Privacy policy

Effective date: [CHECK: effective date]

Colorsona is run by [CHECK: legal entity / FOP name and address]. Questions or requests: [email protected].

This page says what we collect, why, who sees it and how to delete it.

Who can use Colorsona

You must be 13 or older. We ask for your birth year once. If you are under 13, we block the app and delete anything we hold about you. If you are 13 to 17, a parent or legal guardian must approve before any photo goes to our AI provider. We send them a link by email. They can approve, decline or withdraw later.

We keep your birth year and age band on our server. Friends never see them.

What we collect

• Account. A sign-in ID from Sign in with Apple, or an anonymous ID. Your name, if you set one.
• Photos you give us. Selfie, full-body photo, closet item photos, look check photos, Shop Scan photos and your profile picture. Photos used for a result are processed by our AI provider (see below).
• Results. Your season, palette, contrast level, closet items and their colors, look check results and photos, try-on images and outfit plans.
• Friends. Your name, picture, season, the friends you connect with, season guesses, posts you share with friends, and reports or blocks you file.
• Guardian records (ages 13 to 17). The parent's email while a request is pending or a confirmation is unsent, a hash of that email, the time of each step, the IP address of the parent's device, and the consent version.
• Purchases. Handled by Apple and RevenueCat. We see your subscription status and an app user ID, not your card.
• Location. Only if you allow it, and only for the weather forecast. Your phone sends approximate coordinates to Apple WeatherKit and keeps the coordinates and the forecast on the device. Our server gets a temperature range, never your location.
• Style preferences. What you wear (womenswear, menswear or both) and whether you want makeup tips. We keep them with your account so they come back after a reinstall. We also send the "what you wear" choice with outfit idea, try-on and Shop Scan requests to our AI.
• Device and usage data. Push token and crash reports through Firebase Crashlytics. Also usage events, such as which screens and features you open, and some settings: accessibility settings, appearance, language, season, undertone, age band and style preferences. These go to Google Analytics for Firebase. They are not linked to your account, and we never send your name, email, photos, birth year, free text or friend names. We do not use or share them for ads. Usage stats are on by default, and off by default for ages 13 to 15. You can change this any time in Settings, then Share usage stats.
• Feedback. What you write in the feedback form, your email if we have one, your device model, OS version, language and season.
• Usage counters. How many AI calls you make per day or month, so we can cap cost and abuse.
• Waitlist. If you join the waitlist on colorsona.app, we keep your email, the site language, the date you joined and the date we emailed you. We use it to send a short hello now and one email when the app launches. Nothing else. To leave the list, reply to any of these emails or write to [email protected].

We do not read your body shape out loud or store a body label. The photo you give for fit advice is not kept after the answer.

How we use it

• To give you your season, palette, outfits and checks. This is the service you asked for.
• To run friends features, if you use them.
• To keep the app safe: moderation, reports, abuse limits.
• To fix crashes and improve the app.
• To manage subscriptions and answer support.

We do not sell your data. We do not use your photos to train models. We do not use them for ads. We do not track you across other companies' apps.

Who processes it

• OpenAI. Your selfie, full-body, closet, look check, Shop Scan and try-on photos go to OpenAI through our server so the AI can read them. Friends photos (profile picture and posts) go to OpenAI moderation. We ask OpenAI not to store the content. OpenAI may keep inputs and outputs for up to 30 days for abuse monitoring, and can keep content flagged for child safety longer. [CHECK: update once OpenAI Zero Data Retention is granted and the data processing addendum is signed]
  For a look check we send a copy with your face blurred on your device. For "Show me in" a color and "Try it on", we send the full photo, face included, to make the image.
• Google Firebase. Our database, file storage, server functions, sign-in, push messages, crash reports (Crashlytics) and usage stats (Google Analytics for Firebase). Our Firebase project runs in Europe (europe-west1). Some Firebase services may process data in the US.
• RevenueCat. Subscription status.
• Apple. Sign in with Apple, StoreKit purchases, push delivery, WeatherKit.
• Resend. Sends the guardian email and the waitlist emails from our EU region (Ireland).

We share data with authorities only when the law requires it.

Who sees what

Friends you accept can see your name, picture, season, palette and posts you share with them. They cannot see your closet, your age or your email.

People who are not your friends, such as someone who opens your invite link or the web guess page, see initials instead of a picture unless you are 18 or older. A leaked link never shows a teen's face.

How long we keep it

• Your data stays until you delete it or delete your account.
• Your latest selfie is stored so your result and try-ons work. A new selfie replaces the old photo.
• The full-body photo for "Try it on" is not stored. Only the finished image is.
• Closet photos and cutouts, look check photos, try-on images, your profile picture and your posts stay until you delete them or your account.
• Parent email: only while a request is pending or a confirmation is unsent. The email hash and the guardian step log stay as proof of consent and are deleted with your account.
• If a guardian withdraws approval, we stop new AI calls on photos. Photos already saved stay until you delete them. Settings lets you delete them.
• Reports are kept after account deletion as a safety record. That includes a copy of the reported picture or post.
• Feedback you send stays after you delete your account, with your ID and email removed.
• Usage counters: until you delete your account. Security and rate-limit logs: [CHECK: retention period for security and rate-limit logs].
• Waitlist email: deleted 3 months after the app launches, or sooner if you ask.
• Usage events and settings in Google Analytics: 2 months. Turning off Share usage stats also resets the analytics data on your device.
• Crash reports: 90 days.

Delete your data

Open Settings, then Delete account. This removes your photos, season, results, closet, friends data, guardian records, usage records and your Firebase user. It also revokes your Sign in with Apple token. We back up our database once a week and keep each backup for 30 days, so deleted data is gone from backups within 30 days. If we delete an under-13 account on our own, we may not be able to revoke the Apple token.

You can also write to [email protected].

Your rights

Depending on where you live, you can ask to see, correct, export or delete your data, object to some uses, or withdraw consent. You can complain to your data protection authority. If you are in the EU or UK, our legal bases are: contract (the service you asked for), consent (photos, friends features, optional location), legitimate interest (safety, abuse limits, crash fixes) and legal duty. [CHECK: legal bases and the EU/UK representative if one is required]

Our servers are in Europe and some processors are in the US. For transfers outside the EU and UK we rely on the Standard Contractual Clauses, with the UK addendum, that our processors offer.

Face and body data

We use photos to read color, not to identify you. We do not build a face template or a face-shape profile, and we do not use photos to recognize you. Selfies and full-body photos are kept only as set out above. [CHECK: Illinois biometric retention schedule wording, and Washington consumer health data policy, from COMPLIANCE.md]

AI notice

Results, images and outfit ideas in Colorsona are made by AI. They can be wrong. Treat them as style ideas.

Security

Data is encrypted in transit. Files are private to your account. Only our server writes results. No system is perfectly safe.

Changes

If we change this policy in a way that matters, we tell you in the app before it applies. If it changes what your guardian approved, we ask them again.

Contact

[CHECK: legal entity / FOP name and address]
[email protected]