Effective 9 October 2026
Privacy Policy
Sitaarah AI is made by AYMO Ventures Inc., Toronto, Canada. We are the controller of the personal information described here. You can reach us at [email protected].
This policy says what we collect, what we do with it, who else sees it, how long it lasts, and what you can do about it. It is short because we keep very little.
The short version
- Your photos and your looks live on your phone. We do not have a copy.
- To make a look, your photo and the garment picture go to our server and on to Google's image model, and are used for that one render. We keep no copy. Google may keep one for a limited period, solely to detect abuse of its service. We never use your content to train anything, and Google's paid terms bar it from using your content to improve its products.
- The only record we keep is a counter: which device, which plan, how many renders. No name, no email, no face data.
- We show no ads in the app and sell nothing about you to anyone. We count which screens are used and whether a look was made, under an anonymous device id, and we delete those counts if you ask.
- We advertise the app on Instagram and Facebook, and Meta helps us see which of those ads brought people to it (section 1.8). Your advertising identifier goes to Meta only if you allow tracking when Apple asks.
- You can delete everything, on your phone and on our server, with one tap in the app.
The rest of this policy is the same thing in full.
1. What we collect
1.1 Your photo and your looks
You give the app one full-length photo of yourself. It is checked on your phone, by code that runs on your phone, to see whether a try-on can be made from it. Nothing is sent during that check.
If you choose Scan my camera roll, the app asks for access to your photo library and then, on your phone, looks through your newest photos (up to 1,000) for ones a try-on can be made from. It reads small copies of them to do this. Nothing about them leaves your phone, and nothing is kept — not the photos, and not which ones were looked at. You see the ones that would work and choose which are you; only those are copied into the app, exactly as if you had picked them yourself. If you gave access to only some photos, it looks only at those. You can turn the access off in your phone's Settings at any time; choosing photos yourself needs no access at all.
When you ask for a look, the photo and the garment image are sent, over an encrypted connection, to our server, and from there to Google's Gemini image model, which makes the picture. Our server holds both images in memory only for the seconds it takes, uses the finished picture to check that you were not changed, then returns it to your phone and forgets all three. We write no image to disk, ever, and we keep no description of your face or body. The check produces a handful of yes-or-no answers ("face unchanged", "coverage not reduced") that are counted, not kept against you.
The finished look is stored on your phone, in the app's own folder. So are your photos. Deleting them in the app deletes the files.
1.2 The record on our server
For each install, our server keeps:
- A device key. On iPhone this is the identifier of a key created by Apple's App Attest inside your phone's secure hardware; on Android it is a Play Integrity token. It proves a request came from a real, unmodified copy of the app. It is not your phone's serial number or advertising identifier, and it cannot be tied to you by anyone.
- A user record. An anonymous id, your plan, when it expires, how many renders you have used this period, and how many top-up credits you hold. If you sign in with Apple, the anonymous id is replaced by Apple's opaque identifier for you, and the record follows you to a new phone.
- Render records. For each render, a random key generated by your phone, whether it was charged, whether the free fix was used, the check's yes-or-no answers, and timestamps. This is what stops a retried render being charged twice. It contains no image and no description of you.
- Rate-limit counters, kept for minutes, and a daily render count, kept per day.
1.3 What we do not collect
We do not collect your name, email address, phone number, contacts or location. We run no crash-reporting service. Besides the usage counts in section 1.7, the only measurement is the ad measurement in section 1.8, which receives your advertising identifier only if you allow tracking. If you sign in with Apple and share your first name, the name stays on your phone to greet you; it is not sent to us. We never receive your email, even a relay address.
Your answers to the onboarding questions (height, occasions, age range, undertone) stay on your phone. They shape what the app shows you; they are not sent to our server.
1.4 Server logs
Like every service on the internet, our hosting provider records each request's IP address, time and result for security and to diagnose failures. Those logs are held by Google Cloud for 30 days and then deleted. We do not use them for anything else.
1.5 Support
If you email us, we keep the email so we can reply and so we remember what we told you. If you attach a picture, we keep it only as long as the conversation needs, then delete it.
1.6 Reports
If a look went wrong, you tell us by email, from the look itself. The email carries the garment's name and the reason you chose, and nothing else unless you add it. A screenshot you attach is used to look at what went wrong and is deleted within 30 days.
1.7 Usage counts
To learn whether the app works — whether onboarding is finished, whether a first look gets made, whether a look was shared — the app and our server send a short record of certain moments to PostHog, an analytics service, on servers in the European Union: which screen was reached, that a photo passed or failed the on-phone check (and why, as a code), that a search of your photos was started and how many photos it looked at and found (numbers only), which section a garment came from, that a render started, how long it took and whether it was charged, that a look was saved, shared or deleted, and that a plan or a pack was bought. Each record carries the anonymous device id from section 1.2, the app's version and language, and nothing else about you: no photo, no look, no garment picture, no words you typed, no name, no email, no location. We do not derive a location from your address on the internet. There is no session recording and no automatic capture of taps.
These counts are anonymous and are never used to identify you, to advertise to you, or to track you across other apps. Delete everything under Me → Our promise also resets the anonymous id they carry.
1.8 Ad measurement
We advertise Sitaarah on Instagram and Facebook. To learn which of our ads brought people to the app, so that we keep the ones that work and stop paying for the rest, the app includes Meta's measurement tool (the Meta SDK), and RevenueCat tells Meta when a trial or a subscription starts.
Nothing is sent to Meta until you have answered Apple's question about tracking, which the app asks once, before the plans are shown. Whatever you answer, Meta then receives:
- that the app was installed and opened, and that you finished the first-run questions;
- that a trial, a subscription or a credit pack was bought, with its price;
- an anonymous id the Meta SDK creates on your phone, your phone's identifier for our app (Apple's IDFV), your internet address, the app's version, and your phone's model and system version;
- if Meta's SDK itself crashes, a report of that crash, which is not linked to you.
Only if you allow tracking does Meta also receive your phone's advertising identifier (IDFA), which lets Meta connect the app to the ad you saw on Instagram or Facebook.
If you do not allow tracking, Meta still receives the items in the list above, and uses them only in aggregate to measure our ads, under its own rules for apps without tracking permission.
Meta never receives a photo, a look, a garment picture, words you typed, your name or your email. Meta is an independent controller of this data under its own privacy policy (facebook.com/privacy/policy). You can change your answer at any time in your iPhone's Settings → Privacy & Security → Tracking; saying no changes nothing in the app.
2. How we use it
- To make the look you asked for.
- To check that the look kept you as you are, and to redo it free if not.
- To count your renders against your plan, and to make sure a retry is never charged twice.
- To stop abuse: a device that is not a real copy of the app, or one making far more requests than a person could.
- To reply when you write to us.
- To see, in aggregate, where the app loses people and where it works, from the usage counts in section 1.7.
- To learn which of our own ads on Instagram and Facebook brought people to the app, from the ad measurement in section 1.8.
- To meet legal obligations, such as tax records for payments (which are held by Apple or Google, not us).
We do not use your information to show you ads in the app, to build a profile of you, to make automated decisions about you, or to train any model, ours or anyone else's. The ad measurement in section 1.8 is used only to learn which of our own ads work.
3. Legal basis (for readers in the EEA, UK and Switzerland)
We process your photo and the garment image with your consent, which you give explicitly in the app and can withdraw at any time from Me → Our promise. Because a photo of your face is special-category data under the GDPR, we rely on your explicit consent for it and on nothing else.
We keep the device and user record because it is necessary to perform our contract with you (to deliver what you paid for), and we run the device check and rate limits under our legitimate interest in keeping the service secure, which we have weighed against your interests and consider proportionate given that the check involves no personal data about you. The usage counts in section 1.7 rest on the same legitimate interest, in understanding whether the app works; they carry no personal data beyond the anonymous device id, and you can ask us to delete them.
The ad measurement in section 1.8 rests on our legitimate interest in knowing which of our ads work, which we have weighed against yours: Meta receives no content of yours, and without your permission no advertising identifier. Your advertising identifier is shared only with your consent, given in Apple's tracking question and withdrawn in your iPhone's Settings → Privacy & Security → Tracking.
4. Who else sees it
We share as little as possible, with as few as possible. Everyone below is a processor acting on our instructions, under a written agreement, except where stated.
| Who | What they see | Why |
|---|---|---|
| Google (Gemini API) | Your photo, the garment image, and the finished picture, for the seconds of one render | Making and checking the picture. We use Google's paid API, under terms that do not allow Google to use your content to improve its products. Google may keep prompts and outputs for a limited period, solely to detect and prevent abuse of its service and for legal requirements; if its systems flag something, authorized Google staff may review it. Google may process or briefly cache this data in any country where it operates. |
| Google Cloud | Our server and its database (the counters above) and request logs | Hosting. Servers are in the United States (Virginia). |
| Apple (or Google Play) | Your purchase and subscription, handled entirely by them | Payment. Apple and Google are independent controllers for your payment data under their own policies. We never see your card. With Sign in with Apple, we receive only Apple's opaque identifier for you. |
| RevenueCat | Your anonymous or Apple-keyed user id and your subscription status, from the app store | Knowing which plan is active. RevenueCat does not receive images or anything about you beyond that. |
| PostHog | The usage counts in section 1.7, under the anonymous device id, and your subscription's status changes as RevenueCat reports them | Measuring whether the app works. Servers are in the European Union. PostHog does not receive images or anything about you beyond that. |
| Meta Platforms | The items in section 1.8: install, opens, finishing the first-run questions, trials and purchases with their price, the SDK's anonymous id, your phone's identifier for our app, your internet address, phone model and system version, crash reports of its own SDK, and your advertising identifier only if you allow tracking | Measuring which of our ads on Instagram and Facebook brought people to the app. Meta is an independent controller for this data under its own privacy policy. It does not receive images, words you typed, your name or your email. |
| The seller whose garment you paste | The request from your phone for their product page or image, including your IP address | Fetching the garment picture. This happens directly from your phone to their site, with no server of ours in between, and their privacy policy applies to it. |
We will also disclose information if the law requires it or to protect someone's safety, and only the minimum required. If AYMO Ventures Inc. is ever sold or merged, this record would go with it, under this policy.
We do not sell personal information. The only information that leaves us for advertising purposes is the ad measurement in section 1.8, shared with Meta to learn which of our own ads work.
5. How long we keep it
| Information | Where | How long |
|---|---|---|
| Your photos and looks | Your phone | Until you delete them, or delete everything |
| Your photo and garment image during a render | Our server, in memory | Seconds; gone when the render returns |
| Your photo, the garment image and the finished picture | Google (Gemini API) | A limited period, only to detect abuse |
| Device key and user record | Our server | Until you delete everything, or 24 months after the device was last seen |
| Render records | Our server | 90 days |
| Server request logs | Google Cloud | 30 days |
| Rate-limit and daily counters | Our server | Minutes to one day |
| Usage counts | PostHog (EU) | Up to 24 months. They carry only the anonymous device id, so once you delete everything nothing can tie them to a person; write to us to have them removed sooner |
| Ad measurement (section 1.8) | Meta | Under Meta's own policy. The SDK's anonymous id stays on your phone until you delete the app |
| Support emails | Our mailbox | 2 years |
| Screenshots you attach to a report | Our mailbox | 30 days |
Delete everything in the app (Me → Our promise → Delete everything) removes your photos and looks from your phone and, in the same tap, deletes the device key and user record from our server, asks RevenueCat to delete its record of your subscription, and stops the ad measurement in section 1.8 for the rest of that session. It cannot be undone. To stop the advertising identifier going to Meta for good, say no to tracking in your iPhone's Settings → Privacy & Security → Tracking.
6. Security
Everything between your phone and our server travels over TLS. Every request is signed by your phone's secure hardware, so a forged request is rejected before anything is read. Images are never written to disk on our side. Our database holds only the counters above. Access to it is limited to the people who run the service, which today is one.
No system is perfect. If a breach ever affects your personal information, we will tell you and any regulator we are required to tell, without undue delay and within 72 hours where the GDPR applies.
7. Where your information goes
We are in Canada. Our server and database are in the United States, run by Google Cloud. For readers in the EEA, UK and Switzerland, transfers to Google rest on the standard contractual clauses in Google Cloud's data processing terms, and to us on the same clauses; Canada is also recognized by the European Commission as providing adequate protection for commercial organizations under PIPEDA. Meta receives the ad measurement in section 1.8 in the United States, as an independent controller under its own transfer safeguards. A copy of the relevant clauses is available on request.
8. Your rights
Wherever you live, you can:
- see what we hold about you (the record in section 1.2; the app shows you most of it under Me);
- correct it, though there is little to correct;
- delete it, from the app, without asking us;
- withdraw consent to our using your photo, from Me → Our promise, which also deletes your photos from your phone;
- object to the usage counts in section 1.7, by emailing us, and we delete the counts held for your device id;
- take your looks with you, because they are already on your phone as ordinary image files;
- complain to us, and to a regulator.
Under the GDPR you can also restrict or object to processing and lodge a complaint with your supervisory authority; under the UK GDPR with the Information Commissioner's Office; in Switzerland with the Federal Data Protection and Information Commissioner. Under Canada's PIPEDA you can complain to the Office of the Privacy Commissioner of Canada. California residents have the right to know, delete, correct, and to opt out of sale or sharing. We sell nothing. The ad measurement in section 1.8 may count as "sharing" under California law; you can opt out of it by saying no to tracking when Apple asks, or later in your iPhone's Settings → Privacy & Security → Tracking, and we will never treat you differently for exercising a right. Readers in Saudi Arabia and the UAE have equivalent rights under their personal data protection laws.
To exercise any right, use the app, or write to [email protected]. We answer within 30 days, usually within a day. We may need to confirm the request came from the phone in question, since we hold nothing else that identifies you.
9. Children
Sitaarah is for people aged 16 and over. We do not knowingly collect information from anyone younger. If you believe a child under 16 has used the app, tell us and we will delete the record.
10. Sellers' sites and other links
When you paste a link, your phone fetches it from the seller's site directly. That site sees the request, and its privacy policy, not ours, governs what it does with it. The same applies to Apple's subscription pages and any other link the app opens.
11. Marketing
We hold no email address for you, so we cannot and do not send marketing. The one notification the app sends, the reminder before your free trial ends, is scheduled on your phone by the app itself; nothing is sent from our server, and you can turn it off in your phone's settings.
12. Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect, and for anything that would let us keep more of your information or use it in a new way, we will ask you again rather than assume. The date at the top is the date of the current version.
13. Contact
AYMO Ventures Inc. Toronto, Canada
A real person reads every message and usually replies within a few hours.