PRIVACY AND DATA USE

What we use, and why

OUTFIT ENVY uses the photo you choose and the clothes reference you choose to make a clothing swap. The photos are sent only when you ask us to prepare or create that clothing swap.

Your account

When you create an account, we keep your name, email address, a protected password verifier when you choose password sign-in, sign-in sessions, account status, credit activity, and your chosen background material. If you choose Apple or Google sign-in, we also keep the provider name, that provider's account identifier for OUTFIT ENVY, and the verified email the provider supplies. For Apple sign-in, we keep an encrypted refresh credential so we can revoke the Apple connection when you disconnect it or delete your account, plus Apple's latest reported status for private-email forwarding so we do not send account mail to a disabled relay address. We use these details to let you sign in, connect only the provider account you approve, personalize the app's appearance with your chosen background material, keep account choices together across your signed-in devices, protect your account, and help with support when you ask. We do not keep the raw Apple or Google identity token, Apple authorization code, or raw Apple refresh credential. We also keep limited records of completed clothing-swap actions, repeated user-correctable photo errors, security events, refund requests, and support actions for app functionality, account support, and abuse prevention. If you ask to reset your password or request an emailed deletion link, the credential table keeps only a protected hash of the one-time token. To make accepted mail recoverable after a restart, a separately keyed encrypted outbox temporarily contains the recipient and complete one-time link until it is delivered, expires, is replaced or used, is cancelled, or the account is deleted; the encrypted message is then scrubbed. Mail-provider delivery is at-least-once. If the provider accepts a message but its acknowledgement is lost, a retry can send a duplicate. Password-reset security-event timestamps contain no token.

To protect sign-in and Apple account-notification endpoints from abuse, our server normalizes the connection IP address and immediately turns it into a one-way SHA-256 client fingerprint. Only that hash enters a bounded, process-local rate-limit registry; attempts count in a rolling 15-minute authentication window, so this is not treated as processing only for one real-time request. The app does not write the raw address or fingerprint to an account, database, backup, analytics service, or advertising system, and does not share it with another company. Expired attempts cease to count and expired buckets are reclaimed.

Your photos and clothing swaps

Your chosen photos are processed by our clothing swap service and OpenAI to identify the intended person and clothing reference and make the image. We keep the created image and its two original input photos together in a private, account-bound service record for up to 3 days. Recent shows you only the created image. Your browser may keep that created PNG, never either selected source photo, in an account-bound IndexedDB device cache for no longer than the same three-day window. The app purges expired device copies even while you are signed out. Before server-side account deletion starts, the browser must either clear that account's device cache or save a durable local account-purge marker so cleanup resumes after a restart. You can delete a saved image sooner, and deleting your account removes any remaining live-service copy. If you choose Photo refund in Help, you select one created image from Recent. That places the private three-photo set into an owner-only review queue; the input photos are never shown in the customer app. A refund request does not automatically change credits. Standard support staff cannot browse photos; an authorized owner can open a submitted request, and every review is logged. If you use Take Photo in the Android app, the phone keeps a temporary private camera file only long enough to attach it and schedules deletion within 15 minutes.

OpenAI has its own documented API data controls. Its standard abuse-monitoring records can retain API content and related metadata for up to 30 days in some circumstances. If OpenAI’s automated safety systems flag a possible serious safety issue, it may keep a photo for manual review under its own rules. We do not promise that another service has no retention when its published policy says otherwise.

Report an AI image

Use Report image in Help to flag offensive or unsafe generated content without leaving the app. We keep the selected result reference, your account reference, the report category, and any optional details you submit. Only an authorized owner can review the reported generated image and report details; this report does not expose either input photo to the review screen. Reports help us review safety concerns and improve content filtering and moderation. Reporting does not change credits or request a refund. The report, its details, and owner review notes are deleted with the result or account, or when the result reaches its original three-day expiry. Submitting a report does not extend image retention. We retain a limited audit of owner access and review outcomes, without the report text or image bytes; older encrypted backups follow the retention rule below.

Credits and purchases

When you purchase credits in the installed app, we keep the minimum protected purchase and notification record needed to put valid credits on the right account, restore them after a device change, and handle a store refund or revocation. For an unconsumed Google Play purchase, a separately keyed durable queue keeps the purchase token encrypted at rest until Google Play reports it consumed or the purchase is revoked; the token ciphertext is then scrubbed. The raw Google token is not put in your account record or returned to the app. Account shows you a short list of your own confirmed credit activity, but your App Store or Google Play receipt stays with that store. A normal clothing swap costs 1 credit. The first two user-correctable photo errors are free; later repeated user-correctable errors in the same rolling day can use one credit. An image-provider content-policy block creates no image and does not return the credit used for that request. We do not keep raw payment-card data.

Backups and recovery

Owner-controlled daily SQLite backups can include account, purchase, mail-queue, private photo, and image-report records that existed at the backup point. Each managed backup is authenticated and encrypted with AES-256-GCM under a separately held key; we retain the newest 14 daily backup artifacts. Daily backup is not zero-RPO, so changes after the latest successful backup can be lost during recovery. Deleting live data does not rewrite an older encrypted backup. Backup verification uses private temporary storage, and restoration is an explicit offline owner action. A restored service must stay offline until transactions and deletion requests newer than that recovery point are reconciled; retained backup artifacts age out as successful daily backups replace them.

Support access

Authorized support staff can search an account by name to help with account, credit, deletion, and clothing swap status questions. Their lookups are recorded. The support console does not show your password, session token, provider key, or full store payment token. Standard support account lookups do not show photos; only the authorized owner can open a submitted Photo refund request or reported generated image under the three-day policy. Use Email support in Help if you need assistance with a completed image.

Delete your account

Use the account deletion page to permanently delete your account. The page accepts an existing password or emails a one-time link to the account address, including for Apple- or Google-only accounts. The deletion link expires after 15 minutes, can be used once, is stored as a protected hash in its credential table, and is temporarily present only inside the encrypted delivery message described above; it still requires an explicit final deletion confirmation. We immediately revoke OUTFIT ENVY sign-ins and erase your name, email, password verifier, linked Apple or Google identity record, saved photos, queued personal mail payloads, and the platform account identifiers used to connect purchases to your profile. The browser also clears that account's device Recent cache or retains a local cleanup marker before it sends the deletion. When Apple sign-in is connected, we attempt to revoke that provider authorization after deletion is confirmed. Your local account data is still erased if Apple is unavailable, the encrypted refresh credential is not retained for a retry, and the confirmation tells you how to stop using OUTFIT ENVY in Apple Account settings when manual action is needed. We keep only the minimum opaque financial and audit record required for secure reconciliation, if one is required. Older encrypted backups remain until their configured retention rotation and require the offline deletion reconciliation described above before a restored service can return.

Privacy questions

For privacy questions, contact support@theoryofpositiveexistence.com.