1. Introduction
SmartCloset ("app", "we" or "service") takes the privacy of your personal data seriously. This Privacy Policy explains what personal data we collect when you use the SmartCloset mobile app and website, how we use it, and what your rights are.
This policy has been prepared to fulfil our obligations under the EU General Data Protection Regulation (GDPR) and applicable data protection laws.
By continuing to use the app you confirm that you have read and accepted this policy.
2. Personal Data We Collect
2.1 Account Information
- Email address (for registration and login)
- Name / username (optional)
- Password (stored encrypted; never stored as plain text)
2.2 Guest Mode Data
If you use the app without registering, a unique guest ID (UUID) is assigned to your device. This ID identifies you locally rather than linking your data to an account. When you register, your guest data is migrated to your account.
2.3 Clothing Photos & Content
- Clothing photos you upload
- Outfits and collections you create
- Tags, notes and category information you add
- Wishlist contents
2.4 Usage Data
- In-app activities and feature usage
- Outfit viewing and creation history
- AI chat history
- Error logs and performance data
2.5 Device & Technical Data
- Device type, operating system and version
- App version
- IP address
- Notification token assigned by Firebase Messaging
2.6 Subscription Data
- Subscription plan (Free / Pro)
- Purchase history (via RevenueCat)
- Trial period information
2.7 Advertising Data
Ads are shown to free-plan users via Google AdMob. AdMob may use your advertising ID (IDFA/GAID) for ad personalisation. You can disable personalised ads from your device settings.
3. How We Use Data
- To create, verify and manage your account
- To store and sync your clothing and outfit data
- To provide AI-powered analysis and outfit suggestions
- To send notifications (only with your permission)
- To display ads to free-plan users
- To process and manage subscription transactions
- To improve app performance and fix bugs
- To fulfil our legal obligations
4. Third-Party Service Providers
AI features and data sent to OpenAI: Some features send your personal data to OpenAI, our third-party AI provider, so it can generate the requested result. Specifically: (a) when you add a clothing item, the clothing photo is sent for automatic analysis (category, colour, style); (b) when you use Virtual Try-On, the personal/body photo you upload together with the selected clothing image is sent to generate the try-on image; (c) when you chat with the AI Stylist, your messages and relevant wardrobe details (item names, categories, colours) are sent to produce styling advice.
This data is transmitted securely over HTTPS, used only to generate the result you requested, and is never used to show you ads. We ask for your explicit consent inside the app before any data is sent to OpenAI for the first time, and Virtual Try-On additionally requires you to confirm the photo is of yourself and free of objectionable content. OpenAI processes this data under its own privacy policy and does not use it to train its models for API requests.
We use trusted third-party providers to deliver our services. These providers access your data only for the stated purposes.
OpenAI
GPT and image models analyse the clothing photos you upload, generate Virtual Try-On images from the personal photo you provide, and power the AI styling chat using your messages and wardrobe details.
View privacy policy →5. Data Retention
If you delete your account, your data will be permanently deleted from our systems within 30 days. Photos on Cloudinary are purged within 7 days of deletion.
- Account data: Until you delete your account or 3 years after last activity
- Clothing photos: As long as they exist in your account
- AI chat history: 90 days
- Error and performance logs: 30 days
- Guest data: 12 months after last activity
If you delete your account, your data will be permanently deleted from our systems within 30 days. Photos on Cloudinary are purged within 7 days of deletion.
6. Data Security
However, no internet transmission or electronic storage method is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security.
We apply industry-standard security measures to protect your data:
- HTTPS/TLS encryption for all data transmission
- Authentication via JWT — short-lived access tokens; refresh tokens stored in secure storage
- Password hashing (bcrypt)
- Clothing photos protected with signed URLs
- Regular security updates and audits
However, no internet transmission or electronic storage method is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security.
7. Your Rights (GDPR)
To exercise these rights, email us at berksancak6161@gmail.com. We will respond within 30 days.
You have the following rights over your personal data:
- Right of access: Learn what personal data we process about you
- Right to rectification: Request correction of inaccurate or incomplete data
- Right to erasure: Request deletion of your data ("right to be forgotten")
- Right to restrict processing: Limit data processing under certain conditions
- Right to data portability: Receive your data in a structured format
- Right to object: Object to certain data processing activities
- Right to object to profiling: Object to automated decision-making
To exercise these rights, email us at berksancak6161@gmail.com. We will respond within 30 days.
8. Notifications
You are asked for permission to send push notifications when you first open the app. If you decline, no notifications are sent. You can change notification permissions at any time in your device settings.
9. Cookies & Tracking
This website may use technically necessary cookies only for session management. Third-party tracking or analytics cookies are not currently active.
No cookies are used in the mobile app. Authentication tokens are stored in the device's secure storage (FlutterSecureStorage).
10. Children's Privacy
SmartCloset is not directed at individuals under 13. We do not knowingly collect personal data from children under 13. If we become aware of such a case, we will delete the relevant data immediately.
11. International Data Transfers
Your data may be transferred to countries where our service providers are located (primarily the US and EU). Such transfers are made with appropriate safeguards under the GDPR, including standard contractual clauses.
12. Policy Changes
We may update this Privacy Policy from time to time. For significant changes, we will notify you via an in-app notification or email. Continued use of the app after changes are published constitutes acceptance of the updated policy.
The "Last updated" date at the top of this page indicates when the policy was last changed.
13. Contact
If you have questions or requests about this Privacy Policy, please contact us:
SmartCloset
Email: berksancak6161@gmail.com