feature usable.
  • Push notification token — if you allow notifications, the app registers your device with Firebase Cloud Messaging and we store the resulting registration token, your platform (android), your app version and the time the device was last seen, so we can tell you when a try-on has finished rendering. Optional, and revocable in Android settings.
  • Camera and photo library access — used only to let you pick or take the photos you choose to upload. The app reads the images you select; it does not browse, index or upload your photo library.
  • Saving to your gallery — when you save a generated look, the app writes that one image to your device gallery. This is a write; nothing is read back or sent to us.
  • Data stored on your device— your sign-in tokens are kept in Android’s encrypted keystore via expo-secure-store and are erased when you sign out. Your closet, looks and style data are also cached on the device so the app works on a poor connection; that cache is erased when you delete your account or uninstall the app. Neither is shared with anyone.

On the website only:

  • Free try-on without an account — our free try-on page works without signing up, so we collect the following even when you have no account: the photo of yourself you upload; any outfit photos you upload; the product page links you paste, and the garment images we retrieve from those pages; and the try-on image we generate for you.
  • Free try-on abuse controls — to make the free allowance workable we store a one-way hash of your IP address and a hash of its network block, plus a random identifier in the dba_tryon cookie. We do not store your raw IP address for this purpose, and the hashes are not reversible into one. The cookie is described in our Cookies Policy.
  • Product analytics and session recordings — we use PostHog to record how pages on the website are used, which includes session replays: a reconstruction of your visit covering the pages you saw, your mouse movement, clicks, scrolling, and what you typed into forms. Recording is not masked, so on the try-on page a replay shows the photos you chose and the links you pasted. Two things about this are worth stating plainly rather than burying: it runs on every visit to the website — there is currently no cookie banner or opt-in gate in front of it — and once you sign in, the recording is associated with your account, your email address and, where Google supplied it, your name. If you would rather not be recorded, email us at support@dressedbyai.com and we will suppress and delete your recordings. Session recording does not happen in the app, which has no such code in it.

4. Permissions the app asks for, and why

All of these are optional — the app continues to work if you decline, minus that feature — and you can change your mind at any time in Android Settings → Apps → DressedByAI → Permissions. Camera, photos and location are asked for in context, the first time you use the feature that needs them. The notification prompt is the exception: it appears shortly after you sign in, rather than when you start a try-on.

  • Camera — to photograph a garment for your closet or take a try-on photo. Declining means you add photos from your gallery instead.
  • Photos and media — to let you choose existing photos to upload, and to save a generated look to your gallery. On current builds Android asks for media access as a group, so the prompt covers video and audio files as well as images. We only ever read the images you pick and write the looks you save; we do not read your videos or audio.
  • Location (while using the app only) — to fetch weather-appropriate suggestions for where you are. Declining leaves the manual city picker.
  • Notifications — to tell you when a try-on has finished. Declining means you check the app instead.

5. How we use your information

  • To provide, maintain and improve the service.
  • To analyse the clothing photos you upload and generate outfit suggestions and try-on images for you.
  • To generate the try-on you asked for, including retrieving the garment image from any product page you paste.
  • To look up local weather, where you have given location or chosen a city, so suggestions suit the conditions.
  • To send you the notifications you opted into, such as a finished try-on.
  • To authenticate your account and keep it secure.
  • To enforce the free-try-on allowance and our per-visitor, per-network and daily limits, and otherwise to detect and prevent abuse of a page that anyone on the internet can use without an account.
  • To respond to your support requests.
  • To comply with legal obligations.

6. What we do not do with your information

Stated plainly, because these are the questions worth a direct answer:

  • We do not sell your personal information. Not your photos, not your email address, not your generated looks — to anyone, for any consideration.
  • We do not use your information for advertising. No targeted or personalised advertising, no advertising networks, no advertising identifier, and no sharing with advertising or data brokers.
  • We do not train AI models on your photos, and neither does our image provider. Image generation runs on the OpenAI API, where data submitted by a customer is not used to train or improve OpenAI models unless that customer explicitly opts in to share it. We have not opted in, and we have verified that setting on our OpenAI organisation. (This is the API, which is governed differently from the consumer ChatGPT product.) See section 8 for what OpenAI does retain.
  • We do not track you across other apps or websites. There is no advertising identifier, no ad network and no cross-site tracking anywhere in the service, and the app binary contains no third-party tracking or analytics code. Our own analytics, described in sections 3 and 8, covers your use of DressedByAI and nothing beyond it.
  • We do not collect your contacts, calendar, SMS or call logs, microphone audio, health data, precise background location, or a list of the other apps on your device.

7. Legal bases for processing (UK / EU users)

  • Contract (Art. 6(1)(b) UK/EU GDPR) — to provide the service you sign up for, and to produce the try-on you requested.
  • Legitimate interests (Art. 6(1)(f)) — service security, abuse prevention (including the hashed IP address and the dba_tryon identifier behind the free-try-on limits), diagnostics, and product improvement. This is also the basis we currently rely on for website analytics and session recording and for the server-side app events in section 8, because neither is gated behind an opt-in today. We recognise that unmasked session recording is intrusive and that consent would be the stronger basis for it; you can object at any time by emailing us, and we will stop and delete your recordings. None of it involves selling, advertising or automated decisions about you.
  • Consent (Art. 6(1)(a)) — for the optional features you switch on: uploading a profile photo, granting location access, and enabling push notifications. None of these run until you allow them, and you can withdraw consent at any time in Android Settings → Apps → DressedByAI → Permissions, or by removing the photo.
  • Legal obligation (Art. 6(1)(c)) — where required by law.

8. Who we share your information with

We share data with the service providers below, and with nobody else. Each one receives only what it needs to do its job, and none of them is permitted to use your data for their own purposes.

  • OpenAI (USA) — receives the photos you upload, to classify garments, generate outfit suggestions, check try-on inputs against its moderation endpoint, and generate try-on images. This includes photos of your facewhen you request a try-on. As described in section 6, OpenAI does not train its models on this data. OpenAI states that it retains API inputs and outputs for up to 30 days for abuse monitoring before deleting them; that retention happens on OpenAI’s systems and is outside our control.
  • Cloudinary (USA) — storage and delivery of your uploaded images and generated results, including closet photos, profile photos, try-on photos and finished looks.
  • Google (Firebase Cloud Messaging) — receives your device push token and the notification content, to deliver app notifications to your device. Only if you enable notifications.
  • Google (Sign-In) — where you choose to sign in with Google, Google handles the authentication and tells us your email address.
  • Open-Meteo and OpenStreetMap Nominatim — receive location coordinates, or the city name you type, to return a weather forecast and to resolve place names. They receive no account identifier, and nothing that links a lookup to you.
  • GlitchTip (Sentry-compatible error monitoring) — receives diagnostic error reports from our backend when a request fails, and from your browser on the website when a page errors. We do not attach your identity to these reports.
  • Our email provider — receives your email address to deliver magic-link sign-in and support correspondence.
  • Hetzner — our hosting provider. The application and the database both run on a virtual private server we rent from Hetzner, so everything described in this policy is stored on infrastructure they operate. They have no access to it for their own purposes.
  • PostHog (EU hosting) — our product analytics, in two forms. On the website, in-browser analytics and unmasked session replay, on every visit, as described in section 3. From our server, a record of certain actions taken on either the website or the app — first garment added, suggestions generated, look favourited, try-on rated, account deleted — tagged with your account identifier, and for suggestions including your request text, city and weather. Signing in also sends your email address and any name from Google Sign-In. There is no analytics code inside the app, but these server-side events do cover app use, so we list it rather than calling it website-only.
  • Payment and subscription processing — on the website, subscriptions are handled by Gumroad, which takes your payment details directly and tells us only that a subscription exists and its status; we never receive or store your card number. In the Android app, in-app subscriptions are not yet enabled; when they are, they will be processed by Google Play Billing, which likewise tells us only that a subscription is active.

We may also disclose information where we are legally required to, or where it is necessary to protect the rights, property or safety of our users, the public or us. If we are ever involved in a merger or acquisition, we will give you notice before your personal data becomes subject to a different privacy policy.

9. International data transfers

Your data is stored on our hosted server and database (Hetzner, see section 8) and with the service providers listed there. DressedByAI is operated from India, so we access and administer that data from India — which is itself a transfer for UK and EU purposes, even though the storage is not in India.

India is not currently on the UK or EU adequacy list, so we rely on the UK International Data Transfer Agreement (IDTA) and EU Standard Contractual Clauses (SCCs) to cover that access. Service providers outside the UK/EU — including OpenAI, Cloudinary and Google in the USA — operate under their own appropriate safeguards, such as Standard Contractual Clauses or the EU-US Data Privacy Framework.

10. Data retention

  • Account data — kept for as long as your account is active.
  • Closet items, profile content, try-ons and saved looks — kept until you delete them or delete your account.
  • Push notification tokens — kept until you sign out, disable notifications, the token is replaced, or you delete your account.
  • Data on your device — sign-in tokens are erased when you sign out; the cached copy of your closet, looks and style data is erased when you delete your account or uninstall the app.
  • At OpenAI — up to 30 days for abuse monitoring, as described in section 8.
  • Diagnostic error reports — retained according to our error-monitoring configuration, then discarded. They are not keyed to you.

After account deletion we remove personal data as described in section 11, subject to any legal retention obligations. That removal covers the image files themselves in our image storage, not only the database records pointing at them. Anonymised, aggregate records that cannot be linked back to you — for example counts used for billing reconciliation and service monitoring — may be retained.

Free try-ons made on the website without an account are different, and we would rather say so plainly than imply otherwise: there is no account to close, and we do not currently delete this data on a schedule. The photo you uploaded, the garment images, and the generated result are kept indefinitely until you ask us to remove them. We intend to introduce an automatic retention period and will update this policy when we do.

To have a free try-on erased before then, email support@dressedbyai.com. Because there is no account to identify you by, please send the value of your dba_tryoncookie (your browser’s developer tools will show it under Storage → Cookies) and the approximate date and time of the try-on, so we can find the right images and no one else’s.

11. Deleting your account and your data

You can delete your account and everything in it yourself, by any of three routes, all documented on our account deletion page:

  • In the app — tap the profile icon on your Closet tab to open Style profile, then Delete account → Delete my account.
  • On the web — sign in and use the Delete account section of your account page.
  • By email — write to support@dressedbyai.com from the address on the account. We verify the request and delete within 30 days.

Deletion removes your account and email address, your closet and every garment photo in it, your style and body profile and profile photo, your style threads and suggestions, every try-on including the photos you uploaded and the images generated from them, your saved looks, your subscription record, and the sign-in tokens and push registrations held for your devices. The image files are erased from our image storage as part of the same operation, so no copy of a photo survives at its old link. It happens immediately and cannot be undone — there is no recovery window and no archived copy. Deleting the app from your phone does not delete your account; use one of the routes above.

12. Your rights (UK / EU GDPR)

  • Access a copy of your data.
  • Correct inaccurate data.
  • Delete your data ("right to be forgotten").
  • Restrict or object to processing.
  • Receive your data in a portable format.
  • Withdraw consent at any time.
  • Lodge a complaint with the UK Information Commissioner’s Office (ICO) or your local EU data protection authority.

These rights apply whether or not you have an account. If you used a free try-on on the website without signing up, identify the try-on as described in section 10 so we can act on the right data. If you cannot supply the dba_tryon value — because you cleared it, or are asking from a different device — we may be unable to link a request to your data, and we will tell you so rather than guess.

13. Your rights (India DPDP Act)

If you are in India, you have the right to access information about the personal data we process, request correction or erasure, and nominate another individual to exercise these rights in the event of your death or incapacity, in accordance with the DPDP Act.

14. Users in other jurisdictions

If you are in the United States or another jurisdiction, you may have additional rights under your local law (for example, the California Consumer Privacy Act). We do not sell personal information, and we do not share it for cross-context behavioural advertising. Contact us to exercise any available rights.

15. Children

DressedByAI is not directed to children under 13 (or the minimum age in your country, if higher), and the app is not designed for or targeted at children. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact support@dressedbyai.com and we will delete it.

16. How we protect your information

  • Encrypted in transit — all traffic between the app or website and our API uses HTTPS, as does all traffic to the service providers in section 8.
  • Credentials on your device— sign-in tokens are stored in Android’s encrypted keystore, not in plain application storage.
  • Short-lived sessions — the app holds a short-lived access token and a rotating refresh token, so a captured token has limited value and can be revoked.
  • Access controls— every request for an account’s data is authorised against the signed-in account (the no-account try-on on the website is the one deliberately anonymous path), and access to production data is restricted to those who need it.
  • Moderation — try-on inputs are checked automatically before generation, to keep the feature from being misused.

No method of transmission or storage is 100% secure, and we have not had an independent third-party security review. If you find a security problem, please tell us at support@dressedbyai.com.

17. Changes

We may update this Privacy Policy from time to time. The date at the top reflects the current version. Material changes — including any change to what we collect, who we share it with, or the commitments in section 6 — will be communicated by email or in-app notice before they take effect.

18. Contact

Privacy questions, data requests, and anything else covered by this policy: support@dressedbyai.com. Postal address: DressedByAI, 308-B, Gali No.8, Laxmi Nagar, Brahmpuri, Jaipur, Rajasthan, India 302002.