Privacy Policy
Effective November 7, 2026
The short version
- Your photos, briefs, try-ons and looks live on your iPhone and in your own iCloud. We don’t store them on our servers.
- AI providers do receive them. To style a look or make a try-on, what you give us passes through our server to OpenAI or Google. We ask both not to keep it. Each keeps abuse-monitoring logs for a limited time, up to 55 days at Google and 30 at OpenAI, and neither uses it to improve its products or train its models.
- We keep what runs your account: your email address, try-on balance, purchases and usage records, plus analytics that never include your words or pictures.
- We don’t sell your data, show ads, or track you across other apps.
- You can delete your account in the app at any time.
Who we are
Lookcraft is an AI stylist and fitting room for iPhone. It’s run by [company or full legal name], [postal address], which is responsible for your data under this policy (the “data controller” in EU and UK law). This policy covers the app and this website.
What stays on your iPhone
These are kept on your iPhone, and in iCloud if you have it on:
- The photos of you that you add.
- Your briefs and their reference photos.
- Your concepts, looks, try-ons and the photos of pieces you add.
- Your settings, such as who you’re shopping for, your country and your budget.
iCloud sync uses your private iCloud database, under Apple’s terms. We can’t see what’s in it. With iCloud off, everything stays on the iPhone, and deleting the app deletes it.
When you add a photo, Lookcraft checks on your iPhone that your whole body is in frame, that there’s one person and that the light is good. That check doesn’t leave your iPhone, and we don’t use your photos to identify you.
Lookcraft asks for your camera only if you choose to take a photo, and it never asks for your location or contacts. Your country is suggested from your iPhone’s region setting, and you can change it.
What we keep on our server
- Your account: a random account ID, your Apple sign-in identifier, and your email address, or the private relay address if you chose Hide My Email. We don’t ask for your name. We also keep a token from Apple so we can revoke your sign-in when you delete your account.
- Your try-on balance: each time try-ons are added, used or refunded.
- Your purchases: the App Store transaction ID, the pack, its price and currency, your storefront, the date, and any refund. Apple handles payment, and we never see your card.
- Usage records: when you ran a brief or a try-on, the AI model it used, whether it worked, how long it took and what it cost us. These never include your words or pictures.
- Clicks to shops: when you open a shop link from Lookcraft, we log the link, the shop, the product, your country and the time.
- Technical logs: our hosting provider keeps short-lived logs of sign-ins and requests, which can include your IP address and device type.
When you style a look
Your brief, up to three reference photos, who you’re shopping for, your country, your budget and the app’s language pass through our server to the AI that plans the look, which is OpenAI or Google. Our server doesn’t store them. The AI writes search terms for each piece, and we send those to Google Shopping through SerpApi, without anything that identifies you.
When you try a look on
Your photo, the photos and names of the pieces, and any notes you add pass through our server to Google’s Gemini, which makes the picture. On our server, your photo stays in memory only while the try-on runs, and we never store it or log it. What Google keeps is explained below.
Before a try-on starts, a small Gemini model checks the photos of the pieces and your notes. We don’t make try-ons of underwear or swimwear, and we refuse notes that ask for nudity, sexual content or violence.
The finished try-on waits on our server until your iPhone downloads it, and then we delete it. If it’s never downloaded, we delete it after 7 days.
Only add photos of yourself. Try-ons are labelled as AI-generated, and Gemini also adds an invisible SynthID watermark. A try-on is shared only if you share it.
What AI providers do with your data
Google makes try-ons and can also plan looks. We use its paid Gemini service, which is covered by its data processing terms, and Google doesn’t use what we send to improve its products.
- Requests: Google would normally store requests for 55 days. We ask it not to store them, or, for try-ons and looks, to delete each one as soon as it’s done. For a try-on, a request includes your photo, the photos of the pieces, your notes and the finished picture.
- Abuse logs: separately, Google logs prompts and results for up to 55 days to detect violations of its policies. Authorized Google staff can review content flagged in that process.
OpenAI can plan looks, so it can receive your briefs and reference photos. It doesn’t train its models on this data by default. We ask it not to store these requests, and it keeps abuse-monitoring logs for up to 30 days.
We don’t train any AI models on your data ourselves.
Analytics
We use PostHog’s EU cloud to learn which parts of Lookcraft work. Events are sent under your random account ID, or a random ID stored on your iPhone before you sign in, and they cover:
- Your device and app: opening the app, the app’s version, your device model and system version, screen size, language, time zone, and whether you’re on Wi-Fi or mobile data.
- Styling and try-ons: that a brief was sent, whether it had words, how many reference photos it had, the budget, your country and who you’re shopping for. Also looks you view and create, try-ons you start and see, and try-ons we refuse and why.
- Shops and brands: the names of those shown, which shop links you open, including the product’s ID, and whether you come back within seconds.
- Other actions: opening the share sheet or the try-on packs, and the app asking iOS to show a review prompt.
- Purchases: the pack, its price and whether it went through.
- What each request cost us.
Analytics never include your brief’s text, photos, try-ons, product names, full shop links, your email address or advertising IDs. There’s no session recording, no screen tracking, and no location from your IP address.
Shops and product pictures
Product pictures load straight from Google and the shops’ image servers, which see your IP address like any website would. A Buy link opens the shop in your browser, where the shop’s own privacy policy applies. We don’t tell shops who you are.
Today, links go straight to the shop. We plan to send some through Sovrn Commerce so that Lookcraft can earn a commission when you buy. Those links would carry a random click ID, and not your name or email address.
Who receives your data
These providers process data for us. We don’t sell it to anyone.
| Provider | What it receives | Why | Where |
|---|---|---|---|
| Supabase | Your account and usage records, what passes through our server, and finished try-ons until your iPhone downloads them | Runs our server and database | Database in Frankfurt, Germany |
| Google (Gemini) | Your briefs, reference photos, photos of you, photos of pieces, and try-on notes | Makes try-ons, checks pieces and notes, and plans looks | Wherever Google has facilities, including the US |
| OpenAI | Your briefs and reference photos | Plans looks | United States |
| SerpApi | The search terms the stylist writes, with your country and language, and no account details | Finds products on Google Shopping | United States |
| PostHog | Analytics events, as described above | Shows us how Lookcraft is used | Frankfurt, Germany |
| Apple | Your sign-in, purchases and iCloud data, under your agreement with Apple | Sign in, payments and sync | Under Apple’s terms |
We may also disclose data if the law requires it. When data leaves the UK or the European Economic Area, we rely on safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.
How long we keep it
| Photos, briefs, looks and try-ons on your iPhone and iCloud | Until you delete them |
|---|---|
| Your photo and briefs on our server | Only in memory, while the request runs |
| A finished try-on on our server | Until your iPhone downloads it, and 7 days at most |
| What Google receives | Deleted as soon as each request is done, apart from abuse logs kept up to 55 days |
| What OpenAI receives | Not stored, apart from abuse logs kept up to 30 days |
| Your account, email address and try-on balance | Until you delete your account |
| Analytics | Until you delete your account. PostHog’s deletion finishes within days |
| Your try-on balance history | Until you delete your account |
| Try-on and usage records | 90 days. After that we keep only daily totals per AI model, with nothing that links them to you |
| Clicks to shops | Linked to your account for 90 days, then kept without that link for up to 13 months in total, to match commissions from shops |
| Purchase records | 10 years from the purchase, for tax and accounting. If you delete your account, they’re no longer linked to it |
| Technical logs | About a week |
Deleting your data
- Your account: go to the Me tab and tap Delete account. That revokes your Apple sign-in, removes your email address and balance, and deletes your analytics. Unused try-ons are lost.
- Your photos and looks: these aren’t on our servers, so deleting your account doesn’t touch them. Delete them in the app first if you want them gone from your iPhone and iCloud. To delete a photo, long-press it on the Me tab. Try-ons made with it stay until you delete their look.
Your rights
In the EU and UK, you can ask us for a copy of your data, and ask us to correct it, delete it, limit how we use it or send it to you in a portable format. You can also object to how we use it, including for analytics, and complain to your local data protection authority.
We rely on these legal grounds: providing the service you asked for (your account, styling, try-ons and purchases), our legitimate interests (analytics, security, preventing abuse and reconciling costs), and legal obligations (financial records).
In the US, some states give you the right to know what we hold about you, and to correct or delete it. We don’t sell your personal information or share it for targeted advertising.
To use any of these rights, email us. Your photos and looks aren’t on our servers, so you can see and delete those directly in the app.
Age limit
Lookcraft is for people 18 and older, and we ask you to confirm that before you add a photo. If you think someone younger has given us data, email us and we’ll delete it.
Security
Data is encrypted on its way to and from our server. Your account records can be read only by you and our server, and the keys to our AI providers never leave the server. No system is perfectly secure, so we keep as little on it as we can.
This website
This site uses no cookies, analytics or JavaScript, and its fonts load from this site rather than from a font service. It’s hosted on GitHub Pages, which may log visitors’ IP addresses for security, as described in GitHub’s privacy statement.
Changes to this policy
If this policy changes, we’ll update this page and the date at the top. If a change significantly affects how your data is used, we’ll say so here before it takes effect.
Contact
Questions about privacy? Email us at hello@getlookcraft.com.