PRIVACY

Privacy for OUTFIT ENVY

This privacy policy describes how OUTFIT ENVY handles account information, photos, purchases, and support requests.

Account information and mail

When you create an account, OUTFIT ENVY keeps your name, email address, a protected password verifier when you choose password sign-in, sign-in sessions, account status, credit activity, and chosen background material. The background material personalizes the app's appearance and follows the account across signed-in devices. If you choose Apple or Google sign-in, it also keeps the provider name, that provider's account identifier for OUTFIT ENVY, and the verified email the provider supplies. For Apple sign-in, an encrypted refresh credential is kept so the provider connection can be revoked when it is disconnected or the account is deleted, along with Apple's latest reported private-email forwarding status so account mail is not sent to a disabled relay address. Raw Apple and Google identity tokens, Apple authorization codes, and raw Apple refresh credentials are not kept. Password-reset and emailed-deletion credential tables store only protected one-time token hashes. A separately keyed encrypted mail outbox temporarily contains the recipient and complete one-time link, or a refund acknowledgement, until delivery, expiry, cancellation, or account deletion, then scrubs the encrypted payload. Mail-provider delivery is at-least-once: a retry can send a duplicate if the provider accepted the first message but its acknowledgement was lost.

To protect sign-in and Apple account-notification endpoints from abuse, the server normalizes the connection IP address and immediately turns it into a one-way SHA-256 client fingerprint. Only that hash enters a bounded, process-local rate-limit registry; attempts count in a rolling 15-minute authentication window, so this is not treated as processing only for one real-time request. The app does not write the raw address or fingerprint to an account, database, backup, analytics service, or advertising system, and does not share it with another company. Expired attempts cease to count and expired buckets are reclaimed.

Photos and created images

When you submit a clothing swap, the app processes the two photos you chose. The created image and both input photos stay together in a private, account-bound service record for up to three days. Recent shows only the created image. The browser can keep that created PNG, never either selected source photo, in an account-bound IndexedDB device cache for no longer than the same three-day window. Expired device copies are purged even while signed out. Before server-side account deletion, the browser clears that account's cache or saves a durable local account-purge marker so cleanup resumes after a restart. You can delete a result sooner, and account deletion removes the remaining live-service copy. OpenAI processes photos needed for the requested generation under its own published API data policies.

Purchases, app activity, and support

Credits are granted only after the server verifies a store transaction. The app retains the protected minimum needed to prevent duplicate grants, restore eligible credits, and handle a valid store revocation. For an unconsumed Google Play purchase, a separate durable queue keeps the purchase token encrypted at rest until Play reports it consumed or the purchase is revoked, then scrubs the token ciphertext; the raw token is not stored in the account record or returned to the app. Limited records of completed clothing-swap actions, repeated user-correctable photo errors, security events, refund requests, and support actions are used for app functionality, account support, and abuse prevention. If you use the app’s Photo refund support path, the selected created image and its two private inputs are available only to the authorized owner for review during the same retention period.

Report an AI image

Report image in Help lets you flag offensive or unsafe generated content within the app. OUTFIT ENVY keeps your account and selected result references, a report category, and optional details of up to 500 characters. An authorized owner can review the reported generated image and report details, without viewing the input photos through this workflow, to address safety concerns and improve content filtering and moderation. Reporting does not change credits or request a refund. Reports and owner review notes are deleted with the result/account or at the result's original three-day expiry; reporting never extends retention. A limited owner-access and review-outcome audit excludes report text and image bytes. Encrypted backups follow the retention below.

Backups and recovery

Owner-controlled daily SQLite backups can include account, purchase, queued-mail, private-photo, and image-report records present at the backup point. Each managed artifact is authenticated and encrypted with AES-256-GCM under a separately held key; we retain the newest 14 daily backup artifacts. Daily backup is not zero-RPO, so newer changes can be lost during recovery. Live deletion does not rewrite an older encrypted backup. Verification uses private temporary storage, restoration is an explicit offline owner action, and later transactions and deletion requests must be reconciled before a restored service returns online. Older backup artifacts age out as successful daily backups replace them.

Delete your account

You can delete your account in OUTFIT ENVY or use the account deletion page. The web page accepts an existing password or emails a protected, one-time deletion link to the account address, including for Apple- or Google-only accounts. The link expires after 15 minutes, is stored as a hash in its credential table, is temporarily present only inside the encrypted delivery message described above, and still requires an explicit final confirmation. Deletion revokes OUTFIT ENVY sign-ins and removes the account's live personal profile, linked Apple or Google identity record, queued personal mail payloads, and private images. The browser also clears its device Recent cache or retains its local cleanup marker. When Apple sign-in is connected, OUTFIT ENVY attempts to revoke that provider authorization after deletion is confirmed. Local account data is still erased if Apple is unavailable, the encrypted credential is not kept for a retry, and the confirmation provides the manual Apple Account action when needed. Only the minimum non-personal financial and security record needed for lawful reconciliation may remain. Older encrypted backups remain until retention rotation and require deletion reconciliation before restore.

Questions

A public support mailbox is being configured before launch.