Privacy policy

1. Who is responsible

The data controller is Aitor Fernández López, tax ID (NIF) 53518010T, based in Málaga (Spain).

For anything about privacy you can write to hello@tinycloset.app.

This policy covers the TinyCloset app and the website https://tinycloset.app.

2. What stays on your phone

TinyCloset works without an account or sign-up. Everything you add is stored only on your device:

• Garments: their photos, category, size, colour, season, brand and notes.
• Your baby's details: name, date of birth or due date, sex (optional) and measurements (optional).
• Your settings and the size confirmations you make.

We do not receive this data and we hold no copy of it. There is no cloud sync.

If you have iCloud Backup turned on, the app's data is included in it; that backup is handled by Apple under your own account, not by us.

3. Catalog photos with AI

This feature is optional and only works with your explicit consent: the first time, the app explains what is sent and asks for permission. If you don't give it, nothing is sent and the app cuts the photos out on your own phone.

If you allow it, adding a garment sends:

• The photo of the garment and, if you take one, the photo of its label.
• Your device's language and the app version.
• An install identifier.

The photos go to our server, hosted on Cloudflare, which forwards them to OpenAI to analyse the garment, read the label and generate the catalog image. Our server does not store the photos: it processes them in memory and discards them once it has answered.

OpenAI only receives the photo and the instructions to process it. It does not receive your install identifier, your IP address or any information about you or your baby.

OpenAI does not use data sent through its API to train or improve its models. It may keep it for up to 30 days to monitor for abuse, unless the law requires it to keep it longer. OpenAI automatically scans images to detect illegal content and, if one is flagged, may keep it for review.

Photograph only the clothes, never your baby. If the analysis detects a face, a child or a person's body, the photo is discarded and no image is generated.

You can withdraw your consent whenever you like in Settings › Privacy. From then on no more photos are sent.

4. The install identifier

To prevent abuse, our server limits how many photos each installation of the app can process. For that, the app creates a random identifier the first time you use AI photos and keeps it in your device's keychain.

It is a pseudonymous identifier: it is personal data, but it is not linked to your name, your email or any account, and it does not let us know who you are. It is only used to count how many analyses that installation has made in the last hour and the last day.

Because it lives in the keychain, the identifier may remain on your device even if you delete the app. It is not included in backups and does not move to other devices.

The counter tied to that identifier is kept on our server (Cloudflare) and is deleted automatically after 7 days without use.

The server's logs store neither the install identifier nor your IP address. Cloudflare processes the IP transiently in order to provide the service. We only keep technical details of each request (its status, the app version, timings and cost) for 3 days.

5. App usage analytics

The app uses TelemetryDeck to learn, anonymously, which features are used and to improve it. It is analytics with no personal identifiers: it cannot identify you or follow you across apps, and it never includes your baby's name, date of birth, measurements or photos.

You can object at any time by turning it off in Settings › Privacy › "Share anonymous usage data". With it off, nothing is sent.

6. Device permissions

• Camera and photos: to photograph garments or pick them from your library.
• Notifications: to let you know about size changes. They are scheduled on your own device; we use no push servers.

You can withdraw any of these permissions in your phone's settings.

7. Our legal bases

• Catalog photos with AI and the install identifier: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Anonymous app analytics and website statistics: our legitimate interest in improving the product (Art. 6(1)(f)). You can object to the app's analytics from its Settings.

8. Who else handles the data

We do not sell your data or share it for advertising. We work with these processors:

• Cloudflare, Inc. (USA): hosts our intermediate server and the usage counters. Transfer covered by the EU-US Data Privacy Framework and, should it cease to apply, by standard contractual clauses.
• OpenAI Ireland Ltd. (Ireland): analyses garment photos and generates the catalog images. Its transfers to OpenAI in the USA are covered by standard contractual clauses.
• TelemetryDeck GmbH (Germany): anonymous app analytics. Its servers are in the European Union (the Netherlands and Germany), so there is no international transfer.
• Vercel Inc. (USA): hosts this website and its statistics. Transfer covered by the EU-US Data Privacy Framework and by standard contractual clauses.
• Apple: distributes the app as an independent controller.

9. How long data is kept

• Your wardrobe data: on your phone, until you delete it or remove the app.
• Photos sent for AI: our server does not keep them; OpenAI, for up to 30 days.
• The per-install usage counter: up to 7 days without use.
• The server's technical logs: 3 days.

10. Children

TinyCloset is made for mothers, fathers and other adults who look after a baby. It is not directed at children and is not part of the App Store's Kids category.

The baby's details are entered by the adult using the app and stay on their device.

11. Your rights

You can exercise your rights of access, rectification, erasure, portability, objection and restriction of processing, and withdraw your consent, by writing to hello@tinycloset.app.

Bear in mind that we do not hold your wardrobe and have no way of knowing which installation is yours: the identifier is not visible to you and is not tied to your identity. That is why most of these rights are exercised directly in the app, where you can see, correct and delete all your data.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with your local supervisory authority.

12. How to delete all your data

You can delete each garment and each baby from the app. Removing the app from your phone deletes the garments, the photos and your baby's details.

The install identifier is kept in the device's keychain and may remain even if you delete the app. It contains no information about you.

Nothing of yours remains on our server except the usage counter tied to that identifier, which deletes itself after 7 days without use.

13. This website

This website uses no cookies. Visit statistics come from Vercel Analytics, which uses no cookies and collects no personal data: only aggregate figures, such as the most viewed pages.

The size calculator does all its work in your browser: the date of birth and height you type are neither sent nor stored.

Like any web server, Vercel processes your IP address in order to serve you the pages.

14. Changes to this policy

If we change anything important, we will update this page and the date above.