Privacy

Contact and responsibility

Dress Nicely is operated by Konrad Lottenbach, Wettingen, Switzerland, trading as madeforth. He is responsible for the personal data described in this notice.

For support or privacy requests, use the contact form for Dress Nicely at madeforth. Begin with “Dress Nicely privacy” for a privacy request. Describe the issue and approximate processing date. Do not attach photos, identity documents, passwords, verification codes, access tokens or payment-card details in your first message.

The studio imprint and contact privacy notice explain the existing contact service. madeforth is a business designation, not a separate company.

Cloud services and availability

Public cloud image generation, service-account access and image-credit purchases are not yet available. The sections below describe their intended data handling when those features are enabled. This website does not announce an App Store release.

Your wardrobe on your device

Clothing and personal photos, generated images, wardrobe and profile information, and preferences are kept in local app storage until you remove them. Device backups may contain app data according to your system settings. The app does not automatically synchronise your complete wardrobe to a cloud wardrobe service.

Optional profile information includes height and a self-described body build. Analysis of a selected personal photo can suggest a style and an uncertain broad age group. You can correct the local suggestion; it is not verified age or identity. Selected wardrobe information, wishes and relevant profile context can be included in later AI requests.

Only add photos you are entitled to use. Avoid other people and identity documents. AI previews can change appearance and clothing details; they do not establish garment size or physical fit.

Service account and Apple sign-in

A randomly generated installation credential is kept in protected device storage. The service derives a salted access identifier and links it to a stable account, jobs, recovery state, free-use limits and image-credit records. These records are account-linked and pseudonymous, not anonymous.

Where enabled, Sign in with Apple links the service account for recovery. Apple processes the sign-in. The app sends the identity token, sign-in challenge and, when available, authorisation code to the service for validation. The described sign-in flow does not request name or email scopes. The service retains a salted Apple-account identifier and, when available, an encrypted capability for revoking authorisation.

Cloudflare processes technical connection information. Registration uses a daily salted value derived from the IP address to limit abuse. This daily value is separate from Cloudflare’s own platform and access logs.

Selected photos and AI processing

When you use an enabled AI feature, selected inputs are sent over HTTPS to the Cloudflare-hosted Dress Nicely service. The service sends the required content through OpenRouter to the configured processing provider.

Text processing in app versions with privacy text from before 29 October 2026, including Singapore version 1.0.0: Clothing recognition, outfit selection, wearing instructions and personal-photo age and style estimates use only Gemini 3.5 Flash Lite through OpenRouter to Google AI Studio. These versions do not use Vertex AI or a fallback model or provider for text processing. Google’s 55-day AI Studio retention rules described below apply.

Text processing in app versions with privacy text from 29 October 2026 or later: The app identifies that it includes the updated text before the service enables the Google Vertex AI route. These versions use the text models described below.

Outfit previews and try-on images: App versions with privacy text from 30 October 2026 or later that names OpenAI use OpenAI for these images. All earlier versions, including Singapore version 1.0.0 and TestFlight versions without this new text, use Black Forest Labs. The app identifies its privacy-text version before the service enables OpenAI. Studio images of garments use Black Forest Labs in every version.

Clothing recognition, outfit selection and wearing instructions in updated app versions: Selected photos, garment descriptions, wardrobe details, prompts, language and styling wishes go through OpenRouter to Google Vertex AI using Claude Haiku 5.5. Anthropic develops this model; Google operates the configured processing route.
Personal-photo age and style estimates in updated app versions: The selected personal photo and accompanying instructions go through OpenRouter to Google using Gemini 3.5 Flash Lite on Vertex AI or AI Studio. Gemini is the first choice for this analysis and also the fallback when Claude is unavailable. Claude may in turn handle personal-photo analysis when Gemini is unavailable. These text requests remain restricted to Google.
Studio images of garments in all app versions: Selected garment photos and the image request go through OpenRouter to Black Forest Labs using FLUX 3 Image Klein.
Outfit previews and try-on images in versions with privacy text from 30 October 2026 or later: Your selected personal photo, selected garment reference photos, outfit wishes and optional height and body-build details go through OpenRouter to OpenAI using GPT Image 2.5 Flare.
Outfit previews and try-on images in earlier versions: The selected photos, outfit wishes and optional height and body-build details go through OpenRouter to Black Forest Labs using FLUX 3 Image Klein.

Only app versions with privacy text from 29 October 2026 or later can switch text requests between the two text models and the allowed Google services. Each image request uses only the model and provider described above for its feature and app version, without a fallback model or provider. Requests deny provider data collection through the routing setting; security and abuse checks remain separate. This is not a complete list of those services’ subcontractors. OpenRouter receives request content and technical connection information; the app’s service-access and Apple sign-in credentials are not sent as AI-provider credentials.

For the Google-hosted partner-model route used here, Google states that customer prompts and model responses are not shared with third parties, including model partners. Anthropic is the model developer, not a separate recipient of your photos on this configured route. See Google’s partner-model data handling.

Private Cloudflare storage temporarily holds selected input copies, accompanying request information and results. Job and delivery records are linked to the service account. Photos and free text can identify a person even without a name field.

Purchases and billing records

The prepared Apple purchase flow uses StoreKit for consumable image-credit packs. Prices come from StoreKit; the authenticated service catalogue must also allow the product. The purchase uses the existing recoverable account and its app-account token. Opening the credits page does not create another account or grant credits locally.

The app sends the store transaction identifier to the service. Private verification checks the signed Apple transaction and current Apple transaction information: transaction and original-transaction identifiers, product, environment, account association and relevant times. Before completing the native purchase, the app requires a committed response matching the account, transaction and verified product, with valid entitlements. Replaying a transaction does not create another full grant or undo a refund.

The private purchase-verification role receives no photos, prompts or payment-card/bank details. Its hosting and operation must be established before purchases are enabled; no new hosting provider or Singapore-only processing commitment is asserted here.

Verified, transaction-linked Apple events are deduplicated. Case records include event identifier, environment, type, payload hash, signed and first-received times, deadline/status, required account/transaction/product/recovery associations and financial references. Protected decisions retain action, time, operation and state/fingerprint/result references. Their purposes are purchase/refund handling, unresolved-case review, audit and preventing duplicate financial changes. They are account-linked records, not anonymous analytics.

A refund reversal needs an authorised decision and a fresh check of the same transaction. A correction can release only original units that are unused and unreserved. Other verified cases can remain pending; recording or deferring a case is not automatic resolution.

The prepared service does not collect a separate consent for Apple’s consumption-information process and sends no consumption API request, usage statistics, false-consent response or invented zero-use figures. A verified request records non-participation. A receipt acknowledgement is not consumption disclosure. AI permission does not provide this separate consent.

Operational information

Job, stage and event references, model, time, status, image counts, provider-request references and known or unresolved costs support operation and accounting. A separate Cloudflare collector receives a reduced cost receipt without photos, prompts, body details or account ID. Job and request references can still be correlated; this is not anonymous data.

The app does not include advertising or general tap analytics. Account, job, cost, security, billing and platform records remain separate processing activities.

Weather is optional and off until you enable it. With your permission, the app reads an approximate location while you use it, rounds the coordinates to two decimal places and sends them through our Cloudflare service to MET Norway for a forecast. This request contains no app-account or device identifier. The service does not forward your IP address or account headers to MET Norway. It caches public forecasts by rounded grid cell for up to 24 hours, without an association to a user or a location history. The current location and forecast stay in the app's memory only. Turning weather off or removing permission clears them. Outfit requests may include forecast values, never coordinates or a place name.

Weather settings name MET Norway weather documentation and the CC BY 4.0 licence. Dress Nicely summarises forecasts and converts units. The location permission is separate from permission for AI photos.

From version 1.0.2, the app can check whether an update is required. It sends the installed app version, iOS version and App Store country to our Cloudflare service, without an account or device identifier. When a minimum version is active, the service checks the public Apple listing for that country. These checks do not create a per-user update history. If an update is required and compatible with your iOS version, the app directs you to the App Store.

The new billing routes do not themselves write request logs. This does not establish the host’s or Cloudflare’s diagnostic retention. Financial audit is separate from host logs.

Removing content and deleting an account

Removing a garment, personal photo or result removes the corresponding local files, or files no longer referenced by the local app. It does not automatically erase provider records, store records or device backups.

The account-access page has a separate Delete account flow with confirmation. Active or queued work can prevent deletion until a safe state is reached. An accepted deletion blocks service access, handles open jobs, schedules temporary media cleanup and returns a status receipt. The app then removes local content and the account credential. Pending cleanup is not confirmation that every copy has been erased.

For an Apple-linked account, the service attempts to revoke Apple authorisation only with the required stored permission and separate Sign in with Apple configuration. Purchase-verification credentials do not provide that permission. Follow the app’s pending, retry, configuration-required or manual-action status. A manual step in Apple Account settings may be needed; immediate successful revocation is not guaranteed.

The prepared purchase-event service removes retained signed case payloads and case account tokens atomically on account deletion, records the deletion association and prevents a later billing decision from reviving the account. Financial ownership/journal records remain under their separate rule. Minimal access-blocking, allowance, receipt and replay records can remain to prevent reuse. The deleted account and balance cannot be restored through this flow. External providers, Apple, backups and protected archives have separate records.

Reporting an AI image

Use Report image on a generated result and choose a reason. The report sends that reason and the authenticated job/result reference, without original reference photos, prompts or personal comments.

Allow review of this generated image is optional. It permits access only to the existing generated result while it is still available on the service. It creates no additional image copy and does not extend storage. A receipt confirms submission, not completed review or a response time.

How long information is kept

These are distinct product rules. They are not a claim that Singapore law requires ten years for every record. Cleanup and redaction are asynchronous and can be delayed until maintenance succeeds. Removal of every collector, operator, provider and backup copy is not guaranteed.

Local photos, profile, wardrobe and results: Until you remove them. Device backups have separate platform handling.
Temporary service inputs: Scheduled for deletion after the processing stage ends, including failed or uncertain outcomes. Failed deletions are retried; no exact physical deletion time is promised.
Generated service results: A 24-hour retrieval window, followed by asynchronous cleanup. This is availability, not erasure of every record within 24 hours.
Provider-request references and individual free-use journal entries: 90-day redaction/retention rules. Invalid dates or incomplete enforcement can delay completion. Cumulative allowance counters and non-expiring balances can remain while the account exists.
Financial and cost records: Ten full calendar years after the event year ends. Unknown costs, undelivered records and unresolved reviews can prevent final cleanup. Under this product rule, an event in 2026 ordinarily reaches its cutoff on 1 January 2037.
Signed raw payloads for pending Apple-event cases: A 30-day rule through existing periodic maintenance. Terminal consumption non-participation stores no raw payload; successful correction or account deletion removes it. Later private resubmission of the exact original for verification does not restart retention.
Apple-event case metadata and financial decision audit: The financial-deadline rule, calendar-year end plus ten years. Maintenance then reduces the case to a minimal event/environment/type/hash/time/completion record without owner, account, transaction or raw payload.
Minimal event and operation replay references: No general short expiry. Event tombstones and operation fingerprints, historical result/state references and times prevent duplicate processing. The minimal operation record contains no raw payload or account content; it does not restore a deleted account or old grant.
AI-report and deletion-status records: A 30-day record/status window, without extending generated-image availability.
Encrypted Apple revocation capability: At most seven days or 24 attempts in the automatic procedure, then a manual step may be required.
Daily abuse-prevention IP value: Prior-day values are removed by the service sweep. Cloudflare’s own logs have separate retention.
Access, allowance and purchase-reuse barriers: No general short expiry while the relevant access or purchase-verification system accepts those identifiers.
Database recovery and protected metadata archives: Cloudflare database recovery can cover the preceding 30 days. Protected checkpoint archives have an indefinite operations lock, not an automatic 30-day expiry.

Support correspondence and related case evidence are kept only for as long as reasonably necessary to answer the request, handle the service or business relationship, meet legal obligations or establish, exercise or defend claims. Operational records and private evidence copies are kept where needed to investigate unresolved processing, delivery or billing, preserve recovery evidence and meet the separate accounting rules. Unresolved cases and protected archives can extend storage. Hosting and platform diagnostics have their own delivery, security and operational purposes; no new host-log period is promised here. These criteria do not shorten financial records, replay prevention or protected archives.

Providers and international processing

For the OpenRouter workspace used by Dress Nicely, optional input/output logging and use of inputs and outputs for OpenRouter product improvement are disabled. No trace destinations are configured. OpenRouter retains separate technical metadata. These settings and the request restrictions do not guarantee zero retention, no training by every processing provider or processing in a particular country. Read its data-collection information and privacy policy.

Google AI Studio / Gemini API: Google documents 55-day retention of prompts, accompanying context and output for abuse monitoring and required legal disclosures. Authorised staff may review flagged content. Those logs are not used to train models except models specifically used for policy enforcement. See Google’s Gemini API abuse-monitoring rules.

Google Vertex AI: Different abuse-monitoring rules apply. For Google models covered by its standard rules, Google may log suspicious prompts for up to 90 days and authorised staff may review them; applicability depends on the customer’s Google agreement. Google’s documentation does not specify a separate fixed retention period for Claude Haiku 5.5 on this route. The 30-day rules for designated Advanced AI models are not a general Claude retention promise. We therefore do not apply AI Studio’s 55-day period to all Vertex AI requests or promise zero retention for Haiku. See Google’s Vertex AI abuse-monitoring rules.

Black Forest Labs’ general notice gives no universal deletion period and distinguishes separately contracted enterprise processing. No enterprise exception for this route is asserted here. See the Black Forest Labs privacy policy.

OpenAI, for outfit previews and try-on images in versions with the new privacy text: OpenAI does not use these API inputs and outputs for training. Abuse-monitoring logs may include requests and results and are normally retained for up to 30 days. OpenAI allows longer retention where required by law or reasonably necessary to protect its services or others from harm. Image inputs flagged as potentially containing child sexual abuse material are retained for manual review, even under approved Zero Data Retention arrangements. We do not promise Zero Data Retention for this route. See OpenAI’s API data controls and OpenAI’s privacy policy.

OpenRouter’s commercial terms of OpenRouter incorporate its data processing agreement of OpenRouter, which includes standard transfer clauses and UK/Swiss adjustments where applicable. These terms do not establish a Singapore-only or EU-only processing location.

Google processing may use global, European or US infrastructure. Processing is not restricted to Singapore, Switzerland or the EU. This notice makes no route-wide promise of no human review, no retention or no training.

Requests about your information

Subject to applicable law, you can request access and information about use/disclosure, ask for correction, withdraw consent where relevant and raise deletion or retention questions. Start through the contact route above with the minimum details needed. A later account or identity check should be limited to what is necessary; do not send identity documents or photos in the first message.

For information about Singapore’s data-protection framework and regulator channels, visit the Personal Data Protection Commission.

Security and this website

The app-service routes described here use HTTPS, protected device credential storage and private temporary media storage. Processing services can access content required for their role. This is not end-to-end encryption from you back to you, and no absolute security guarantee or certification is claimed.

Cloudflare delivers this website and processes technical request information, including IP address, requested resource, time and connection/security information, for delivery and protection. Fonts and images are served with the site. This page has no advertising, general analytics or mailing-list form. See Cloudflare’s privacy policy.

The separate madeforth contact notice states that its form forwards the message, email address and related metadata through Cloudflare Email Routing as email, without storing the message on the website. Its stated purpose is handling the enquiry and related obligations. Opening that contact site is separate from app processing.