Privacy Policy

1. Controller and contact

The controller responsible for the processing described in this policy is:

Jeremy Poroye
Vaalser Straße 13
52064 Aachen
Germany
Email: support@ratemyfit.app

This policy applies to the RateMyFit mobile app, our website at ratemyfit.app, and related support and waitlist communications (together, the "Service").

2. Data we process

Account and authentication

• Email address, authentication method, account ID, and sign-in timestamps.
• If you choose Google Sign-In, Google provides the information required to authenticate you, such as your Google account identifier and email address. We do not receive your Google password.

Profile and style preferences

Information you choose during onboarding or in your profile, such as display name, age range, style goals, preferred styles or vibes, occasions, and other styling preferences.

Outfit photos and analysis data

• Photos you take or select and submit for analysis.
• Results generated from those photos, including overall and category scores, color information, feedback, suggestions, saved fits, favorites, and rating history.
• Outfit-coach messages, responses, reactions, and reports you choose to submit.

A photo may incidentally show your face or surroundings. We do not use facial recognition, identify people in photos, or create biometric templates.

Subscription data

Product, entitlement, trial, purchase, renewal, and subscription-status information. The Apple App Store or Google Play processes your payment details; we do not receive your full card or bank-account details.

Usage and diagnostics

App screens and features used, app lifecycle and product events, app version, operating system and device information, an account or analytics identifier, IP address as part of network communication, and crash or error details. We do not use advertising SDKs or sell this information.

Website and communications

If you join the waitlist or contact support, we process your email address, message, submission time, and related delivery or support metadata. Cloudflare Turnstile may process limited browser, device, network, and interaction signals to protect forms from automated abuse.

3. Why we process data and our legal bases

• Provide the Service (Art. 6(1)(b) GDPR): create and authenticate your account, analyze submitted outfits, provide the coach, save your results and preferences, restore purchases, and provide support.
• Consent (Art. 6(1)(a) GDPR): send optional waitlist or product-update emails and, where legally required, use non-essential analytics or access information on your device. You can withdraw consent at any time with effect for the future.
• Legitimate interests (Art. 6(1)(f) GDPR): secure the Service, prevent fraud and abuse, diagnose errors, understand whether core features work, and defend legal claims. We balance these interests against your rights and limit the data used for these purposes.
• Legal obligations (Art. 6(1)(c) GDPR): retain or disclose information where tax, accounting, consumer-protection, law enforcement, or other applicable law requires it.

4. Camera, photo library, and device permissions

Core app features use the camera or photo library only when you choose to take or select an outfit photo. We use the selected image to preview, prepare, upload, and analyze the outfit. You can deny or later revoke these permissions in your device settings, but the related photo feature will then be unavailable.

Outfit analysis does not require your contacts, precise location, SMS, call logs, or audio recording. We do not use photos or camera data for advertising or to build a facial-recognition database.

Some preferences, authentication state, and temporary app data are stored locally on your device. They remain until they are cleared by the app, you sign out or delete the account where applicable, you uninstall the app, or your operating system clears them.

5. AI processing

When you actively submit an outfit for analysis or ask the outfit coach a question, the photo and relevant context are sent through our backend to an AI provider. Depending on the model configured for the feature, this may be Google Gemini or OpenAI. The provider returns the requested analysis or response to RateMyFit.

• Transfers use encrypted connections.
• We may store the photo, generated scores, feedback, and coach history in your account so you can access them later.
• We do not use your photos or messages to train a RateMyFit model.
• AI output can be inaccurate or inconsistent and is not used to make decisions that produce legal or similarly significant effects about you.

Provider processing is governed by the applicable service terms and privacy information, including Google's Privacy Policy and Gemini API Terms, or OpenAI's Privacy Policy and Services Agreement.

6. Recipients and service providers

We do not sell personal data. We disclose only the data needed for the recipient's function or where law requires disclosure. Current providers include:

• Supabase: authentication, database, edge functions, and outfit-photo storage.
• Google: Google Sign-In when selected and Gemini AI processing when configured.
• OpenAI: AI analysis or coach responses when an OpenAI model is configured.
• PostHog: limited product analytics and diagnostics using PostHog's EU-hosted endpoint. Automatic touch capture and session recording are not enabled.
• RevenueCat: subscription entitlement, purchase, trial, renewal, and restore management.
• Apple and Google: app distribution, store accounts, billing, and subscription management.
• Resend: delivery of service-related emails, such as subscription trial reminders.
• Expo: app build, delivery, and update infrastructure.
• Cloudflare: Turnstile bot protection on website forms.

Providers acting for us are contractually limited to processing data for the agreed service and must apply appropriate safeguards. Apple, Google Play, and authentication providers may also process data as independent controllers under their own policies.

7. Retention

• Account, profile, photos, and app history: kept while your account is active, until you delete individual content where that option exists, or until your account is deleted.
• Coach content: kept with your account so you can continue or review conversations, until you delete the account.
• Product analytics: kept for up to 12 months unless a shorter period is sufficient or longer retention is necessary to investigate security, abuse, or a technical incident.
• Waitlist data: kept until you withdraw consent or, at the latest, six months after the public launch campaign ends.
• Support and privacy requests: ordinarily kept for up to three years after the request is closed to document our response and protect legal claims.
• Purchase and compliance records: kept only for the statutory period that applies, or as needed for refunds, fraud prevention, accounting, or legal claims.

Deletion from active systems may not immediately remove data from protected backups or security logs. Those copies are isolated, not used for ordinary product purposes, and expire under the relevant backup or logging schedule. We may retain data that has been irreversibly anonymized because it can no longer be linked to you.

8. Account and data deletion

You can request deletion from anywhere:

• In the app: Settings → Account & Subscription → Delete account.
• On the web: follow the account deletion instructions.

Account deletion removes the active account, database records, and stored outfit files we control. We also delete or de-identify account-linked processor data where required and technically available. Limited purchase, fraud, security, backup, or legal records may remain for the reasons in Section 7.

Deleting your account does not cancel a subscription billed by Apple or Google. Manage that subscription separately in your store account.

9. Security and international transfers

We use measures designed to protect personal data, including encrypted transport, access controls, short-lived signed file access, and user-scoped backend permissions. No service can guarantee absolute security.

Some providers may process data outside the European Economic Area. Where required, we use an adequacy decision, the EU Standard Contractual Clauses, or another lawful transfer mechanism and apply additional safeguards where appropriate.

10. Your rights

Subject to the legal conditions, you have the right to request access, correction, deletion, restriction, and portability of your personal data; to object to processing based on legitimate interests; and to withdraw consent at any time for future processing. You also have the right not to be subject to a solely automated decision with legal or similarly significant effects.

Send a request to support@ratemyfit.app. We may ask for information needed to verify your identity and normally respond within one month.

You may lodge a complaint with a supervisory authority. Our competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

11. Children

The Service is not directed to children under 13, or under 16 in the European Economic Area where parental authorization would otherwise be required. If you believe a child has provided data contrary to this section, contact us so we can investigate and delete it where appropriate.

12. Changes

We may update this policy when the Service, providers, or legal requirements change. We will update the date above and, for material changes, provide an appropriate notice in the app or by email before the change takes effect where required.