Privacy Policy

Last Updated: January 31, 2026

1. Introduction

OtFit AI ('Service') values your privacy and complies with applicable data protection laws. This Privacy Policy explains how we collect, use, and protect your personal information when you use our Service.

2. Information We Collect

2.1 Required Information

• Email address: Account creation and authentication
• Nickname: User identification within the service

2.2 Optional Information

• Gender, age group, height, body type: Personalized virtual try-on
• Face photo (Plus/Pro only): AI virtual try-on image generation
• Wardrobe images: Clothing management and outfit recommendations
• Story content: Posted images, captions, anonymity preference

3. Purpose of Data Collection

• Service provision: Virtual try-on, AI style recommendations
• Account management: Registration, authentication, customer support
• Service improvement: Usage analytics, quality enhancement
• Payment processing: Subscription management (via RevenueCat)
• Social features: Story sharing, likes, report processing
• Ad display: Personalized advertising (Free/Plus tiers)

4. Third-Party Sharing

Information may be shared with the following third parties for service provision:

• Google (Firebase): Authentication, data storage, image storage
• Google AI (Gemini 2.5 Flash): AI outfit generation and clothing analysis
• Replicate.com: Face swap AI service for virtual try-on (Plus/Pro only)
• RevenueCat: Subscription payment management
• Google AdMob: Ad serving (Free/Plus tiers)

4.1 Face Data Handling by Third Parties

When you use the face upload feature (Plus/Pro tiers), your face photo is sent to Replicate.com for AI-powered face swap processing. Replicate is a third-party AI service provider that enables realistic face integration into generated outfit images.

What Replicate does with your face data:

• Purpose: Process face swap requests to generate personalized try-on images
• Storage: Replicate temporarily stores input images (including face photos) for technical processing
• Retention period: Face data is automatically deleted within 1 hour after processing completes
• Why this duration: The 1-hour retention allows users to retrieve their results and ensures system reliability. After this period, all input data (including your face photo) is permanently deleted from Replicate's servers
• Data location: Replicate's servers are located in the United States
• Privacy policy: https://replicate.com/privacy
• Data retention documentation: https://replicate.com/docs/topics/predictions/data-retention

Important: Your face photo is NOT permanently stored by OtFit AI or Replicate. Each time you use the face upload feature, you must upload your face photo again because:

• We do NOT save your face photo on our servers (privacy protection)
• Replicate automatically deletes it within 1 hour after processing
• This "upload every time" approach ensures maximum privacy for sensitive biometric data

Ads are served through Google AdMob. Google may collect device information, advertising identifiers (IDFA/GAID), and app usage data for ad display. Please refer to Google's Privacy Policy for more details.

5. Data Retention and Deletion

• Account data: Deleted within 30 days of account closure
• Face photos:
  • NOT stored on OtFit AI servers (uploaded each time for privacy protection)
  • Temporarily stored by Replicate.com for processing: Automatically deleted within 1 hour after processing
  • You must upload your face photo each time you use the feature because we do not permanently store it
• Wardrobe images: Deleted within 30 days of account closure
• Generated images: Tier-based retention (Free: 10 most recent, Plus: 50, Pro: 100). Older images are automatically deleted when limits are exceeded
• Stories: Automatically deleted 24 hours after posting
• Report records: Retained for service operation (deleted when account is closed)
• Dormant accounts: Processed after 1 year of inactivity with prior notice

6. Your Rights

You have the following rights regarding your personal data:

• Access: Request to view your collected data
• Rectification: Request to correct inaccurate data
• Erasure: Request to delete your data (right to be forgotten)
• Restriction: Request to restrict processing
• Portability: Request to download your data
• Withdrawal: Withdraw consent for data processing

7. Data Security

• Encryption: Data encrypted in transit and at rest
• Access control: Only authenticated users access their data
• Secure infrastructure: Firebase/Google Cloud security certifications

8. Children's Privacy

This Service is not intended for children under 14 years of age. If we learn that we have collected personal information from a child under 14, we will delete that information immediately.

9. International Transfers

Your data may be transferred to servers located in the United States for service provision. These service providers maintain appropriate data protection standards.

10. Policy Changes

If this policy changes, we will notify you via in-app notification or email. Significant changes will be announced at least 30 days in advance.

11. Contact Us

For privacy-related inquiries, please contact us at:

biglolnate@gmail.com