Privacy Policy

Last updated: October 20, 2026

Introduction

Dresser ("the app," "we," "us") is a virtual wardrobe and AI stylist app for iOS. This policy explains what information the app collects, how it is used, who it may be shared with, and the choices you have.

Please read this before you continue. Dresser is built local-first — your closet lives on your device first, full stop — but the app relies on cloud services to work, and your information, including in some cases photos and data about your wardrobe, may be processed by, or transferred to, third-party service providers as part of how those features work. At minimum, this currently includes Firebase and Google (analytics, crash reporting, AI processing, and — only if you choose to sign in with Apple — your account and wardrobe sync) and Apple (weather, platform services, and Sign in with Apple); see "Information We Send To Service Providers" and "Accounts and Sync" below for exactly what each one does and does not receive. We may engage other processors over time — this document will always be kept current to describe what is actually true of the version you are using. By continuing to use Dresser, you agree to this Privacy Policy. Where the law that applies to you requires your separate, explicit consent for a specific kind of processing, we will ask for it distinctly — continuing to use the app is not treated as that consent in those cases.

Where Your Information Is Stored Today

• Your closet. Photos of your clothing items, the attributes you or the app assign to them (category, color, season, style), your saved outfits ("looks"), your wear history, any style preferences you choose to set on "My Style" (preferred styles, colors or categories you'd rather avoid, comfort notes), and short notes the stylist records from a conversation (e.g. a stated preference, constraint, or a dated event you mentioned), shown on "My Style" where you can delete any of them at any time, are stored on your device, using Apple's SwiftData framework — true for every user, signed in or not. If you choose to sign in with Apple, this same data is also synced to our servers so it can follow you to a new device; see "Accounts and Sync" below for exactly what that involves and how to remove it. Specific features send limited, purpose-built data to the service providers listed below to work, as described in this document.
• Background removal. When you photograph an item, the app removes its background on-device using Apple's Vision framework. The cutout stays on your device unless a feature described below says otherwise. For attribute tagging, a downscaled copy of the photo itself is sent (see "Google Gemini, via Firebase AI Logic").
• App preferences. Your haptics, appearance (light/dark/system) and analytics preferences are stored locally on your device and are never transmitted anywhere — these are device settings, not part of your wardrobe data.

Information We Send To Service Providers

Dresser uses the following third-party services, each for a specific, limited purpose:

Firebase Analytics (Google)

We use Firebase Analytics to understand how the app is used in aggregate — for example, which screens are opened and how often a feature is used — so we can improve the app. Analytics events never include your photos, item names, notes, or any other content you entered; they carry only anonymous, aggregate usage signals (for example, "the Closet tab was opened"). Every install of the app generates a random identifier — never derived from your name, email, or Apple ID — and stores it in your device's keychain. This is what these events are tagged with, so we can tell a returning install from a new one instead of just counting raw events, and it stays the same even if you delete and reinstall the app on the same device. Signing out doesn't change or remove it, since it identifies this installation, not your account. The app also stores this same identifier on our servers, alongside your account data (see "Accounts and Sync" below). That happens whether or not you ever sign in, because the app creates a technical, anonymous account for every install in the background. The identifier is kept in your account's private settings and, if you have a subscription, on its subscription record (see "Apple StoreKit" below). We use it to connect your analytics history to your account, to tell (for example) which accounts started, renewed or cancelled a subscription, and for support or abuse investigation. If you turn off Usage Analytics, the app stops sending the identifier to us. Turning the setting off does not delete a copy that is already stored. Deleting your account removes that stored copy along with everything else tied to the account, but the identifier on your device itself is untouched — it identifies this installation, not any one account — and the app keeps using it afterward, for a fresh, anonymous analytics history. The app links Firebase Analytics without advertising-identifier support, and no advertising identifier (IDFA) is ever collected. You can turn this off at any time in Settings → Privacy → Usage Analytics; the app defaults to sharing this data, consistent with how most usage-analytics tools work, but the choice is always yours.

If you installed the app after tapping an Apple Search Ads result, a small number of these analytics events (first-run setup and subscription/purchase events only) may additionally carry Apple's own campaign and ad-group identifiers for that install — Apple's standard install-attribution mechanism, which tells us which of our own ad campaigns brought you to the app. This uses a separate, short-lived token from Apple ("AdServices"), never the advertising identifier (IDFA) named above, and Apple does not require a tracking permission prompt for it.

Firebase Crashlytics (Google)

We use Firebase Crashlytics to receive automatic crash reports if the app unexpectedly stops working during a session. A crash report may include technical details such as which line of code was running, your device model, and OS version — never your photos or closet content. Crash reporting cannot be turned off in the app, because it is safety and reliability telemetry that benefits every user of a young app, including the person whose crash it reports — turning it off would only reduce our ability to find and fix the very bug that affected them.

Firebase App Check

Firebase App Check verifies that requests to our backend genuinely come from an unmodified copy of the Dresser app, protecting our AI usage allowances from abuse. It does not collect any information about you personally — it verifies the app, not the user.

Firebase Cloud Messaging (Google)

If you turn on push notifications for a feature that offers them — a studio photo finishing while the app is closed, the stylist replying while you're away, or a daily reminder to log today's outfit — the app registers a device push token with Firebase Cloud Messaging and stores it (tied to your account, if you are signed in) so our server can deliver that one notification to this device. A push token identifies this installation of the app on this device; it is not linked to your name or used to identify you across apps or websites, and no message content is processed by Google beyond routing the notification to your device. You control this entirely in Settings → Notifications, where each type of notification has its own switch, and the system permission itself can be turned off at any time from your device's own Settings app. Turning a notification off removes its device token from our server; declining or never turning one on means this app never asks your device to register at all.

Firebase Remote Config (Google)

The app uses Firebase Remote Config for a small number of server-adjustable settings — today, only the daily limit on how many outfit-photo scans (the "digitize a whole outfit in one photo" feature) the app will attempt in a day. Checking for an updated setting sends your app's Firebase Installation ID (the same anonymous, per-install identifier Firebase Analytics and Crashlytics already use — never your name, email, or any wardrobe content) to Google so it can return the value currently in effect. This lets us adjust that limit for everyone without shipping a new app update; it does not affect anything else you do in the app.

Google Gemini, via Firebase AI Logic

When you photograph or edit a clothing item, or ask the app to suggest its attributes again, the app sends Google's Gemini model a downscaled copy of the garment photo you took or picked (the original photo, resized to a 768 px JPEG). Gemini uses it to suggest a category, color, season and style tags. Background removal still happens on your device first, but the background-removed cutout is not what gets sent for tagging. The downscaled photo is. When you use the AI stylist features, including the stylist chat and an occasion you type in, your request and a description of the relevant items in your closet are sent to Gemini to generate a styling answer. The stylist chat and the other stylist text features send text only, never a photo. Dresser does not store the text of a typed occasion. It keeps only the keyed fingerprint of the request described under "AI safety records" below. Your chat conversations are saved on your device so you can pick up where you left off. If you are signed in with Apple, they are also synced to your account (see "Accounts and Sync" below) so they follow you to a new device. They stay until you delete a conversation, clear your chat history (every stored conversation, not only the recent ones shown), or delete your account; deleting a conversation or clearing your history removes it from your account too. If you never sign in, they stay until you delete the app. Opening or reading a past conversation never sends anything to Gemini. The stylist may also record a short, structured note about a preference, constraint, or dated event you state in conversation, so it can remember it in later conversations — never a raw quote or the surrounding conversation, only a short factual note. These notes are shown on "My Style," where you can delete any of them at any time; deleting is permanent. If the stylist recommends a purchase and you tap the "Find in shops" card that appears, the app opens an in-app web browser to a Google search for that item near you — that search page is Google's own and is governed by Google's privacy policy, not ours.

Outfit photo digitize (recognizing every garment in one photo). If you switch the camera to "Outfit" and photograph or pick a photo of yourself wearing a full outfit, that photo — which may show your face, or someone else's, exactly as captured — is sent to Google's Gemini model as taken, only resized for transmission, so it can identify every garment you're wearing (category, colors, season, style tags, and where each one sits in the frame) and let the app add them to your closet in one pass. The safety record described under "AI safety records" below does not hold this photo, only a fingerprint (hash) of the photo as sent. See the Terms of Use for the acceptance this involves.

Studio photo generation. If you tap to generate a studio-style product photo of an item — or, for the very first item you confirm during onboarding, when the app generates one automatically as part of introducing this feature — the item's cutout photo (or, if no cutout exists yet, the original photo) is sent to Google's Gemini image model, which returns a new, AI-generated photo of that item on a clean studio background. This is one of the few places in the app where an image itself, not just a description of it, leaves your device — here, only the item you're generating a photo for is sent. On the paid API tier used for this feature, your content is not used to improve Google's products; Google retains the image and the generated result for up to 55 days solely to monitor for violations of its Prohibited Use Policy, reviewed only by authorized Google staff, and then deletes it. Every generated image carries an invisible, Google-embedded provenance watermark (SynthID) that has no effect on how the photo looks. A studio photo is an AI-stylized derivative of your garment and may not exactly reproduce every detail — such as a logo, wordmark, or repeating pattern — so the app always keeps your original photo and cutout too, and clearly labels the studio photo as generated.

Avatar reference photo (optional). If you generate a studio-style photo of one of your saved looks and choose the "on a mannequin" presentation, you can add a reference photo — of yourself, or of someone who has given you permission to use their photo — so the AI-generated figure wearing your look's garments resembles that person: a photoreal likeness, not just a similar build or proportions. Adding a photo is always your choice: a mannequin-style photo can be generated with a generic figure and no reference photo at all, and the app's original, person-free flat-lay presentation of a look never uses or needs one. If you add a reference photo, it is sent to Google's Gemini image model together with your look's garment photos, for that one generation. The same paid-tier data policy described above for item studio photos applies here: your content is not used to improve Google's products, and Google retains the image and the generated result for up to 55 days solely to monitor for violations of its Prohibited Use Policy — reviewed only by authorized Google staff — before deleting it. Using this feature is never facial recognition or biometric identification: the app does not attempt to identify, verify, or match you to anyone; your reference photo is used purely as a visual reference for image generation, the same way your garment photos are used to depict clothing and not to identify you. Your reference photo is kept on your device until you replace or remove it, and a copy is kept, the same way every other synced photo already is, in your own private cloud storage — not automatically deleted after each photo you generate, but replaced when you add a new one, or removed, together with the cloud copy, the moment you tap "×" on the look customization screen. Deleting your account permanently deletes this photo along with the rest of your synced data.

AI safety records. Each AI request that the app or our servers make to Gemini and can attribute to your installation gets a record: item tagging, outfit photo recognition, stylist chat, the daily outfit, an occasion, a buy-check, fill-the-gap, a custom occasion, and studio photo generation for items and looks when our servers generate it. We store it in the private part of your account. It holds the safety classification Google returns for the request and for the answer (its ratings for categories such as harassment, hate speech, sexually explicit and dangerous content, and whether Google blocked the request or stopped the answer), which feature and model were used, the time and the app version, the identifiers of the related closet item, look or chat message, and a fingerprint of the content that was sent. For a photo, the fingerprint is a cryptographic hash (SHA-256) of the exact image bytes sent. For text, it is a keyed hash made with a secret key that stays on your device, so it cannot be turned back into your text. We do not store the content itself in these records, beyond what the app already stores for you elsewhere, as described in this document. For studio photo generation, our server writes the record. It holds a hash of each stored photo it used, the id of the item or look, and the storage path of the generated result. This applies to every installation, including one where you have never signed in: those records belong to the technical anonymous account described under "Accounts and Sync" and are removed after 180 days (only the lifetime counts and summary values remain).

We keep these records to prevent abuse and to comply with our AI provider's usage policies, for example to answer the provider if it asks about a possible policy violation. Each record is deleted after 180 days. Only lifetime counts and summary values (such as the highest rating seen per category) stay with the account. Deleting your account deletes all of it, including those counts and the AI-access status described below. Your right to delete your account comes before our evidence retention, so once an account is deleted we can no longer answer a provider's question about it.

Pausing AI features. If Google's safety systems repeatedly flag an account's requests, or we otherwise establish abuse of the AI features, we may pause the AI features for that account. Today this is a safeguard only; we are not using it. While AI is paused for your account, the AI features stop working. Where the app offers one, it shows a short notice instead, and it shows that notice in place of subscription and credit-pack offers, because we do not sell subscriptions or credit packs to a paused account. Your closet, looks and wear log keep working. To ask for a review, contact us in Settings → Support → Contact Support. The pause status is stored with your account and deleted with it.

Apple WeatherKit

To suggest outfits appropriate for today's weather, the app requests your device's approximate (city-level) location, with your permission, and uses it to fetch the local weather forecast from Apple's WeatherKit service. Precise location is never requested. You can review or revoke this permission at any time in Settings → Privacy → Permissions, or directly in iOS Settings.

Apple StoreKit (Purchases and Subscriptions)

When you view products, buy or restore a subscription or credit pack, or when Apple updates a purchase, Dresser uses StoreKit to receive the product identifier, transaction identifier, purchase and expiration dates, revocation or refund status, trial/offer eligibility, storefront, and verified entitlement state needed to deliver and reconcile the purchase. Dresser stores the minimum local entitlement and credit ledger needed to prevent duplicate grants and show your current access on this device. These are not part of the wardrobe sync described in "Accounts and Sync" below, but our servers keep purchase records of their own, tied to your account. That includes the technical, anonymous account the app creates for every install, even if you never sign in:

• Subscription ownership. When the app sees a subscription transaction, including a free trial or one that has since expired or been cancelled, it sends Apple's signed transaction to our server. The server verifies it with Apple and records which account the subscription belongs to. This can happen before you sign in. Credits that come with a subscription are granted only after you sign in.
• Subscription lifecycle. Apple notifies our server when a subscription changes. For a subscription tied to your account, we keep those notifications, including the event type, product, purchase and expiration dates, trial or paid state, auto-renew status, refund or revocation, price, currency, storefront, and the analytics identifier described under "Firebase Analytics" above. This is how we know that a trial started, renewed or was cancelled. Notifications for a subscription we can't yet tie to an account are kept without any account or analytics identifier (they do contain Apple's transaction identifiers for the subscription), and a copy is attached to the account once it is known. When you use Delete Account, we also delete those original copies, the ones kept without an account link. Notifications Apple sends after that are stored again without any account identifier, as described above.
• Credits. Your credit balance and the history of credits granted and spent are kept on our servers. Account deletion removes the subscription and credit records tied to your account, as listed under "Delete Account" in "Accounts and Sync" below.

Apple processes the purchase and payment method under your Apple Account and Apple's own privacy terms. Dresser never receives your full payment-card number or security code. We do not put transaction IDs, receipts, localized StoreKit errors, or payment details into analytics; monetization analytics uses only the non-sensitive product ID, paywall source, stable outcome category, and credit amount granted.

What We Don't Do

• We do not sell your data to anyone, for any reason.
• We do not use your data for advertising, and we do not collect an advertising identifier (IDFA). Apple's own install-attribution signal, described above, is a separate mechanism that only tells us which of our own ad campaigns led to an install — it identifies no one and builds no profile.
• We do not build a cross-app tracking profile of you.
• We do not share your photos or closet content with any third party except as described above, and only the minimum data needed for that specific feature to work.

Your Choices

• Analytics: turn off usage-analytics sharing at any time in Settings → Privacy → Usage Analytics.
• Camera and Location: review or change these permissions at any time in Settings → Privacy → Permissions, which links directly to the relevant iOS Settings page.
• Language: the app follows the language you have chosen for it in iOS Settings.
• Your data stays yours: deleting the app deletes your closet data from this device. (A data-export feature is planned for a future update.) If you have ever signed in with Apple, deleting the app does not delete the copy already synced to our servers — use Delete Account in Settings → Account (see "Accounts and Sync" below) to remove that too.

Accounts and Sync

Dresser offers an optional account, so your closet can follow you to a new device. Whether you ever use it is entirely your choice, and it changes nothing about how the app behaves if you don't.

• No sign-in, your closet stays on your device. The first time you open the app, it silently creates a technical, anonymous account for you in the background, with no screen and no personal information involved. No closet data leaves your device because of it (the exceptions are the AI requests you make and their safety records, the analytics identifier, and the subscription records, all described above). If you never sign in, your closet stays exactly where it always has: only on your device, exactly as described above.
• Sign in with Apple, and syncing starts automatically. From Settings → Account, you can sign in with your Apple ID at any time. This turns the anonymous account into a permanent one and immediately starts syncing your wardrobe in the background — your items and their attributes, your saved looks, your wear history, the style preferences you set on "My Style" (e.g. preferred styles, colors or categories you'd rather avoid, comfort notes), any notes the stylist has recorded from conversation, your stylist chat conversations, and the item/look photos themselves — to Google Firebase (Cloud Firestore for your data, Cloud Storage for your photos, hosted in the us-central1 region), kept in a private area of the database that only your own signed-in account can ever read or write, never visible to any other user. Signing out stops syncing immediately: every SwiftData row and photo already on your device stays exactly as it is, and new edits simply stop leaving the device until you sign in again — the same local-first guarantee this document opens with.
• What we receive from Apple when you sign in. A stable identifier for your Apple ID, and — typically only the very first time you ever authorize Dresser — your name and/or email, exactly as much as you chose to share on Apple's own sign-in screen (an Apple-generated private-relay address counts as "shared" if you picked "Hide My Email"). This account record is held in Firebase Authentication, part of the same Firebase/Google service already disclosed above; the app itself stores only a short line in Settings → Account (your email, or "Signed in with Apple" if none was shared) on your device, for your own reference — it is never written into our database. To let us revoke this app's Apple sign-in authorization later if you delete your account, we also ask Apple for, and store, a refresh token in a database location the app itself can never read back — used for that one purpose only.
• Delete Account removes your server-held copies for good. Settings → Account → Delete Account permanently purges every synced item, look, wear-history entry, stylist chat conversation, and photo tied to your account, along with your AI safety records and your AI-access status (see "AI safety records" above), your credit balance and history, your subscription ownership and lifecycle records (including the original Apple subscription notifications stored without an account link), and the stored analytics identifier (see "Apple StoreKit" above). It also revokes this app's Sign in with Apple authorization with Apple and deletes the account record itself. It does not touch your local, on-device closet — you keep using the app exactly as you do now, from a fresh anonymous session, exactly as if you had never signed in. Because this cannot be undone, if you signed in more than five minutes ago the app asks you to sign in with Apple again first, to confirm it's really you. A brief internal record of what was deleted may remain for up to 30 days (so any other device you own can catch up before it's gone), then it is permanently and automatically erased. When you delete a single stylist chat conversation or clear your chat history while signed in, the messages are removed from our servers promptly. An empty record (an identifier and timestamps, no message content) may remain for up to 30 days so your other devices can catch up, then it is automatically erased.
• Deleting the app is not the same as deleting your account. If you have ever signed in, deleting Dresser from your device removes your local closet, exactly as the "Your data stays yours" bullet above says — but it does not touch the copy already synced to our servers. That copy stays until you use Delete Account above, which is exactly what lets your closet come back if you reinstall the app or set up a new device.

Children's Privacy

Dresser is not directed at children under 13, and we do not knowingly collect personal information from children under 13.

Changes to This Policy

If we change what data the app collects or how it is used, we will update this document and its "Last updated" date. For a material change, we will also ask you to review and accept the updated policy the next time you open the app — the same one-time agreement screen you saw when you first used Dresser.

Contact Us

Questions about this policy can be sent to the support address listed in the app's Settings → Support → Contact Support.