Privacy Policy

Last Updated: September 28, 2026

1. Introduction

OtFit ('Service') values your privacy and complies with applicable data protection laws. This Privacy Policy explains how we collect, use, and protect your personal information when you use our Service.

For iOS 1.2.6 (56) and Android 1.2.6 (76) and later, the App does not request or display advertising. Earlier releases included Google AdMob; historical verification records and previously issued reward credits may remain only as needed to settle or honor their original terms.

2. Information We Collect

2.1 Required Information

• Email address: Account creation and authentication
• Nickname: User identification within the service
• Service account identifier: Account and session management
• Authentication diagnostics: Firebase user ID, sign-in provider, processing stage, error code and category, app version and build, platform and operating system, device model, random installation ID, request ID, and occurrence time
• Operational statistics: a pseudonymous identifier derived from the signed-in account, date, and counts of screen visits, wardrobe additions and deletions, and try-on starts, completions, and failures. Email, photos, clothing names, and free-form input are excluded

2.2 Optional Information

• Display name: Account initialization and profile prefill when provided by Google or Apple sign-in or an existing authentication profile
• Social sign-in provider identifiers: Authentication when Google or Apple sign-in is chosen
• Gender, age group, height, weight, body type: Personalized virtual try-on and face-photo-based model generation
• Full-body photo: AI virtual try-on image generation
• Face photo: AI virtual try-on or optional private full-body model generation using profile information
• Wardrobe images: Clothing management and outfit recommendations
• Shopping-candidate photos and analysis tags: Pre-purchase outfit comparison and a virtual preview you request; added to the wardrobe only when you choose to save it
• Look feedback: Your Like or Could be better feedback and selected reasons are saved as an evaluation of that look, and are not used for AI recommendations or try-ons
• Lookbook and Story content: Private saved looks and, when the limited Story pilot is available, explicitly published images, captions, and anonymity preference
• Wardrobe reward abuse prevention: A pseudonymous HMAC digest of a random installation token, platform, claim month, policy version, and expiry

2.3 Public Story Reports

In the limited Story feature, you can report only a post that another user explicitly made public. Your own private try-on results and full-body model candidates do not offer a report action. A report records the reporter and post identifiers, selected reason, server timestamps, and moderation status for safety and service operation.

3. Purpose of Data Collection

• Service provision: Virtual try-on, AI style recommendations
• Account management: Registration, authentication, customer support
• Authentication incident diagnosis: Investigating sign-in and session failures and preventing recurrence
• Service improvement: Usage analytics, quality enhancement
• Operations: Aggregating daily user, activity, and try-on processing status to assess service stability and feature quality
• Payment processing: subscription and one-time pass purchase management (via RevenueCat)
• Private Lookbook: Saving and revisiting generated looks
• Limited Story pilot: Explicit public sharing, likes, and report processing when the feature is available
• Existing reward compatibility: Processing previously issued try-on credits and valid pending reward records under their original terms
• Abuse prevention: Prevent duplicate wardrobe-completion rewards and service misuse

4. Third-Party Sharing

Information may be shared with the following third parties for service provision:

• Google (Firebase): Authentication, data storage, image storage, and daily operational statistics using only a pseudonymous account identifier and approved activity counts; operational statistics are automatically deleted after three months
• Firebase App Check: Essential app and device integrity attestation at app start and periodically through Apple App Attest/DeviceCheck or Google Play Integrity. These signals protect the Service from abuse and are not used for advertising or user profiling
• Firebase Crashlytics and Google Cloud Logging: Our custom diagnostic payload uses only allowlisted fields and excludes account, installation, and request identifiers from the Crashlytics payload; Crashlytics may nevertheless collect its own installation identifiers, crash stack, device, and operating-system diagnostics. Detailed records containing UID, installation ID, and request ID are written only to authenticated Cloud Logging. Email, name, date of birth, authentication tokens, user photos, and clothing information are excluded from our custom payload
• Google Sign-In: When chosen, processes the Google account identifier, profile name, email address, and ID token for sign-in
• Sign in with Apple: When chosen, processes the Apple account identifier, email address and, when Apple provides them, full name and identity token for sign-in
• Google LLC AI processing service: Clothing analysis, outfit generation, virtual try-on, and private full-body model generation
• RevenueCat: Subscription and in-app purchase management

4.1 Personal Photo Processing by Google LLC's AI Processing Service

When you choose a full-body or face photo, the photo and the fitting inputs needed for the requested feature are sent to Google LLC's AI processing service. A face-photo model request may also process your gender, height, weight, body type, and age group. Nationality is neither collected nor inferred.

How the Service handles personal photos and generated models:

• Original photo: Not saved to account storage. A temporary copy stays on your device while you use the try-on screen. OtFit attempts to remove that copy when you remove or replace the photo or close the try-on screen; your gallery photo is unaffected
• Google logging: Google may retain input and output logs for up to 55 days under its service terms
• Unconfirmed candidate: Kept privately for review for up to 24 hours, then automatically deleted.
• Confirmed model: Kept privately until it is replaced, you delete it, or you delete your account
• Generated try-on: Saved in your private account history (My Lookbook)

The current App does not request or display advertising and does not collect advertising identifiers or ad-request data for a new ad opportunity. Previously issued reward credits and valid pending records may still be processed to honor their original terms.

5. Data Retention and Deletion

• Account data: Most app data is deleted immediately when account deletion is processed. A one-way hash of your email may be retained on a limited basis to prevent abusive re-registration
• Operational statistics: A date-level pseudonymous account identifier and approved activity counts are retained for up to three months to monitor service operations, then automatically deleted
• Original full-body and face photos: Not saved to account storage. A temporary copy stays on your device while you use the try-on screen. OtFit attempts to remove that copy when you remove or replace the photo or close the try-on screen; your gallery photo is unaffected
• Unconfirmed full-body model candidate: Kept privately for up to 24 hours, then automatically deleted.
• Confirmed full-body model: Kept privately until it is replaced, deleted by you, or removed with account deletion
• Wardrobe images: Deletion is attempted immediately when account deletion is processed
• Shopping candidates: A candidate photo and analysis not saved to the wardrobe are kept privately for up to 30 days, then deleted; you can delete them at any time
• Look feedback and existing preference records: Preserved when the preference feature is retired and not used for AI recommendations or try-ons; deleted when account deletion is processed
• Generated images: Kept in your private account history (My Lookbook). Deleting a look from its detail or deleting your account removes the result images and record together
• Stories: Only an explicit public share enters the limited Story pilot; published Stories are automatically deleted 24 hours after posting
• Previously issued rewarded credits: Expire 7 days after verified issuance as stated when issued; valid pending verification records may be retained until their server result is settled or expires
• One-time pass duplicate-grant prevention record: An HMAC-based pseudonymous transaction record is retained for the lifetime of the service. It contains no UID, email, raw transaction ID, or balance and is not used to restore passes, recreate accounts, or for marketing. Account deletion removes remaining passes and refund debt; they cannot be recovered or transferred to a new account
• Wardrobe reward abuse-prevention record: A pseudonymous HMAC installation-token digest, platform, claim month, policy version, and expiry are kept for no more than 14 months from the claim month, then deleted by TTL. Raw App Check tokens and hardware identifiers are not stored
• Report records: Retained for service operation (deleted when account is closed)
• Authentication diagnostic records: Detailed Cloud Logging records containing UID, installation ID, and request ID are restricted to authorized operators and retained for 30 days. Crashlytics may retain crash stack, device, operating-system, and its own installation identifier diagnostics for up to 90 days under Firebase policy
• Dormant accounts: Processed after 1 year of inactivity with prior notice

6. Your Rights

You have the following rights regarding your personal data:

• Access: Request to view your collected data
• Rectification: Request to correct inaccurate data
• Erasure: Request to delete your data (right to be forgotten)
• Restriction: Request to restrict processing
• Portability: Request to download your data
• Withdrawal: Withdraw consent for data processing

7. Data Security

• Encryption: Data encrypted in transit and at rest
• Access control: Only authenticated users access their data
• Secure infrastructure: Firebase/Google Cloud security certifications

8. Age Eligibility

The Service is available only to people aged 18 or older. A date of birth entered during registration is used only to check 18+ eligibility and is not stored in its original form. The server retains only the eligibility result, policy version, and confirmation time. If we learn that a user is under 18 or made a false confirmation, we may restrict the account and handle related information as required by law.

9. International Transfers

Your data may be processed outside Korea over encrypted networks. Processing locations and retention terms differ by provider:

• Firebase Authentication: Processes email addresses, user IDs, and authentication records in United States data centers during account creation, sign-in, and verification
• Google Sign-In: When chosen, the Google account identifier, profile name, email address, and ID token may be processed in countries where Google or its agents maintain facilities for sign-in
• Sign in with Apple: When chosen, the Apple account identifier, email address, optional full name, and identity token may be processed in countries where Apple or its agents maintain facilities for sign-in
• Firebase App Check: At app start and periodically, app and device integrity signals may be processed where Google, Apple, or their agents maintain facilities and retained under their security-service policies
• Firebase Crashlytics and Google Cloud Logging: Authentication diagnostics may be processed for incident analysis in countries where Google or its agents maintain facilities. Crashlytics may retain crash stack, device, operating-system, and its own installation identifier diagnostics for up to 90 days; detailed Cloud Logging records containing UID are retained for 30 days
• Cloud Firestore: Processes and stores profile, wardrobe, history, Story metadata, and operational data in the United States Central multi-region (nam5) while you use the Service
• Google LLC AI processing service: May process input images, profile data, settings, and generated results in countries where Google or its agents maintain facilities when a virtual try-on or private full-body model is requested. Inputs and outputs may be logged for up to 55 days for abuse monitoring
• RevenueCat: Processes user ID and subscription and purchase status in the United States during app sign-in, purchase, restoration, and subscription changes, and retains it under contractual instructions for up to the termination or expiry of the agreement
• Cloud Storage: May process stored images in countries where Google or its agents maintain facilities

10. Policy Changes

If this policy changes, we will notify you via in-app notification or email. Significant changes will be announced at least 30 days in advance.

11. Contact Us

For privacy-related inquiries, please contact us at:

otfit.support@gmail.com