← Back to the app

Privacy policy

As of 25 October 2026

This is an English translation for your convenience. In case of doubt, the German version applies.

This page explains which personal data function processes, for what purpose, on which legal basis, for how long, and what rights you have.

1. Controller

Kamil Ryczko
Werster Straße 151
32549 Bad Oeynhausen
Germany
Email: [email protected]

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

3. Visiting the website (Cloudflare)

The website is delivered via Cloudflare Pages by Cloudflare, Inc. (San Francisco, USA). Cloudflare also manages the DNS records of our domain. With every visit, Cloudflare processes technically necessary data: your IP address, date and time, the address requested, the browser type and the operating system. This data is needed to deliver the site and to protect it against attacks.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is a secure, fast and working website.

Storage period: Cloudflare stores this log data only as long as necessary for operation and security and deletes it afterwards.

Transfer to the USA: Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR). In addition, Cloudflare's data processing agreement with the EU Standard Contractual Clauses applies. Privacy at Cloudflare

4. Account, profile and content (Supabase)

Accounts, database and photo storage are operated for us by Supabase Pte. Ltd. (Singapore) as a processor under Art. 28 GDPR. The data is stored on servers in Frankfurt am Main, Germany. On our behalf, Supabase also sends the emails confirming your email address.

Which data

Before upload, photos are resized and re-saved in your browser. Embedded metadata such as the location (GPS) is removed in the process.

Publicly visible are profile, photos, posts, likes and followers – to everyone, even without an account. Email address and password are never public.

Legal basis: Art. 6 (1) (b) GDPR (providing the app you use). For the log data, Art. 6 (1) (f) GDPR (secure operation).

Transfer outside the EU: Where Supabase or its sub-processors process data outside the EU, for example in support, this is based on the EU Standard Contractual Clauses (Art. 46 GDPR) in Supabase's data processing agreement. Privacy at Supabase

5. AI detection of outfits (Anthropic)

When you tap “Analyse outfit” during upload or choose a profile picture, we send the photo to the AI Claude by Anthropic, PBC (San Francisco, USA). The AI first checks whether the photo is permitted (e.g. no nudity, no extremist symbols) and then, for outfits, suggests the clothing items and the style. It does not recognise or identify people. Before posting, you check the detected pieces under “Is this right?”.

If a photo passes the check, we store it immediately so that you can post it. If you don't post it, we delete it after one day at the latest. If the AI rejects a photo, we don't store the photo, only your user ID, the reason for the rejection and the time, in order to detect repeated violations.

To enforce a daily limit for the AI, we store your user ID and the time for every analysis.

Legal basis: Art. 6 (1) (b) GDPR (the analysis is a function you trigger yourself). For the daily limit, the safety check and the log of rejected uploads, Art. 6 (1) (f) GDPR (protecting users, protection against illegal content, abuse and costs).

Transfer to the USA: Anthropic processes the data as a processor. The transfer is based on the EU Standard Contractual Clauses (Art. 46 GDPR) in Anthropic's data processing agreement. According to Anthropic, data from the API is not used to train its models and is generally deleted after 30 days. Privacy at Anthropic

Please only upload photos that show yourself or whose depicted people have agreed.

6. Reports and moderation

Anyone can report posts via “Report”. In doing so, we process the information from the form: reason, description, email address, optionally your name and – if you are signed in – your user ID. We use the data to review the report, to contact you and, if necessary, to request proof. Only the operator sees the data; the person whose post was reported does not learn your name or email address unless this is strictly necessary to resolve the matter and you agree.

If we remove a post or suspend an account, we store a suspension note and inform the person concerned by email, stating the reasons.

Legal basis: Art. 6 (1) (c) GDPR in conjunction with Art. 16 and 17 of the Digital Services Act (DSA), and Art. 6 (1) (f) GDPR (protecting the rights of third parties and a safe platform).

7. Storage in the browser

When you sign in, the app places a sign-in key in your browser's storage (local storage) so that you stay signed in. It is deleted when you sign out. This is strictly necessary for signing in (§ 25 (2) no. 2 TDDDG).

Language: On your first visit, the app shows the language set in your browser (German or English). Nothing is stored or transferred for this. If you choose a language yourself at the top (DE/EN), we store this choice in your browser's local storage so that the site appears in your language on your next visit. This is strictly necessary for the setting you requested (§ 25 (2) no. 2 TDDDG). You can delete the choice by removing the website data in your browser.

Light/dark: The site appears in light mode by default. If you switch dark mode on or off at the top, we store this choice in your browser's local storage so that the site stays that way on your next visit. This is also strictly necessary for the setting you requested (§ 25 (2) no. 2 TDDDG) and is not transferred. You can delete the choice by removing the website data in your browser. We do not use any other cookies or similar technologies.

8. Links to shops

When you tap “Go to shop” or “Search”, the respective shop's page opens. We do not pass on any personal data to the shop. From then on, the shop's privacy policy applies.

9. Storage periods

To have your account deleted, email the address above. We will then delete your account, profile, posts, photos, likes and follows.

10. Do you have to provide data?

You are not legally obliged to. Without an email address and password, however, you cannot create an account and therefore cannot post outfits, like them or follow creators. You can view everything without an account.

11. No automated decision-making

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. The AI makes suggestions about clothing items and style and checks photos for impermissible content before publication. If it rejects a photo, only this photo is not published; a human always decides on removing published content or suspending accounts. If you think a rejection is wrong, email us.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Simply email us.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

13. Right to object

You can object at any time, on grounds relating to your particular situation, to the processing of your data insofar as it is based on Art. 6 (1) (f) GDPR (legitimate interest) (Art. 21 GDPR). We will then no longer process this data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. An email to the address above is sufficient.

14. Changes

If the app changes, we will update this policy. The version published here applies.