Privacy Policy

Last Updated: August 13, 2026

1. Introduction

OtFit ('Service') values your privacy and complies with applicable data protection laws. This Privacy Policy explains how we collect, use, and protect your personal information when you use our Service.

2. Information We Collect

2.1 Required Information

• Email address: Account creation and authentication
• Nickname: User identification within the service
• Age eligibility: A date of birth is processed only momentarily to determine whether you are at least 18 years old. The date of birth is not stored; only the 18+ eligibility result, policy version, Firebase Auth account generation (account creation time), and confirmation time are recorded
• Service account identifier: Account and session management

2.2 Optional Information

• Display name: Account initialization and profile prefill when provided by Google or Apple sign-in or an existing authentication profile
• Social sign-in provider identifiers: Authentication when Google or Apple sign-in is chosen
• Gender, age group, height, weight, body type: Personalized virtual try-on and face-photo-based model generation
• Full-body photo: AI virtual try-on image generation
• Face photo: Creation of a private full-body model using profile information
• Wardrobe images: Clothing management and outfit recommendations
• Lookbook and Story content: Private saved looks and, when the limited Story pilot is available, explicitly published images, captions, and anonymity preference
• Wardrobe reward device verification: Limited device-recall state and a pseudonymous HMAC digest of a random installation token
• Push-notification registration token and related device and app information: Notification delivery after notification permission

2.3 Private AI-Generated Result Reports

You can report a private AI-generated result in the App without sharing it publicly. A report records the account and account-generation identity, immutable result or reference identifier and digest, selected fixed reason, server timestamps, and moderation status. No image is re-uploaded and no free-form text is collected. The report, moderation queue, and request receipt remain private, are used only for safety and moderation, and are deleted through account deletion. A reported pending full-body model candidate's already-owned private image artifact may remain under a moderation hold until terminal review or account deletion. No duplicate image is uploaded to or stored in the report documents. Operator access is restricted, and mobile clients cannot read moderation queue state.

3. Purpose of Data Collection

• Service provision: Virtual try-on, AI style recommendations
• Account management: Registration, authentication, customer support
• Service improvement: Usage analytics, quality enhancement
• Payment processing: subscription and one-time pass purchase management (via RevenueCat)
• Private Lookbook: Saving and revisiting generated looks
• Limited Story pilot: Explicit public sharing, likes, and report processing when the feature is available
• Ad delivery and reward verification, when advertising is enabled and shown: Free/Plus banner ads and optional rewarded ads
• Abuse prevention: Prevent duplicate wardrobe-completion rewards and service misuse

4. Third-Party Sharing

Information may be shared with the following third parties for service provision:

• Google (Firebase): Authentication, data storage, image storage
• Firebase Cloud Messaging: Notification registration and delivery after notification permission, using a push-notification registration token and related device and app information
• Firebase App Check: Essential app and device integrity attestation at app start and periodically through Apple App Attest/DeviceCheck or Google Play Integrity. These signals protect the Service from abuse and are not used for advertising or user profiling
• Google Sign-In: When chosen, processes the Google account identifier, profile name, email address, and ID token for sign-in
• Sign in with Apple: When chosen, processes the Apple account identifier, email address and, when Apple provides them, full name and identity token for sign-in
• Google AI (Gemini API, including the Nano Banana 2 image route): Clothing analysis, outfit generation, virtual try-on, and private full-body model generation
• Replicate: Face-photo processing for requests handled by the legacy face-swap path
• RevenueCat: Subscription and in-app purchase management
• Google AdMob: Free/Plus banner ads and user-initiated rewarded ads when advertising is enabled and shown in the App
• Apple DeviceCheck: Limited reward-recall state on iOS devices
• Google Play Integrity Device Recall: App and device integrity and limited reward-recall state on Android devices

4.1 Personal Photo Processing by Google Gemini and Replicate

When you choose a full-body or face photo, the photo and the fitting inputs needed for the requested feature are sent to Google Gemini. For a request handled by the legacy face-swap path, your face photo and the Gemini-generated image are also sent to Replicate for face-swap processing. A face-photo model request may also process your gender, height, weight, body type, and age group. Nationality is neither collected nor inferred.

How the Service handles personal photos and generated models:

• Original photo: Not saved to your account storage and not retained in OtFit's own systems after the request is processed
• Google logging: Google may retain API input and output logs for up to 55 days under its service terms
• Replicate processing: Replicate applies its current terms, privacy policy, and data-retention documentation. OtFit does not promise a provider-side deletion interval
• Unconfirmed candidate: Kept privately for review for up to 24 hours, then automatically deleted. However, an already-owned private image artifact for a reported unconfirmed candidate may remain under a moderation hold until terminal review or account deletion.
• Confirmed model: Kept privately until it is replaced, you delete it, or you delete your account
• Generated try-on: Saved in your private account history (My Lookbook)

The production release temporarily disables advertising. If advertising is enabled and shown in a later version, ads are served through Google AdMob. Google may collect device information, advertising identifiers (IDFA/GAID), app usage data, and ad transaction data for ad delivery and verified rewards. Rewarded ads run only when you choose an option shown in the App; privacy or advertising consent alone never starts an ad.

5. Data Retention and Deletion

• Account data: Most app data is deleted immediately when account deletion is processed. A one-way hash of your email may be retained on a limited basis to prevent abusive re-registration
• Original full-body and face photos: Not saved to account storage or retained in OtFit's own systems after processing
• Unconfirmed full-body model candidate: Kept privately for up to 24 hours, then automatically deleted. However, an already-owned private image artifact for a reported unconfirmed candidate may remain under a moderation hold until terminal review or account deletion.
• Confirmed full-body model: Kept privately until it is replaced, deleted by you, or removed with account deletion
• Wardrobe images: Deletion is attempted immediately when account deletion is processed
• Generated images: Kept in your private account history (My Lookbook) within the plan's history limit and included in account deletion
• Stories: Only an explicit public share enters the limited Story pilot; published Stories are automatically deleted 24 hours after posting
• Rewarded-ad credits: Expire 7 days after verified issuance; grant timestamps are processed while weekly and rolling-30-day limits are enforced
• One-time pass duplicate-grant prevention record: An HMAC-based pseudonymous transaction record is retained for the lifetime of the service. It contains no UID, email, raw transaction ID, or balance and is not used to restore passes, recreate accounts, or for marketing. Account deletion removes remaining passes and refund debt; they cannot be recovered or transferred to a new account
• Wardrobe reward abuse-prevention record: Limited device-recall state, a pseudonymous HMAC installation-token digest, platform, claim month, policy version, and expiry are kept for no more than 14 months from the claim month, then deleted by TTL. Raw verification tokens and hardware identifiers are not stored
• Report records: Retained for service operation (deleted when account is closed)
• Dormant accounts: Processed after 1 year of inactivity with prior notice

6. Your Rights

You have the following rights regarding your personal data:

• Access: Request to view your collected data
• Rectification: Request to correct inaccurate data
• Erasure: Request to delete your data (right to be forgotten)
• Restriction: Request to restrict processing
• Portability: Request to download your data
• Withdrawal: Withdraw consent for data processing

7. Data Security

• Encryption: Data encrypted in transit and at rest
• Access control: Only authenticated users access their data
• Secure infrastructure: Firebase/Google Cloud security certifications

8. Age Restriction and Minors' Privacy

This Service is available only to users at least 18 years old. Users determined to be under 18 cannot use AI, wardrobe, history, Story, advertising, or purchase features; only sign-out and account deletion remain available. The date of birth is not stored. If we learn that a minor's information was collected through another route, we will verify and delete it.

9. International Transfers

Your data may be processed outside Korea over encrypted networks. Processing locations and retention terms differ by provider:

• Firebase Authentication: Processes email addresses, user IDs, and authentication records in United States data centers during account creation, sign-in, and verification
• Google Sign-In: When chosen, the Google account identifier, profile name, email address, and ID token may be processed in countries where Google or its agents maintain facilities for sign-in
• Sign in with Apple: When chosen, the Apple account identifier, email address, optional full name, and identity token may be processed in countries where Apple or its agents maintain facilities for sign-in
• Firebase Cloud Messaging: After notification permission, the push-notification registration token and related device and app information may be processed in countries where Google or its agents maintain facilities for notification registration and delivery
• Firebase App Check: At app start and periodically, app and device integrity signals may be processed where Google, Apple, or their agents maintain facilities and retained under their security-service policies
• Cloud Firestore: Processes and stores profile, wardrobe, history, Story metadata, and operational data in the United States Central multi-region (nam5) while you use the Service
• Gemini API: May process input images, profile data, settings, and generated results in countries where Google or its agents maintain facilities when a virtual try-on or private full-body model is requested. Gemini API inputs and outputs may be logged for 55 days for abuse monitoring
• Replicate (legacy face-personalization path): The face photo and Gemini-generated image may be transferred to Replicate systems outside Korea to process that request
• RevenueCat: Processes user ID and subscription and purchase status in the United States during app sign-in, purchase, restoration, and subscription changes, and retains it under contractual instructions for up to the termination or expiry of the agreement
• Apple DeviceCheck: When wardrobe-reward eligibility is checked, limited iOS device-recall state may be processed in countries where Apple or its agents maintain facilities and retained under Apple retention policies
• Google Play Integrity Device Recall: When wardrobe-reward eligibility and Android app and device integrity are checked, limited device-recall state may be processed in countries where Google or its agents maintain facilities and retained under Google retention policies
• Cloud Storage and AdMob: May process stored images and ad-request information, respectively, in countries where Google or its agents maintain facilities

10. Policy Changes

If this policy changes, we will notify you via in-app notification or email. Significant changes will be announced at least 30 days in advance.

11. Contact Us

For privacy-related inquiries, please contact us at:

biglolnate@gmail.com