Privacy Policy

Your closet and your wear history live on your iPhone, and we keep no lasting copy of either. A filtered list of your clothes does reach our servers each night so tomorrow's outfit can be made while you sleep, and it is deleted after 36 hours. The same list goes with each outfit you ask for during the day, and is not kept after that request.

Two other things leave your phone and they are the ones most worth reading about: the photographs you add, which go to two outside services so they can be turned into clean pictures of your clothes, and a rough idea of where you are, so we can look up the weather. Some smaller things go too — a few numbers describing your taste, your answer about how formal a normal weekday is, scrambled codes for the last week's outfits, the occasion you pick, the garments Shuffle has already shown you, and any shop link you paste. Every one of them is in one list below, with how long it is kept.

We do not sell anything about you. We do not use what you give us to train an AI model, and we do not licence it to anyone else to train theirs.

Get DRSSD is made by ZIKZAK LLC, at 11752 Dawkins Ridge Ln, Bristow, Virginia 20136-6184. For anything in this policy, write to privacy@getdrssd.app. If you are in the EU or the UK, ZIKZAK LLC is the data controller for the information described here.

Signing in with Apple is the only way to use Get DRSSD. When you sign in, your phone hands us the token Apple issues and, the first time only, the name Apple passes along. From that we store on our servers:

• The identifier Apple gives us for you — a long string that is meaningful only to Apple and to us.
• The email address Apple passes along. If you chose "Hide My Email" this is one of Apple's relay addresses and not your real one. If you did not, it is your real Apple address.
• The name Apple passes along, if it passes one. We record it once and never overwrite it.
• A customer number we generate for you, in the form DRS-000000001. It is how support finds your account without asking for anything personal.
• A token from Apple that lets us tell if you later revoke DRSSD's access to your Apple account. It is never exported, logged or sent back to any app.

We keep all of this for as long as your account exists. We never see your Apple password, and there is no DRSSD password to lose.

If you allow notifications, your phone gives us a delivery code for that device, and we store it against your account so the morning outfit can be pushed to your lock screen. Live Activities — the lock-screen card that updates through the morning — each produce a further code of the same kind.

When you sign out, the app asks our server to delete that device's code straight away. If your phone is offline at that moment the deletion is retried rather than guaranteed, and the code is reassigned or removed the next time it is used. Live Activity codes are removed when your account is deleted.

This is the part of the app that shares the most, so it gets the most detail.

What the app keeps on your phone

When you add a garment, the app makes its own smaller copy of the photograph — resized so the longest side is about 1024 pixels — and stores it in DRSSD's own folder on the iPhone. The original stays in your photo library, untouched, and we never take a copy of anything else in there.

That copy is erased when you remove the garment from the add screen, and the whole folder is erased when you delete your account. Two things to know: if you retire a garment rather than removing it, the app keeps its picture, because a retired garment still has one in your closet. And when one photograph shows several garments, its picture is erased only once the last of them is gone.

What leaves your phone, and to whom

The photograph itself is sent to us whole, and on to two outside services. There is no way around this: the job is to look at a picture of your clothes — including one of you wearing them — and return each garment drawn as if it were laid out flat and ironed. That cannot be done on the phone, and a cropped-out version cannot be used because the crop is exactly what removes the person.

• Google, which looks at the photograph and names every garment it can see.
• Cloudflare, which runs the image model that redraws each garment laid flat on white.

Our own server holds the photograph only in memory, for as long as the request takes. It is never written to our storage and never written to a database. We keep no lasting copy of it, nothing about it is sold, and it is not used to train any model. What Google and Cloudflare do with the bytes they receive is governed by their own terms, linked below — we tell you who receives your photograph rather than making a promise on someone else's behalf.

Once the garments come back, the app erases the photograph it sent and keeps the flat pictures instead.

Turning it off

There are two switches, both labelled “Turn photos into garment pictures”. One is permanent, in Settings, then Privacy, then “Your data”. The other appears above the grid whenever you are adding clothes, and covers just that batch. Either one being off is enough. With it off, nothing is sent anywhere — the phone names your clothes by itself, which is rougher and means more typing.

It is on unless you turn it off.

The outfit only makes sense if we know the weather where you are. You can give the app your location, or type a city instead — the app works either way and never needs both.

We round your position to two decimal places before it goes anywhere. That is an area of roughly a kilometre across — enough for a forecast, not enough to find a building. The rounding is done on your phone, and our servers reject anything more precise than that, so a precise position never reaches us. We also ask iOS for reduced accuracy, but that is a second layer rather than the guarantee: the rounding is the guarantee.

Who sees the rounded area

Two weather services. Apple's WeatherKit is the one we ask first. If Apple does not answer, the request goes to Open-Meteo, at api.open-meteo.com, instead.

Each of them can be reached two ways, and the difference matters. The overnight outfit is built by our servers, so the weather lookup for it comes from us and the weather service sees our address, not yours. When you tap for a new outfit during the day, your phone asks directly, so the weather service sees your phone's internet address. The request carries no account identifier of any kind — no user id, no key, nothing that says which DRSSD user it is — but an internet address is still an internet address.

Where it is kept

On your phone, the app remembers the last rounded area so a failed location check does not cost you a morning. On our servers, that same rounded area is stored on your overnight schedule — alongside your wake time, your time zone, how many wearable items you have, and whether notifications are on — and it stays there until it is replaced or your account is deleted. We also keep a shared forecast cache keyed by area and date, which has nothing in it that points at a person.

How long your phone keeps the last known area

While you have granted location access, the app only uses an area recorded in the last 24 hours. It checks that age when it next reads the value rather than on a timer, so a value you stopped using can sit in the app's settings until something reads it or your account is deleted.

If you granted access just once and that grant has since lapsed, the rule changes deliberately: the app keeps using the last known area however old it is, because no new reading can arrive and deleting it would cost you every following morning's outfit. While that is happening the app tells you so on screen, every time, in those words.

The stored area is deleted when you pick a city instead, when you refuse location access, when you delete your account, and when a different Apple account signs in on that phone. It is not deleted when an “Allow Once” grant lapses, and it is not deleted when you sign out — signing out clears your credentials, not the app's settings.

If you type a city, the app stores that city's coordinates as the map gave them, and rounds them the same way before sending. A city centre is not where you live, but it is not rounded while it sits on your phone.

Outfits are composed by Claude, an AI model made by Anthropic. Only our servers ever talk to it — your phone never does. Everything sent is text. No photograph is ever sent, and there is no way for one to be: the format the request uses cannot carry a picture.

What it receives, for one outfit:

• A filtered slice of your closet. Anything in the wash or retired is taken out on your phone before anything is sent, and no more than 150 garments go in any case. For each one: an id, its category, its colour, what you named it, its brand if you recorded one, a few words the phone's own classifier used to describe it, how formal it is and the temperatures it suits. Never a picture and never a price, and not the shop link saved with a garment — a link reaches the AI only at the moment you paste one, as described below.
• Today's forecast for the rounded area described above.
• A handful of numbers describing your taste — six figures for the styles you leaned toward in the quiz, and two for how much weather and formality should matter. The quiz swipes themselves are never sent, and are not even saved on your phone.
• Your answer to "How formal is a normal weekday for you?", if you gave one, as a level from one to five. Unlike the numbers above it is not worked out from anything: it is your own answer, just written as a number. It is left out when the outfit is for a Saturday or Sunday.
• Up to seven short codes, one for each of the last seven days' outfits, so the morning outfit does not repeat itself within a week.

Those seven codes are one-way scrambles of each day's garment list. They are enough to answer “is this the same outfit as Tuesday?” and they cannot be turned back into a list of clothes by anything that reads them afterwards. We will not tell you they are unbreakable, because they are not: our server also holds that night's slice of your closet, so a determined process on our own side could work out which combination produced a code. What they genuinely buy is that the thing we store is not a wear diary — nothing downstream can log it, export it or leak a list of your clothes out of it, and the database refuses to hold anything in that column but scrambled text. We chose this over simply sending the list.

The closet slice, the taste numbers, your weekday answer and the seven codes are staged together on one record that expires after 36 hours — never more than 48 — and is then swept away automatically. When you ask for an outfit during the day, your phone sends the slice, the taste numbers and the weekday answer again with that request, and we do not keep them after it. We keep no lasting copy and build no lasting picture of your taste.

Two more things go only when you ask for them. When you tap Shuffle, your phone also sends the ids of up to 15 garments it has already shown you that day, so the next outfit is different — which says what you have just seen and passed over. Our server swaps those ids for references to garments in that request's list, drops any that are not in it, and only then shows them to the AI. When you ask for an outfit for an occasion, the one you picked goes with the request: one of seven fixed choices — date night, formal event, night out, impress, comfort, active or travel — and never anything you type. It says what your day holds. Our server holds both only while the request runs and writes neither down. The occasion you pick also goes into the app's usage events, described in the next section.

The app does not read your calendar today. The design allows for it and reserves room for counts of how many formal and casual things you have on — never titles, locations, attendees or notes, which the format structurally cannot carry. That feature is not built, so nothing calendar-related is collected or sent, and the app does not ask for the permission.

When you add a garment from a shop link

You can add a garment by pasting a link to it in an online shop. Your phone fetches that page and sends it, with the link, to our server, which passes both to the AI so it can read the garment's name, brand, colour and price off the page. If your phone cannot fetch the page, our server fetches it instead. Our server holds the link and the page only while the request runs and writes neither down. The link is then saved on your phone, with the garment, and nowhere else.

We use PostHog to see which parts of the app people use and to catch crashes. Crash reporting is deliberately on — an app that crashes silently never gets fixed.

Events sent from the app are anonymous. The app is configured never to create a person profile, never to record a session replay, and never to tell PostHog who you are. Every value in an event is a count, a yes-or-no, one of a fixed set of words, or the name of an error type — never free text, never anything you typed, never a photograph. A redaction step runs over every value before it leaves, as a backstop against a mistake. One of those fixed words is worth naming: when you ask for an outfit for an occasion, the event records which of the seven you picked, and PostHog keeps it under its own retention like every other event.

Crash reports are the exception, and the sentence above does not cover them. We deliberately turn crash capture on, because the app can fail during a background launch where you would see nothing but a missing outfit. A crash report is assembled and sent by PostHog's own software, so it does not pass through the redaction step, and it carries the failure's type, its message and the list of functions that were running. It is not built from your content, but it is not one of the bounded values described above either.

The app is given a random id by PostHog when it first runs, so that separate events can be recognised as coming from the same phone. It is not connected to your account and it does not follow you to another app. It does stay put when you sign out, and it goes when the app is deleted.

Events recorded by our servers — how many outfits were generated, what they cost us — carry your customer number, the DRS-000000001 sort, so we can tell one account's usage from another's. That number is not your name or your email. Those events are also marked so that no person profile is built from them.

Apple takes the payment and Apple keeps the card details. We never see them. We use RevenueCat to tell us whether a subscription is active, and it receives the internal account id we generated for you — not your name, not your email, not your card. On our side we store what plan you are on, whether it is in trial, and when it ends.

• Your wear log — the day-by-day record of what you actually wore, and any correction you make to it. Not one entry of it has ever been sent anywhere.
• What you paid for a garment.
• Your swipes in the style quiz. They are not saved at all, on the phone or anywhere else — only the handful of numbers worked out from them.
• The closet database itself, which is a file in the app's own storage on your iPhone. We hold no mirror of it.

Be clear about what that does and does not cover. The names, brands, colours and categories of your clothes do go to our servers, in the nightly slice described above and with each outfit you ask for during the day, and for someone who uses the app every day a slice is nearly always there. It expires and is replaced; it is not a copy we keep. The wear log itself never leaves — what leaves is the seven scrambled codes, which are worked out from it rather than taken out of it. A shop link you saved with a garment is stored only on your phone, but it did leave once, with its page, at the moment you pasted it. And your answer about how formal a normal weekday is does leave, with the taste numbers — the answer itself, not something worked out from it.

One caveat we would rather you heard from us. Everything the app stores on your phone — including your photographs — sits in a folder that iCloud Backup includes by default. That is deliberate: your backup is what restores your closet on a new iPhone, and nothing else can. It also means a backup taken before you delete something still contains it. Your iCloud backup is between you and Apple; we cannot read it and we cannot reach into it to delete anything.

Here is every kind of information about your clothes, your taste, your day and where you are that leaves your phone, in one list, with how long each is kept. The sections above explain each one. Your Apple account, your device's notification codes, your subscription and usage events have sections of their own.

• A filtered list of your clothes: for each garment an id, its category, its colour, what you named it, its brand if you recorded one, a few words the phone's own classifier used to describe it, how formal it is and the temperatures it suits. Staged each night with the bundle for your morning outfit, which is deleted after 36 hours and never kept more than 48. Sent again with each outfit you ask for during the day, and not kept after that request.
• When you tap Shuffle, the ids of up to 15 garments the app has already shown you for that day, which say what you have just seen and passed over. Your phone keeps that day's list, and sends it with Shuffle and with nothing else. Our server holds it only while the request runs and writes it nowhere; before the AI sees it, the server swaps the ids for references to garments in that request's list and drops any that are not in it.
• The occasion you pick — one of seven fixed choices: date night, formal event, night out, impress, comfort, active or travel — which says what your day holds. Never anything you type. Our server holds it only while the request runs, and passes it to the AI. The app also sends your choice to PostHog, in an anonymous usage event, where PostHog's own retention applies.
• A shop link you paste to add a garment, and the page it points to. Both go to our server and on to the AI, which reads the garment's details off the page. Our server holds them only while the request runs and writes them nowhere. The link is then saved on your phone, with the garment, and nowhere else.
• The photographs you add, whole — to our server, and on to Google and Cloudflare. We hold each one in memory only while the request runs and write it nowhere; what Google and Cloudflare keep is governed by their own terms.
• A handful of numbers describing your taste, worked out on your phone, and beside them your answer to “How formal is a normal weekday for you?”, if you gave one, as a level from one to five. That answer is not worked out from anything — it is the one you gave — and it is left out when the outfit is for a Saturday or Sunday. Staged each night with the bundle for your morning outfit and deleted with it; sent again with each outfit you ask for during the day.
• Up to seven short one-way codes, one for each of the last seven days' outfits, so the morning outfit does not repeat itself within a week. Staged each night with the bundle for your morning outfit and deleted with it.
• Your position rounded to two decimal places — or, if you typed a city, that city's position rounded the same way — with your time zone, your wake time and how many wearable items you have, kept on your overnight schedule. This one has no expiry: it stays until it is replaced or your account is deleted. The weather services see the same rounded area, as described above.

We sell none of it, and our servers build no lasting profile of your taste or of what you wear.

These are the companies that handle your information on our behalf or receive part of it to do their job. We do not sell your data to anyone, and there is no advertising in the app.

We will also hand over information if the law requires it, and we would tell you unless we were forbidden to.

• Your account details, subscription record and notification codes: as long as your account exists.
• Your overnight schedule, including the rounded area: until it is replaced, or your account is deleted.
• The nightly outfit bundle — closet slice, taste numbers and weekday answer, outfit codes: 36 hours, then swept away automatically.
• The photographs you send us: only for the length of the request. We never write them down.
• What your phone sends with an outfit you ask for during the day — the closet slice, taste numbers and weekday answer, the occasion you pick, the garments Shuffle has already shown you — and a shop link you paste with its page: only for the length of the request. We never write them down.
• How many photos you have sent in the current 30-day photo allowance: until the allowance renews, then cleared automatically. It is also deleted with your account.
• A record of each morning job we ran for you and whether it worked: 30 days.
• Your usage ledger — how many AI requests we ran for you and what they cost us: 90 days.
• Which days we served you an outfit: about a week's worth. We trim the older ones each time we serve you a new outfit, so if you stop using Dressed the last week's worth stays until you delete your account.
• Encrypted backups of our server database: the last 14 nights, each replaced in turn.
• Usage and crash events: kept by PostHog under their own retention.

You delete your account in the app, under Settings. Your closet, your wear history and your photographs are erased from the iPhone immediately and cannot be recovered except from your own backup.

Some things deliberately stay on the phone, and we would rather say so than let you find out. One is a marker naming the last account that signed in on this device. It names no person, it is not sent anywhere, and it exists so that a different Apple account signing in on your phone cannot inherit your closet — which is exactly what happened before it existed. The other is a note that a deletion was requested on this phone. It stops the app re-adopting the data, and it lets the app finish clearing the phone if the deletion was interrupted part-way. Neither is removed by deleting the app: iOS keeps this kind of secure-storage value through an uninstall. They are overwritten when a new account signs in.

The on-device erasure is also best-effort rather than guaranteed. If a single file resists deletion the app marks the store as no longer yours and refuses to read it, rather than pretending the erase finished.

What we hold on our servers is deleted at the same moment, and it cannot be undone. We ask Apple to withdraw the app's Sign in with Apple access (if the app still appears under Sign in with Apple in your iPhone's Settings, you can remove it there), then delete your subscription record, your notification codes, your overnight schedule and the nightly job that runs it, the staged outfit bundle, your usage ledger, the record of which mornings we served you, the record of each morning job we ran and whether it worked, the count of photos you have sent, any free access grant, the Apple token described earlier, and finally your account record and your sign-in record, with your name and the email address we hold. If something on our side fails part-way, we retry every day until the deletion is finished.

One copy lasts a little longer. We keep encrypted backups of our server database from the last 14 nights, in case the database itself is ever lost, so your account stays in those backups until they are replaced, normally within 14 days of your deleting it.

Deleting your account does not cancel your subscription. Apple keeps billing you until you cancel it, so cancel it first: open Settings on your iPhone, tap your name, then Subscriptions.

Two records are deliberately kept afterwards, and neither is named:

• A record that the account existed and was deleted: its customer number, our internal number for the account, and the dates. We keep it so we can answer a regulator or a support question about a deletion we performed.
• A record that your Apple account has already used its free trial, kept so trials cannot be claimed over and over. It holds the identifier Apple gives us, our internal number for the account that used the trial, and the date.

Neither holds your name or your email. We keep them to show that a deletion happened and to stop abuse, which are the interests we are relying on here rather than your consent. If you think that is wrong in your case, write to us and say so. If you sign in again with the same Apple account, you start a new account from scratch.

Wherever you live, you can ask us for all of this. If you are in the EU, the UK or California, you have these rights by law and we do not charge for them or treat you differently for using them.

• Get a copy of what we hold. Both halves are in the app, under Settings, then Privacy, then "Your data". "Export my closet" gives you your whole closet and wear history from your phone. "Download what our server holds" fetches a copy of your account's records from our servers straight to your phone, with nobody in between. You can also ask by email — see "Asking by email" below.
• Correct anything wrong. Most of it you can edit in the app directly.
• Delete your account, which erases your phone's data and our servers' at once.
• Object to what we do with your data, or ask us to restrict it, and withdraw a permission you gave — location, photo processing, notifications — at any time, in iPhone Settings or in the app.
• Complain to your data protection regulator if you think we have got this wrong. In the EU or UK that is the authority where you live.

We do not sell or share personal information in the sense California law uses those words, and we have not in the past twelve months. There is nothing to opt out of.

The legal grounds we rely on, for anyone who needs them: performing the contract, for everything needed to actually give you outfits; your consent, for location, notifications and sending photographs onward, each of which you can withdraw; and our legitimate interest in keeping the service working and free of abuse, for crash reports, usage counts and the two records above.

Asking by email

You can also ask by email, at privacy@getdrssd.app — useful if you no longer have the app. We send the file only to the email address on your account: the one Apple passed to us when you first signed in. If you chose Hide My Email, that is one of Apple's relay addresses, and Apple forwards what we send to your own inbox.

A customer number on its own is never enough. You share it every time you write to support, and it is on your Account screen for anyone who sees your phone. So when a request comes from any address other than the one on the account, we do not answer it with your data: we write to the address on the account instead, and act only on a reply from there. An account deletion asked for by email is checked the same way.

Get DRSSD is not for children under 13, and we do not knowingly collect anything from one. This version of the app has no child profiles and no parent-managed accounts. If you believe a child has given us information, write to us and we will delete the account.

Our servers are run for us by Supabase in the eastern United States (Northern Virginia). The other companies listed above are mostly in the United States too, so using the app means your information is transferred there.

If we change something that matters, we will tell you in the app or by email before it takes effect, and the date at the top of this page always says when it last changed.

Write to privacy@getdrssd.app. The support page covers the practical steps — exporting, cancelling, deleting. If you are in the EU or the UK and are not satisfied with our answer, you can complain to your national data protection authority.