Privacy Policy
Effective 4 October 2026 · Last updated 6 October 2026
This notice explains how Try On Haul handles personal data when you use the iOS app, its community feed and related support services. We do not sell personal data and do not use it for behavioural advertising.
1. Who is responsible for your data
Controller / operator: Nik NovakPostal address: Ob dolenjski železnici 124, 1000 Ljubljana, Slovenia
Telephone: +386 41929683
Privacy requests: privacy@tryonhaul.si
Legal form: [LEGAL FORM]
Registration number (matična številka): [REGISTRATION NO.]
Tax number: [TAX/VAT NO.]
VAT status: [VAT STATUS]
The legal form, registration number and tax/VAT status have not been verified and remain marked as placeholders.
2. What we process, why, and for how long
We process only data relevant to the purpose below. The legal bases refer to Article 6(1) GDPR: (a) consent, (b) steps you request or a contract with you, (c) a legal obligation, and (f) our legitimate interests. Where we rely on consent, you may withdraw it as described in section 8.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Create and secure your account; provide the app, closet, saved looks and support | Firebase account identifiers; profile and editable fit preferences; clothing and closet images; support messages and information you choose to include | Article 6(1)(b), providing the service you request | While your account is active. On account deletion, active account data is removed as described below. Support correspondence is retained only as needed to handle the request and related follow-up. |
| AI photo analysis and virtual try-on | Body reference photos and selfie images, which may show your face; clothing references; generated images; image-processing instructions; derived profile suggestions such as binary gender/sex label, estimated height, weight, body type and colour season; disclosure version, consent/withdrawal timestamps and app language | Article 6(1)(a), your consent to photo processing. This does not involve face recognition, identification or authentication. | Saved body photos and your selfie remain until you delete them in Settings → Privacy & AI → Delete my body photos & selfie, request their deletion, or delete your account. That control also clears derived photo-profile data and retained body-processing instructions in try-on jobs. Saved generated looks, closet items and manually entered measurements remain until separately deleted. Settings → Privacy & AI → Withdraw AI photo consent blocks new consent-based photo processing until you explicitly accept the existing disclosure again. Processing already started may finish; completed processing cannot be undone. Consent records remain with the account. Recovery-copy and provider retention are described below. |
| Purchases, subscriptions, credits and accounting | Apple transaction and product identifiers, purchase or subscription state, credit balance, purchase dates and financial attribution records | Article 6(1)(b) for access to purchased services; Article 6(1)(c) for records we must keep under accounting and tax law | App access records are kept while needed to provide the service. Accounting records are kept for the statutory period. Apple separately retains purchase and billing records under its own policy. |
| Prevent fraud, repeated free-credit abuse and attacks | Rate-limit counters, referral redemption records, a one-way identity hash used to prevent repeat abuse, and service-security information. Identifiable usage events include account ID, event/model, outcome, provider usage and estimated cost. | Article 6(1)(f), our interest in preventing fraud, automated abuse and unfair repeated claims, while protecting legitimate users and the service | Identifiable usage-event records are scheduled for deletion 90 days after creation under the active Firestore TTL policy; actual removal after expiry may be asynchronous. Other rate-limit counters, minimal identity hashes and transaction records have different periods and may remain as long as reasonably needed to enforce a limit, investigate an incident, meet a legal obligation or defend legal claims. |
| Community feed, moderation and safety | Images and captions/style metadata you submit; moderation status and reviewer decision; report reasons; blocks; and relevant account identifiers. Published posts may show your face and body to other users. | Article 6(1)(a), your separate choice and consent to submit a public post; Article 6(1)(f) for reviewing reports, preventing abuse and keeping the community safe | Submissions remain unpublished until a human moderator approves or rejects them; only approved posts are published. Moderation and report records have no fixed deletion interval; we retain and periodically review them while needed for moderation, abuse prevention, repeat-posting controls or disputes. |
| Optional push notifications | Push token and delivery information; notification permission state | Article 6(1)(a), your iOS notification permission and any optional notification choice | Until you turn notifications off, the token becomes invalid, or your account is deleted. You can change notification permission in iOS Settings. |
| Protect app requests and the service | App Attest assertions and Firebase App Check tokens or related app/device integrity information used to verify requests | Article 6(1)(b) for secure service operation and Article 6(1)(f) for preventing abuse and protecting our systems | Used when request attestation or enforcement is enabled; any provider-side retention is governed by the provider's applicable terms. |
| Referrals and offer-code attribution | Referral or offer code, redemption and reward records, relevant account/identity hashes, and Apple transaction details needed to attribute an Apple offer | Article 6(1)(b) for administering a reward or offer you use; Article 6(1)(f) for preventing duplicate or fraudulent claims; Article 6(1)(c) where accounting records must be retained | Until the reward/offer is administered and for as long as reasonably needed to prevent repeat claims, reconcile Apple transactions, meet legal duties or resolve disputes. Some transaction-keyed accounting records remain after account deletion with direct account identifiers removed. |
| Community-feed search | Search text and any selected category or gender filters are sent to our backend to search the community feed. | Article 6(1)(b), to provide the search feature you request | Our search implementation uses keyword and synonym matching on our backend. Search text is not sent to an external AI model provider. We do not place raw search text in application logs or usage records and do not maintain a persistent search-history record. Usage records may contain your account identifier, the keyword-search label, outcome, latency in milliseconds and a zero model cost. For performance, a server instance temporarily caches candidate feed entries under a SHA-256 digest of the normalized query, filters and category. Entries may be reused for up to 60 seconds; expired entries are replaced on the next lookup of that key, and instance restarts clear the cache. The digest is not an anonymous identifier. |
3. Photos, face data and inferred profile details
Initial setup requires four body photos. A selfie is required only when the app cannot confirm that the front photo has sufficient quality to serve as the face reference. You can add an optional selfie to enable colour analysis. You may use the camera or photo library. Photos may contain your face and body. We use them as visual references for try-on images and photo-based suggestions. We do not use your face to identify or authenticate you, create or store biometric identity templates, track you, advertise to you, or train our own models. A face may appear in an image; that is not facial recognition.
The app can estimate a binary gender label, height, weight and body type from body photos, and a colour-season suggestion from a selfie. These are estimates, can be wrong, and are not medical assessments. You can edit gender, height, weight and body-type details in your profile. You can ask us to correct or erase profile data. We do not classify skin tone as a profile attribute.
Photo-based features require the relevant images. Deleting saved body photos and your selfie does not delete already generated looks or separately published community posts.
4. Community posts and moderation
When you choose to submit a look to the community, the image and selected style details are uploaded for review. Gemini performs an automated safety pre-screen that can flag an image; it does not approve or reject posts. A human moderator decides whether to publish, reject, remove or restore a post. Other users may view and save a published post. If another user saves your image into their own closet, deleting your post does not delete that separate copy from their account.
Users can report posts and block authors. Report reasons include illegal content, child safety, and copyright infringement or a photo of you. A report hides the post from the reporting user; reports from multiple distinct users can temporarily hide a post while it is reviewed. Child-safety reports receive priority human review. We preserve the reported image as moderation evidence while that review is pending, including if its author removes the public post; reporting does not automatically delete the image. My feed posts shows the stored moderator reason for a rejection or removal, with an email contact for an appeal. Moderators may reject or remove content and may restrict an account from posting. We may access submitted images and related account information for moderation, support, safety and technical troubleshooting. Access to account data is limited to authorized operator/admin accounts. Before the staff tools return lists of account assets or generated looks, we record the staff account, the affected account, the action and time, and any reason supplied. These security audit records do not include image content or download links; when the affected account is deleted, its direct target identifier is removed from the audit record. There is no automatic deletion period for these audit records; they are reviewed and retained only while needed for security, accountability or handling a dispute.
We are working on a notice route and additional reporting/appeal information for people who are not app users. Until then, send a notice about a community post to privacy@tryonhaul.si and include the post URL or a clear description, the reason for the notice, your name and contact details, and a statement that your notice is accurate to the best of your knowledge. This email is a contact channel; it is not a registered U.S. DMCA agent.
5. Third-party inspiration images
Some curated fashion-inspiration images in the feed may come from Pinterest or other third-party sources. The photographs remain the property of their respective rights holders, and we have not verified a licence for every image currently shown. We are adding source links and attribution where the source is known. If you own rights in an image or are depicted in it and want us to review or remove it, email privacy@tryonhaul.si with the image or feed link and enough information to identify the image and your concern. We will review the request.
6. Providers and international transfers
- Google Cloud and Firebase provide authentication, database, file storage and cloud processing. Gemini/Vertex AI is used for image analysis, profile suggestions, community pre-screening and certain image-generation requests. Current default try-on generation uses OpenAI through OpenRouter. Google LLC is listed as an active participant in the EU-U.S. Data Privacy Framework. Google publishes Firebase Data Processing and Security Terms and the Google Cloud Data Processing Addendum, with Standard Contractual Clauses where applicable; which terms and transfer mechanism apply depends on the service. See Firebase terms and the Google Cloud addendum.
- OpenRouter, Inc. routes image-generation requests and reference images to the selected model provider. OpenRouter's privacy policy says API inputs are transmitted to the selected model provider, whose retention and training practices can vary, and states no fixed retention period for query payloads. OpenRouter publishes a DPA that includes EU Standard Contractual Clauses and a UK Addendum; its Terms say the DPA is incorporated for organizational or commercial use. We have not verified the account-specific agreement or whether those terms govern this product's routed model request. We have not verified an account-level Zero Data Retention or prompt-logging configuration. See OpenRouter privacy, OpenRouter Terms and its DPA.
- OpenAI processes generation requests forwarded through OpenRouter. OpenAI's default API abuse-monitoring logs may contain prompts and outputs and are retained for up to 30 days, unless a longer period is required by law or reasonably necessary to protect OpenAI or others from harm. This is not a promise that all provider data is deleted within 30 days. OpenAI publishes a DPA with Standard Contractual Clauses; the account-specific application of its terms is not verified. We have not verified that Zero Data Retention or Modified Abuse Monitoring is enabled. See the OpenAI DPA.
- Apple processes App Store billing, subscriptions and purchase restoration under Apple's own privacy terms. We receive transaction information needed to grant access and credits.
These providers may process data in the United States or another country outside your own. Public provider DPAs describe transfer safeguards including Standard Contractual Clauses, but we have not verified which provider agreement or transfer mechanism applies to this account and each routed request. Provider-side security, abuse-prevention, backup and legal-retention records may remain under provider rules after we delete data from our active systems.
Provider information: Firebase privacy, Firebase processing terms, Google Cloud processing addendum, OpenRouter privacy, OpenRouter DPA, OpenAI API data controls, Apple privacy.
7. Storage, security and deletion
Account content is stored in Firebase/Google Cloud, in the us-central1 (United States) region. We use authentication, access rules and server-side controls to restrict data access. Authorized administrators may access user images when needed for support, moderation or troubleshooting.
When you delete your account in the app or contact us to request deletion, we remove active account data, account-prefixed photos and public posts, and delete the app authentication account. Staff troubleshooting outputs created after the access-audit update are linked to the account when they use its stored body photos or generated looks and are included in account deletion. Shared reference-library assets and older playground outputs without reliable account linkage cannot be removed automatically by that procedure; contact us so we can identify and review them. An image reported for child-safety concerns, or otherwise marked as child-safety evidence, may be retained after account deletion; its moderation record no longer contains the deleted author’s account or source-look identifier. A few other records may remain where needed for legal accounting, Apple transaction reconciliation or fraud prevention: transaction-keyed accounting events have direct account identifiers removed, and a one-way identity hash may be retained to stop repeated referral abuse. We retain a minimal erasure marker keyed by a one-way hash of the account ID to stop staff troubleshooting jobs from publishing or restarting for an account undergoing deletion. It contains no photos or direct account ID and has no automatic expiry. The hash is pseudonymous and does not make the record anonymous. Deleting your app account does not cancel an Apple subscription; manage that separately in Apple ID subscription settings.
To prevent the same consumable purchase from granting credits again, and to enforce refunds even when they arrive before a purchase is linked to an app account, we retain a minimal receipt-status record after account deletion. Its key is a SHA-256 hash of the Apple transaction environment and transaction ID; its fields indicate whether the transaction has been consumed or revoked. This record contains no raw signed receipt, photo or app account ID. It has no automatic expiry. The hash does not by itself make the record anonymous.
Recovery copies are separate from active account data. Live configuration read on 3 October 2026 showed Firestore daily backups retained for 14 days, Firestore point-in-time recovery for up to 7 days, and Firebase Storage soft-deleted objects retained for 7 days. Temporary files under tryon-jobs/ have a 7-day deletion lifecycle. These periods describe recovery or temporary-storage controls; they do not mean deleted content remains available in the app, and do not guarantee immediate erasure from provider systems. Apple and AI-provider records follow their own terms and retention practices described above.
8. Your rights and choices
You may ask us to provide access to your personal data, correct it, erase it, restrict processing, or provide data you supplied in a portable format. Where we rely on legitimate interests, you may object to processing on grounds relating to your situation. Where processing relies on consent, you may withdraw consent at any time; withdrawal does not affect processing that was lawful before withdrawal. In current app versions, open Settings → Privacy & AI to withdraw AI photo consent or delete saved body photos and your selfie. Each action asks for confirmation. Withdrawal stops new photo processing and you may re-accept through the existing disclosure when you next request an affected feature. Deletion removes saved source photos and derived photo-profile data, while preserving saved looks, closet items, manually entered measurements and purchased credits. You can also email privacy@tryonhaul.si, including if your older app version lacks these controls. An email request does not itself change the app's processing state; we will handle it and stop future consent-based processing once actioned. You can delete your full account in Settings. We will respond without undue delay and normally within one month; where legally permitted, that period may be extended for complex or numerous requests, and we will tell you why.
You may complain to the Slovenian supervisory authority: Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, Slovenia; ip-rs.si, or to the competent supervisory authority where you live or work.
9. Children
Try On Haul is intended only for people aged 18 or older. Continuing at sign-in confirms that you are 18 or older, and community posting also requires an age confirmation. We do not independently verify your age. Do not use the service or submit photos if you are under 18. If you believe a person under 18 has provided us with personal data, contact us and we will review and take appropriate steps.
10. Changes to this notice
We may update this notice when our service, data practices or legal requirements change. We will change the “Last updated” date and give additional notice where a change materially affects your rights or choices.
- 6 October 2026 — keyword search: removed external AI query classification. Community-feed search now uses backend keyword and synonym matching without sending queries to Jev, TypeSafe or OpenRouter. This change does not establish deletion of queries previously sent to providers.
- 4 October 2026 — staff access: added logged retrieval of user assets and looks, account-linked troubleshooting-output cleanup and preservation of child-safety evidence without direct author linkage after account deletion.
- 4 October 2026 — community reporting: added child-safety priority review, evidence preservation, additional report reasons and moderator explanations with an appeal contact.
- 4 October 2026 — privacy controls: added the account-specific AI consent record, Settings photo deletion and consent withdrawal, and sign-in age confirmation. These controls are available in current app versions; email remains available for older versions.
- 5 October 2026 — community-feed search: updated the notice for the available search feature, its temporary hashed-filter cache and usage records, and the current OpenRouter/TypeSafe provider path and published provider terms.
- 4 October 2026: added the operator contact details and unverified legal-form placeholders; explained purposes, legal bases, retention, AI/photo processing, community moderation, providers and transfers, rights, age limitations and recovery-copy periods; corrected the earlier statement that body photos could be deleted in Settings.
Read the Terms or contact privacy@tryonhaul.si.