Privacy Policy

Effective 19 October 2026

Lookbox is a personal AI stylist. You photograph your clothes, and Lookbox catalogues them and suggests outfits. This policy describes what the product actually does with your data.

Lookbox is operated by Aliaksei Danilau, an individual based in Tbilisi, Georgia, who is responsible for your data (the data controller). You can reach us at hello@lookbox.style.

1. What we collect

Account information. You sign in with Google, or with Apple where that option is offered. Google gives us your email address, your name, your profile picture, and a unique account identifier. Apple gives us a unique account identifier, your email address (or a private relay address, if you choose to hide yours) and, if you share it, your name. This information is held by our authentication provider, Supabase. In our own database we store only your account identifier, not your name or email address. If you sign in with Apple, we also keep a token from Apple for as long as your account exists and, after you delete it, only until Apple confirms the revocation or refuses the token. We use it for one thing only: to revoke Lookbox's access to your Apple Account when you delete your account. A daily encrypted backup of your account information (your email address, name and a link to your profile picture) is also kept in Cloudflare R2 (see section 5).

Google and Apple handle the sign-in itself under their own privacy policies. If you sign in with Google in our iPhone and iPad app, Google's sign-in software may send Google your IP address, which Google uses to estimate your general location to prevent fraud. Google's privacy declaration for that software also lists data such as a phone number, device identifiers and usage data. On Android, sign-in with Google runs through Google Play services on your device. Any such data goes to Google, not to us; we never receive your phone number.

Photos you upload. When you add an item, we store the photo you took or selected. Before a photo leaves your device, current versions of the app remove its camera metadata, such as GPS location, capture time and camera model. Only the image orientation and colour profile are kept, so the photo displays the right way up and in the right colours. Our server removes any remaining metadata again before the photo is stored. We keep your photos in private storage and never serve them publicly. Lookbox does not collect your precise location: the app does not ask for location access, and location data is removed from your photos. Error monitoring and product analytics, described below, derive an approximate location from your IP address.

Content we generate. From your photo we derive a description of the garment (category, colours, material, fit, season, style and similar attributes), a cleaned-up catalogue image of the item, and outfit suggestions.

Diagnostics and usage. We use Cloudflare Web Analytics for aggregate page statistics; Cloudflare states that this product uses no cookies and no fingerprinting. Our server logs record the IP address of requests and the addresses requested, which can include your account identifier. We use them to run the service, apply rate limits, and investigate abuse.

Error monitoring. We use Sentry to record crashes, errors and app performance. A Sentry report contains technical details, such as your device model, operating system, browser and app version, and the screen you were on. It can also contain the web addresses of the requests and images involved, including links to your catalogue images (anyone with such a link can open the image, see section 7; images are kept until you delete your account, see section 5) and to your profile picture, and the labels of buttons and images on the screen, such as ones you tapped or clicked, which can include the name of a wardrobe item or outfit, or the date and amount of a receipt. Some of these web addresses, and some reports from our server, include your account identifier. Reports about payments and subscriptions, for example a refund or a payment we could not match to your account, can also include the identifiers, amounts, status and dates of the payment records involved. In the iPhone, iPad and Android apps, Sentry also adds a random identifier for your app installation. Sentry does not keep your IP address with the report, but uses it to estimate an approximate location (country, region and city) that is stored with the report. We do not send your name or email address to Sentry, or the photos you upload, and Sentry deletes reports automatically within 90 days.

Product analytics and feedback. Inside the app we use PostHog to understand which features people use: for example, that an item was uploaded, that outfits were generated, or that an outfit was liked or shared, along with the screen viewed and technical details such as your device platform, operating system, browser, screen size and language. We also record the steps of buying a plan and your current plan: that you opened the plans screen and which plan you picked, whether a checkout was started, completed, cancelled or failed (with the type of payment method, such as card or PayPal, but never your card or billing details), and the changes you make to your subscription in the app, such as cancelling it. Our server also records changes to your subscription itself, including ones made in the App Store or Google Play: that it started, renewed, changed plan, was set to cancel, had a failed payment or ended, with the plan and its list price. These events are linked to your account identifier, not to your name or email address. We have turned off session recording and automatic click capture, and we configure PostHog to discard IP addresses. Before discarding the address, PostHog uses it to work out your approximate location (such as country, region, city, approximate coordinates and time zone), which is stored with the events from the app and your analytics profile so we can see where Lookbox is used. PostHog keeps nothing on your device: no cookie and nothing in the browser's storage (it only checks for a moment that the storage works, and a mark it writes when you send feedback is removed right away). Its identifiers live only in the app's memory while it is open, so each time you open Lookbox the events carry a new random identifier for that visit, and once you are signed in, your account identifier. Events from before you sign in carry only that random identifier. In the iPhone, iPad and Android apps, if you sign in during the same visit, they are then linked to your account; on the web they stay unlinked, unless you sign in from another tab while that page is still open. If you send feedback from your Profile, your star rating and the text you write are stored in PostHog together with your account identifier.

Your right to object to analytics. You can stop product analytics at any time by turning off Usage analytics in Profile → Privacy. The setting is saved with your account, so it applies on all your devices (on another device that is already signed in, within about an hour) and also stops the subscription events our server sends. Before you sign in, tap Don't share usage analytics under the sign-in buttons: no new usage events are recorded from that browser tab or app, and once you sign in the choice is saved with your account, and from then on it works like the Usage analytics setting (until then it lasts until you close the browser tab or the app). The choice belongs to your account: after you sign out, the device sends events with a random identifier again, until you sign back in or tap Don't share usage analytics again. If your browser sends a Do Not Track or Global Privacy Control signal, we send no product analytics from it. Feedback you choose to send from your Profile is still delivered when analytics are off, then without your approximate location. Turning analytics off stops new events; to have the events already collected deleted, write to hello@lookbox.style.

Reports of generated content. If you report an item's catalogue image or an outfit from its ⋮ menu, we store the report in our database with your account identifier: which item or outfit it is about, a copy of what you saw (its title, catalogue images and outfit description) and the comment you write, if any. We read reports to review the content and to improve how Lookbox generates it.

Payments. Paid plans on the web are sold by Paddle, our online reseller and Merchant of Record. When you start a purchase, we give Paddle your email address and account identifier to set up your customer record. Paddle processes your purchase as an independent controller under its privacy policy. Paddle collects your payment details and billing address directly; we never see your card number. We store the identifiers Paddle gives us for your customer record, subscription and payments, and the state of your subscription. If you buy in the iPhone or Android app, Apple or Google handle the payment, and RevenueCat tells us which subscription your account has, linked to your account identifier.

We do not use advertising identifiers, we do not show ads, and we do not sell your data.

2. Why we use it

• To provide the service: storing your wardrobe, recognising garments, generating outfits. Legal basis: performing our contract with you.
• To keep the service secure: rate limiting and abuse investigation, using IP addresses in server logs. Legal basis: our legitimate interest in protecting the service and its users.
• To keep the service working: diagnosing crashes, errors and slow responses, keeping backups so we can recover from failures, and remembering which accounts were deleted so that a restore does not bring them back. Legal basis: our legitimate interest in a working service.
• To sell and manage paid plans: your subscription, receipts and the state of your plan. Legal basis: performing our contract with you. Paddle, as Merchant of Record, keeps the records that tax and accounting law require.
• To improve the service: understanding which features are used and where, and reading the feedback you send us. Legal basis: our legitimate interest in improving Lookbox.
• To review reports of generated content and act on them. Legal basis: our legitimate interest in keeping generated content appropriate.

To use Lookbox you need to sign in, and to build your wardrobe you need to add photos; without them we cannot provide the service. Sending feedback or reports is optional.

Where we rely on our legitimate interests, you have the right to object to that processing at any time (see section 10).

3. AI processing, and who receives your photos

Turning a photo into a wardrobe item, and suggesting looks, uses third-party AI services. They receive a resized copy of your photo without location data, the catalogue image generated from it, and the descriptions and attributes of your items (such as category, colours and style). They do not receive your name or email.

We currently use Google (recognising the garment, describing it, generating its catalogue image and suggesting looks) and fal.ai (removing the background of the generated catalogue image; it does not receive your original photo). If we change these providers, we update this list and ask for your permission again in the app.

Your permission. Before any of your photos or item descriptions are sent to these services, the app asks for your permission and tells you what is sent, to whom and why. We record that you gave it and which version of that notice you saw. You can withdraw it at any time in Profile → Privacy → AI processing. After that, no new photos or item descriptions are sent to these services, so you cannot add items, redraw them or get new looks until you allow it again. Items and looks you already have stay in your wardrobe. Processing already under way when you withdraw may finish, and withdrawing does not undo processing that has already taken place. This permission is a product setting: the legal basis for this processing stays performing our contract with you (section 2).

How these providers protect your data. Both process it under contract terms that require them to keep it confidential and secure. Google processes it as our data processor, does not use it to improve its products, and keeps request logs only for a limited time to detect abuse. fal.ai treats it as our confidential information; we ask that our requests are not stored and set the image it generates to be deleted from its servers after an hour. We keep our own copy. See also Google's privacy policy and fal.ai's privacy policy.

4. Service providers

We share personal data only with the providers listed here and in section 3, and only under terms that require them to protect it at least as well as this policy describes.

• Supabase: authentication and database, including daily database backups.
• Cloudflare: storage (R2) for your photos and generated images, website hosting (Pages), Web Analytics, and routing of email sent to our address.
• Cloudflare R2 (backups): backup copies of your photos and generated images, and an encrypted backup of our database and of the account information described in section 1.
• Railway: hosting for our application server.
• Google (Gmail) and Resend: our support mailbox and outgoing email.
• Google: AI services (see section 3), and the content network that serves your Google profile picture directly to your browser.
• fal.ai: background removal.
• Sentry: error and performance monitoring, including approximate location from your IP address.
• PostHog: product analytics, including approximate location from your IP address, and in-app feedback.
• Paddle: payments, receipts and refunds for web purchases, as our reseller and Merchant of Record (an independent controller of that data, see section 1).
• RevenueCat: subscription status for purchases in the apps.
• Public authorities, where the law requires us to share information.

5. Storage, retention and deletion

Photos and generated images are stored in Cloudflare R2. Wardrobe items, outfits, reports of generated content and a usage ledger are stored in a Postgres database hosted by Supabase. So that we can recover from failures, we keep backup copies of both: your photos and generated images are copied to a separate R2 bucket every hour, and the database is backed up daily by Supabase and as an encrypted copy in R2 that also includes the account information described in section 1. Database backups are kept for up to 3 weeks, and earlier versions of replaced images stay in the photo backup for up to 3 weeks.

The record of your AI-processing permission (when you gave it and which version of the notice you saw) is kept until you withdraw it or delete your account; copies in database backups expire with them. If we ever restore the database from a backup, we do not bring back a permission you have withdrawn: the app asks you again.

Deleting an item removes it from your wardrobe and hides any outfits that contain it. The underlying record and the stored images are retained. Our usage and cost ledger is append-only and is never deleted.

Deleting your account. You can permanently delete your account and your wardrobe data yourself (analytics are covered below): open Lookbox, go to Profile, tap the ⋮ menu next to the title, and choose Delete account. This immediately removes your account, every wardrobe item, every generated outfit, your reports of generated content, and all your photos in our storage, including the originals (copies that our AI providers received follow their policies, see section 3). It cannot be undone. If you cannot use the app, you can request deletion at lookbox.style/delete-account or by writing to hello@lookbox.style from your sign-in email; we complete such requests within 30 days. If you signed in with Apple, we also ask Apple to revoke Lookbox's access to your Apple Account, using the token we kept from your sign-in, and keep asking until Apple confirms or refuses the token. If we hold no such token (for example, for sign-ins before we started keeping it) or Lookbox still appears in your Apple Account settings under Sign in with Apple, you can remove it there yourself. Deleting your account also cancels your web subscription right away and a Google Play subscription, so you are not charged again; an App Store subscription has to be cancelled in your Apple Account settings.

What remains after deletion.

• Our append-only usage and cost ledger (for accounting and legal obligations) and a record that the account was deleted (so that late requests or a restore from a backup cannot recreate your data). Both are kept permanently, under your former account identifier (a random code) and without your name, email or photos.
• Our email correspondence with you, such as a deletion request, kept in our mailbox indefinitely as a record of your request.
• A few analytics events, and copies that expire on their own, described in the next paragraphs.
• Paddle, as Merchant of Record, keeps its own records of your purchases, including your email address, as the law requires; we cannot delete them. Paddle is responsible for that data: to ask Paddle about it, see Paddle's Privacy Notice.

Analytics and feedback after deletion. When your account is deleted, whether in the app or at your request, we also ask PostHog to delete your analytics profile together with all product analytics events and feedback linked to your account identifier. We send this request about two hours after the deletion, so that events still on their way from your device are included. PostHog removes your profile within minutes and deletes these events in a background process that it runs at off-peak times, typically at the weekend. Two kinds of events can remain: anonymous events recording that an account was deleted and signed out, without your account identifier, and, if another device was still signed in to your account, a few events that Lookbox there sends later under the same identifier, which recreate an analytics profile with your approximate location. None of this is linked to your name or email address, and PostHog deletes these events automatically within 12 months.

Copies that expire. Some copies of deleted data are not removed one by one but expire on their own. Our database and storage backups are deleted within 30 days. Server and sign-in logs are deleted within 30 days. Error and performance reports in Sentry, including any about the deletion itself, are deleted within 90 days; they can hold your account identifier and the other details listed under Error monitoring in section 1, but not your name, email or the photos you uploaded.

6. Data kept on your device

Your sign-in session is stored in your browser's local storage. A copy of your wardrobe and small thumbnails of your photos are cached on your device so the app loads quickly and survives a reload. Signing out removes your session and this copy. Images the app has shown can stay in your browser's or the app's cache until the system clears it or you delete the app. On iPhone, the name you shared with Apple can stay on the device, and in its backups, after you sign out or delete your account. While you sign in, the browser tab or app also briefly remembers that a sign-in has started and, if you chose so, that you do not want to share usage analytics; neither holds an identifier, and both go when you close the tab or the app.

Some random identifiers stay on your device after you sign out, until you clear the site data in your browser or delete the app: in the iPhone, iPad and Android apps, Sentry's installation identifier and RevenueCat's anonymous purchase identifier. None of them contains your name or email address.

7. Security

Traffic is encrypted in transit. Database access is restricted per account. Your original photos are never served publicly or to other users.

Catalogue images are served from long, unguessable web addresses and are not individually access-controlled, so anyone who has the exact link to one image can view that image. Please treat those links as private.

Access by Lookbox. Within Lookbox, only the operator named at the top of this policy can access your data in our systems, through an internal admin tool and our providers' consoles, each protected by its own sign-in. The admin tool shows your account details (including your email address and name), your wardrobe items, photos and outfits, your subscription and the reports you send. We use this access to give support, investigate problems and abuse, review reports of generated content, handle your requests about your data and manage your plan. To reproduce a problem, we can also open Lookbox signed in as your account.

8. Children

Lookbox is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

9. International transfers

Your data is processed outside the European Economic Area (EEA) and the United Kingdom, mainly in the United States. Our application server (Railway), our database and authentication (Supabase), error monitoring (Sentry) and product analytics (PostHog) are hosted in the United States, and Resend, RevenueCat and fal.ai are US companies. Cloudflare and Google run their services from data centres in many countries, including the United States. Paddle is based in the United Kingdom. Lookbox's operator works from Georgia.

Transfers to our providers rely on one of these mechanisms:

• Adequacy decisions. Cloudflare, Google, Sentry and Resend are certified under the EU-US Data Privacy Framework, which the European Commission recognises as protecting personal data adequately, and its UK Extension, which the UK government recognises for UK data. The European Commission also recognises the United Kingdom, where Paddle is based, as adequate.
• Standard Contractual Clauses approved by the European Commission, with the UK Addendum for UK data, which the data processing terms of Supabase, RevenueCat and fal.ai incorporate automatically.
• Safeguards in the provider's standard terms. For Railway and PostHog we rely on the safeguards in their standard terms and data protection commitments, which you can ask us about.

Apple and Google, when you sign in with them, and Paddle, when you buy on the web, act as independent controllers under their own privacy policies (see section 1). You can ask us for a copy of the safeguards described here at hello@lookbox.style.

10. Your rights

Depending on where you live, and in particular if you are in the EEA or the United Kingdom, you have the right to:

• Access your data and get a copy of it.
• Correct data that is inaccurate or incomplete.
• Delete your data. You can delete your account yourself (see section 5), or ask us to erase specific items or photos without deleting your account.
• Restrict our processing, for example while we check whether your data is accurate or whether your objection applies.
• Object to processing based on our legitimate interests (section 2). We then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data for legal claims.
• Data portability: receive the data you gave us under our contract with you in a structured, commonly used, machine-readable format, and have it sent to another service where that is technically feasible.
• Complain to the data protection authority where you live or work, or where you think your rights were infringed.

How to make a request. Write to hello@lookbox.style. So that we know the request is yours, please write from the email address you sign in with, or we may ask you to confirm it from that address. Requests are free; if one is clearly unfounded or excessive, we may charge a reasonable fee or decline it and tell you why. We respond within one month; if a request is complex, we may need up to two more months and will tell you why within the first month.

Getting a copy of your data. The app does not have an export button yet, so we prepare the copy for you by hand. You receive an archive, or a link to download it, with all the personal data we hold about you, including your original photos and catalogue images, and a machine-readable file with your account details, wardrobe items and their descriptions, outfits, subscription records, your AI-processing permission and your reports of generated content, together with the analytics events, feedback and error reports linked to your account.

11. Changes

If we change this policy we will update the effective date above. Please check this page from time to time.