Privacy policy

FitFindr is run by its owner in New Zealand (“we”, “us”). It learns your taste to find clothes you'll like, so it handles a fair amount of personal information. This policy explains what we actually collect, where it goes, how long we keep it and what you can do about it. We handle personal information under New Zealand's Privacy Act 2020.

Who can use FitFindr

You need to be 16 or older to create an account or use FitFindr.

What we collect

• Account: your name, email address and password. The password is stored only as a bcrypt hash, never as the password itself. We also keep whether and when you verified your email, any Google or GitHub sign-in you link (the provider's account id, email and profile photo link), your plan and when it renews, and, if you pay, a Stripe customer and subscription reference.
• Style profile: who you shop for, the styles, colours and fits you pick, your budget per item and per outfit, your sizes, optional height and weight, your climate, your try-on mannequin settings, the home city you choose for weather (never your device's location) and the colour palette from colour analysis.
• Likes and choices: likes, passes, saves, try-ons and taps through to a store.
• Browsing signals: while you're signed in, which pieces and photos you see and for how long, zooms, swipes between photos, pieces you come back to or scroll quickly past, sizes you pick, shares, outfit edits and buy taps. Each comes with a random id for that browser tab so a sitting can be grouped.
• Closet and outfits: pieces you add (name, size, price paid, purchase date, store and photo cut-out), outfits, your wear log, week plans, trips (destination and dates), fit feedback (the size you bought and how it fit), your clothing budget, notification choices, quiet hours, time zone and email digest choices (off, daily or weekly, the hour and which alerts go in).
• Stylist chats: your messages to the AI stylist and its replies.
• Photos: only when you use a photo feature. See Photos below.
• People you shop for: if you add a profile for someone else, such as a partner or parent, we keep the name you give it and its own taste, sizes, saves and closet. Only add someone who is happy for you to do so.
• Things you share: polls, boards, gift lists, group looks and challenge entries you create, with your first name only if you choose to show it. When someone votes on a poll or marks a gift as bought, we keep a keyed hash of a random device cookie and of their IP address (never the address itself), plus any comment they leave.
• Connected apps: if you connect FitFindr to another app, such as an AI assistant, we keep which app it is and hashed access tokens.
• Security records: keyed hashes of the IP address and email used to sign in, sign up or reset a password, used to limit repeated attempts; hashed one-time links for email verification and password reset; and a log of the account emails we send.
• Usage counts: how many AI features you've used this month and today, for plan limits.

Photos

• AI photo try-on: the photo you upload is stored on our server, along with the renders made from it, until you delete it. To make a render, your photo and the product photos are sent to OpenAI (or to Replicate, if that service is switched on). Mannequin try-ons don't use a photo of you.
• Rate my outfit: your photo is read on our server to find the garments, then sent to OpenAI with your face blurred for feedback. The photo is deleted afterwards unless you tick the option to keep it. The rating itself is saved.
• Outfit selfies and colour analysis: a selfie used to log what you wore, or to find your colour palette, is processed in memory on our server. It is never saved and never sent to anyone. Colour analysis keeps only the resulting palette.
• Photo search: the photo is re-saved without its location and camera data, processed on our server and available with its results for 24 hours. A photo you share to the installed app from another app is re-saved the same way and available for up to 15 minutes until photo search picks it up. Expired files are removed by scheduled cleanup, as described below.
• Moodboards: each image is read in memory into colours, shapes and numbers that describe it. The image itself is not kept. A board may be named by OpenAI using only those derived words.
• Closet photos: a photo of a piece is cut out on our server. A cut-out you add to your closet is kept until you remove the piece. One you don't add expires after 24 hours and is removed by scheduled cleanup.
• Order emails and screenshots: when you import pieces from an order, the text or screenshot is sent to OpenAI to read the items. We don't keep the email or screenshot, only the pieces you confirm.

How we use your data

• To personalise your feed, outfits, sizes, deals and alerts.
• To run the features you use, like the stylist, try-on, closet and sharing.
• To spot what's popular, using likes from all shoppers combined, without names attached.
• To send account emails, like email verification and password reset links.
• To email you a digest of your alerts, only if you turn it on in Settings.
• To keep FitFindr secure and stop abuse.

Price drops and other alerts appear in your Inbox in the app. If you turn on the email digest (it's off unless you do, and needs a confirmed email address), we also email you a daily or weekly summary of those alerts, with a one-click unsubscribe link in every email. We don't send marketing emails, we don't show ads and we don't sell your personal information.

Where your data is processed

Your data is stored on a single server that the owner runs. The taste model, photo search, colour analysis and most matching run there. Some features send data to other services:

• OpenAI, through the owner's Codex (ChatGPT) account: the AI stylist, ask about this piece, AI photo try-on, order import, rate my outfit, naming your feed tabs and moodboards, reading taste rules and dress codes you type, and the weekly edit intro. Each request carries what that feature needs, for example your message or photo, your first name, profile, sizes, budget, a summary of your taste and closet pieces the stylist looks up. Stylist conversations are saved by Codex as transcripts in its sessions folder on our server. Other requests are one-off and not kept there. When these AI features are off, simpler versions run on our server instead.
• Anthropic (only if switched on): Claude can answer the stylist and ask about this piece instead of OpenAI, with the same kind of information.
• Replicate (only if switched on): AI photo try-on, with your photo and the product photo.
• TypeSafe (only if switched on): re-orders your feed. It gets text descriptions of up to 10 pieces you liked and 6 you passed on, your chosen styles, the department you shop and descriptions of the pieces being ranked. It never gets your name, email or account id.
• Stripe (only for paid plans): takes payments. Stripe gets your name, email and account id, and handles your card details itself. We never see or store your card number.
• Google and GitHub: only if you sign in with them. We receive your name, email, whether it is verified and a profile photo link.
• An email provider: Resend or an SMTP mail service delivers account emails and, if you turn it on, the email digest (your address and the alerts in it). Production delivery requires a configured provider. Our production email log keeps delivery details, not verification/reset links or the message body, including when delivery fails.
• Open-Meteo: our server sends the city name you search, or the rough location of your saved city or trip, to get forecasts. Nothing about your account is sent.
• Retailers: when you tap through to a store, you're on their site and their privacy policy applies. When you paste a product link, our server fetches that page.
• Apps you connect: an app you connect can read and act on your account within the access you grant. What it does with the data is covered by its own terms.

Most of these services are based in the United States, so your information may be processed outside New Zealand. We only send each one what the feature needs.

How long we keep it

• Photo searches: 24 hours. Photos shared to the installed app: up to 15 minutes before the search starts.
• Pasted product links: 24 hours.
• Closet photo cut-outs you don't add: 24 hours.
• Rate my outfit photos: deleted straight after the rating, unless you choose to keep them.
• Outfit selfies and colour analysis photos: never stored.
• Sign-in attempt records: about 24 hours after the last attempt, or until a lockout ends.
• Email verification and password reset links: they expire after 24 hours and 30 minutes, and the records are deleted a day after that.
• Account email log (including email digests): 7 days. A record of which digests were sent (the date and how many alerts, not what they said) is kept for 120 days.
• Connected app access: access tokens last 1 hour and refresh tokens 60 days, unless you disconnect the app sooner.
• Stylist transcripts saved by Codex: until you delete your account (see Your rights).
• Everything else, including your account, profile, likes, browsing signals, closet, wear log, chats, try-on photo and renders, kept outfit photos, moodboards, notifications and usage counts: until you delete it or delete your account.

You can clear your stylist chat, reset your taste (which removes your likes and browsing signals) and delete your try-on photo at any time. Records of taps through to stores stay as anonymous counts after your account is deleted, with nothing linking them to you.

Cookies and local storage

FitFindr only sets its own cookies. They are all needed for sign-in, security or features you use. There are no analytics, advertising or third-party tracking cookies.

• ff_session: keeps you signed in. 30 days.
• ff_profile: remembers which profile you're shopping for. 30 days.
• ff_likes: remembers likes you make before signing in, so they carry over to your new account. 90 days, removed when you sign in.
• ff_device: a random id so public polls and gift lists allow one vote or mark per device without an account. About 13 months.
• ff_plan_intent: remembers the plan you picked while you finish signing up. 1 day.
• oauth_state_*, oauth_verifier_*, oauth_next and oauth_link: protect Google or GitHub sign-in, note when you're linking one to your account, and return you to the right page. 10 minutes.

Expired photo-search files, shared photos and unconfirmed closet cut-outs become unavailable at the stated deadline. Our server checks for expired data at startup and every minute, in bounded batches. Physical removal normally follows on the next cleanup pass, but can take longer during outages or a cleanup backlog.

Your browser also keeps a few settings in local storage on your device, like light or dark mode, whether the sidebar is collapsed, your compare tray and a few dismissed tips. A random id for each browser tab, used to group browsing signals, lives in session storage and is cleared when you close the tab.

Retailers and affiliate links

Links to stores may carry an affiliate tag or a store discount code, and we may earn a commission if you buy. This never raises the price you pay and it doesn't affect how pieces are ranked for you.

Security

• Passwords are hashed with bcrypt.
• Email addresses can be verified with a one-time link.
• Repeated sign-in attempts are rate limited, with longer lockouts for repeat offenders.
• You can sign out of all your devices at once from Settings.
• Photos are stored in private, per-account folders that only your account can read.

No system is perfectly secure, but we work to protect your data and will tell you if a breach affects you.

Your rights

• Access and export: in Settings, choose Download my data to get a zip of your account data, profiles and available uploaded photos. The zip includes export-manifest.json, which marks the photo export as complete or partial and lists any files omitted because they could not be read or the 200 MiB photo limit was reached. If it is partial, retry or contact the privacy address below for help obtaining the remaining data.
• Correction: edit your profile, sizes and settings in Settings at any time.
• Deletion: in Settings, choose Delete account. This removes your database records, your stored photos and renders, and the stylist transcripts we can link to your account. Transcripts from before September 2026, or ones not linked to your account, may not be identifiable. Contact us and the owner can remove them on request.
• Sign out everywhere: end every session on every device from Settings.
• Changing your mind: delete a photo, clear your chat or reset your taste to stop us using that data.

If you're unhappy with how we handle your information, please contact us first. You can also complain to the New Zealand Office of the Privacy Commissioner at privacy.org.nz.

Changes

If we change this policy in a meaningful way, we'll update the date above and let you know in the app.

Contact

Questions or requests about your data: A privacy contact address has not been configured. Public launch is blocked until one is provided. See also our Terms of service.