Astra Style — Privacy Policy

Last updated: 31 July 2026

Flagged for counsel: biometric privacy. This app collects face images (reference selfies for Style Studio) and body measurements, and the Style Studio pipeline derives a face and body identity representation from a photograph. These may fall within biometric-privacy statutes — notably the Illinois Biometric Information Privacy Act (BIPA), which requires written notice and consent before collection, a published retention and destruction schedule, and which carries a private right of action with statutory damages. Texas, Washington and several state privacy laws impose related duties; the GDPR treats biometric data processed for unique identification as special category data. This draft does not attempt to resolve any of that. [[NEEDS INPUT: specific biometric-privacy legal review — BIPA applicability, pre-collection written consent flow, published biometric retention/destruction schedule, whether Style Studio should be geofenced pending review]]

1. Who we are

Astra Style is a personal styling application for iPhone. This policy explains what personal data the app and its backend collect, why, who processes it, how long it is kept, and how it can be deleted.

Controller / operator: [[NEEDS INPUT: full legal entity name]]
Registered address: [[NEEDS INPUT: registered entity address]]
Privacy contact: [[NEEDS INPUT: privacy contact email address]]
Data protection officer or EU/UK representative, if one is appointed: [[NEEDS INPUT: DPO / Article 27 representative details, or a positive statement that none is required]]

This policy describes our practices. It does not make a claim about compliance with any particular statute; which laws apply, and what they require of us, is a question for our legal advisers.

2. What this policy covers

The Astra Style iOS app, and the backend services it talks to: our database, file storage and server functions (hosted with Supabase), and the third-party model providers listed in section 8. It does not cover retailer websites you open from the app, which have their own policies.

3. Guest mode collects nothing on our servers

You can use Astra Style without creating an account. Guest mode is designed to be entirely local to your device:

No account is created, and no server-side identity of any kind exists for a guest — not even an anonymous one.
Guest data (up to 10 closet items, their photographs, and one Style Studio sample) is stored only in the app's on-device storage. It is not uploaded to our database or our file storage.
There is no cloud sync and no shopping history in guest mode.
Because nothing is on our servers, guest data is not recoverable by us. If you delete the app or lose the device, that data is gone.
If you later create an account, the app asks you to migrate your guest data. Migration is an explicit, user-initiated upload — it does not happen silently — and everything uploaded is written under your new account's identity.
To delete guest data, delete the app from your device.

[[NEEDS INPUT: confirm with engineering whether the single Style Studio sample offered in guest mode transmits a reference image to our server functions and to OpenAI. Generation cannot happen on-device, so it almost certainly does. If so, that is a transfer of a face image by a user who has no account, and this section and section 8 must say so plainly — and the biometric-consent question above arises before any account exists]]

4. What personal data we hold

The tables below are taken from the database schema, so they list what the system is built to store rather than a generic summary. Fields are optional unless stated; the app is designed so that measurement and appearance questions can be skipped, and skipping them leaves the field empty rather than guessed.

4.1 Account and identity

Data	Notes
Authentication identifier and email address	Held by our authentication service when you sign in with Apple or with an email link/one-time code. If you use Sign in with Apple and choose to hide your email, we receive Apple's private relay address rather than your own.
Display name, avatar image URL	Optional profile fields.
Approximate location name, time zone	A place name you enter or grant for weather context, plus your time zone. We do not store precise coordinates in the profile record.
Units, theme, onboarding completion time, subscription tier	App preferences and state.

4.2 Style profile

Data	Notes
Style goals, primary and secondary style identities	From onboarding.
Preferred and avoided colours, preferred fit, formality preference, logo tolerance, trend tolerance, accessory preference	From onboarding and from the style summary the app generates.
Style summary text	A written description of your style, generated from your answers.
Style preference vector	The result of the paired-image preference quiz: for each of eight dimensions (colour tolerance, formality, silhouette, texture, logo tolerance, trend tolerance, accessory preference, contrast preference) a score, a confidence band, how many comparisons stand behind it, and how consistent those comparisons were.
Numerical embedding of your style profile	A vector derived from the above, used to find items and outfits similar to your taste. It is derived from your personal data and is treated as personal data.

4.3 Body measurements and appearance — sensitive

These are the most sensitive fields in the app and we are not going to bury them in a list.

Data	Notes
Height, weight, chest, waist, inseam and neck measurements	Stored in centimetres and kilograms. Every one is optional.
Shoe, shirt and trouser sizes	Optional.
Fit notes	Short descriptions of fit problems you tell us about, e.g. broad chest, short torso.
Derived frame characteristics	From your measurements the database derives, and stores, a taper classification, a torso/leg proportion classification, an overall scale classification, a muscularity hint, and a confidence figure for each. These are computed on our servers, are never shown to you as labels, and exist only to shape fit advice.
Appearance details	Optional: skin undertone, hair colour, eye colour, facial hair, whether you wear glasses, whether tattoos are visible.
Reference selfie and body images	Photographs of your face and body that you upload for Style Studio. The images are held in private file storage; the database stores only their paths.

Body measurements and face images are handled as sensitive personal data. See the flagged biometric note at the top of this policy.

4.4 Lifestyle profile

Data	Notes
Occupation category, dress code, typical week, common occasions	From onboarding.
Climate preferences, laundry cadence, travel frequency	From onboarding.
Clothing budget and currency, preferred and avoided brands, sustainability preference	From onboarding.
Religious or service attire needs	Free text, optional. If you complete this field, it may reveal your religion, which is a sensitive category of data in many jurisdictions. It exists so that outfit suggestions are usable rather than tone-deaf, and it can be left empty. [[NEEDS INPUT: whether this field needs its own explicit consent treatment, or should be restructured to avoid capturing religion at all]]

4.5 Closet

Data	Notes
Garment records	Name, brand, category, colours, pattern, material composition, size, fit, condition, seasonality, and computed formality/warmth/water-resistance scores.
Purchase information	Purchase date, price paid, currency, retailer, product link.
Use information	Wear count, last worn date, laundry state, availability, and whether you have archived the item.
Garment photographs	The photos you take or import, and their background-removed versions, in private file storage. The database stores paths, plus per-image analysis metadata such as confidence scores and blur/lighting flags.
Numerical embeddings of items	Used for similarity and duplicate detection.

4.6 Outfits and wear history

Data	Notes
Outfits	Name, description, occasion tags, weather range, formality and compatibility scores, how the outfit was created, preview images, favourite flag, and an embedding.
Outfit contents	Which of your items, or which shortlisted products, fill each slot.
Wear events	Each time you mark an outfit worn: the date and time, the occasion, a 1–5 rating, any written feedback, and a snapshot of the weather at the time.

4.7 Planning

Data	Notes
Occasions	Title, start and end times, location, dress code. If you enable calendar access, we store the identifier of the calendar event so a re-sync updates rather than duplicates the entry. Calendar access is requested only when you turn this feature on.
Daily briefs	One record per day: the outfit suggested, alternatives, a weather snapshot, a snapshot of your schedule for that day, and the accompanying message.

4.8 Kyra conversations, feedback and style memories

Data	Notes
Conversation threads and messages	What you write to Kyra and what Kyra replies, including any structured content in a reply.
Model metadata on each message	Provider and model identifier, token counts, latency and confidence. By design this field holds metadata only — not raw prompts and not provider request or response bodies.
Style feedback	Your likes, dislikes and reasons about items, outfits and products, including any free text you write.
Style memories	Durable preferences inferred from your conversations, each with a confidence value, a link to the message it came from, and an embedding. These are stored so they can be genuinely deleted rather than hidden — the schema has no soft-delete for them.

4.9 Shopping

Data	Notes
Product evaluations	For each product you ask about: a compatibility score, a redundancy score, how many new outfits it would unlock, an expected cost per wear, a verdict, and the written reasoning. Evaluations are kept as a history rather than overwritten, so the same product can have several evaluations over time.
Product catalogue	The catalogue of products itself is shared across all users and holds no personal data — retailer, brand, name, price, links. It is not tied to you and is not deleted when you delete your account, because it is not yours.

4.10 Style Studio

Data	Notes
Generation records	The path of the reference image used, the outfit it was based on, the prompt payload sent to the provider, job status, the path of the resulting image, which provider produced it, and any error message.
Reference and generated images	Held in private file storage. Generated images are labelled in the app as generated, and are a styling estimate rather than a photograph of you in those clothes.

4.11 Subscription

Data	Notes
Subscription state	Apple's original transaction identifier, the product identifier, status, expiry date and whether the transaction is a production or sandbox one. This record is written by our server functions from what Apple tells us.

Payments are taken by Apple. We never see or hold your card details, billing address or payment credentials.

4.12 Deletion records

When you ask us to delete your account we create a record of the request: its status, when it was requested, when it completed, and any failure reason. Once the deletion completes, your user identifier is removed from that record and replaced with a one-way SHA-256 hash of it, so that we can confirm a deletion happened without keeping the identifier itself.

5. What we do with it

Build your style profile and generate outfit suggestions, daily briefs and packing lists.
Recognise garments from the photographs you take, and fill in their attributes for you to correct.
Answer your questions in the Kyra conversation, and remember preferences you express.
Evaluate products you are considering, against the wardrobe you already own.
Generate Style Studio visualisations from a reference image you provide.
Operate subscriptions and enforce free-tier limits.
Keep the service secure, diagnose faults, and prevent abuse.

We do not sell personal data. We do not share it with advertisers, and the app contains no advertising SDK and no cross-app or cross-site tracking. Apple's App Tracking Transparency prompt is not shown because no such tracking is implemented; if that ever changes, the prompt will be added and this policy updated first.

[[NEEDS INPUT: the legal bases for each purpose (e.g. contract, consent, legitimate interests) if a GDPR-style basis table is required, and the corresponding disclosures for US state privacy laws — deliberately not drafted here]]

6. Analytics

The app defines a fixed set of product analytics events: onboarding started and completed, closet item added, scan corrected, outfit generated, outfit marked worn, outfit rejected, Kyra prompt sent, product evaluated, affiliate link opened, Style Studio generation started and completed, paywall viewed, and subscription started, renewed and cancelled.

These events are constructed so that they cannot carry personal content: their properties are limited to fixed category values, counts, booleans, and record identifiers. Image data, image paths, your messages to Kyra, your written feedback and pasted product URLs are excluded by the way the event type is defined, not by a filter that could be forgotten. The analytics identity is the opaque user identifier only — never your name, email or images — and it is cleared when you sign out.

Being precise about the current state: no analytics provider is connected, there is no analytics table in the database, and the production analytics client does nothing but print in debug builds. Nothing is transmitted to any analytics service today. [[NEEDS INPUT: which analytics provider, if any, will be used at launch; this section must be rewritten to name it and describe its own data handling before that happens]]

7. Permissions we ask for

Camera — only when you scan a garment.
Photos — only when you import an image.
Location — only if you enable weather-aware suggestions.
Calendar — only if you enable occasion-aware suggestions.
Notifications — only after you have seen what they are for.
Microphone — only if you use voice input.

Each is requested in context, at the moment the feature needs it, and each can be refused or withdrawn in iOS Settings without losing the rest of the app.

8. Who processes your data for us

8.1 OpenAI — model provider

OpenAI is our only model provider. Requests are made from our server functions using our own API key; the app never talks to OpenAI directly. Depending on the feature, OpenAI receives:

Style Studio: your reference image — a photograph of your face and body — and the structured prompt describing the garments, using the gpt-image-1.5 model.
Quiz and reference imagery: prompts for the paired-image style quiz and other generated illustrative imagery, using the gpt-image-2 model. No photograph of you is involved in this.
Garment analysis: garment photographs, for classification of subtype, material, pattern and condition.
Kyra and styling reasoning: your messages and the profile, closet and outfit context needed to answer them.
Embeddings: text derived from your profile, items and outfits.
Product extraction: the content of product pages you ask us to evaluate.

Initial photo processing — blur and exposure checks, garment region detection, background removal, care-label text recognition, colour extraction, resizing and metadata stripping — happens on your iPhone using Apple's on-device frameworks, before anything is uploaded. Metadata such as location tags is stripped from garment photographs on the device.

8.2 Supabase — hosting

Supabase hosts our database, our file storage and our server functions, and provides authentication. Everything described in section 4 is stored there. Access is restricted per user at the database level, storage buckets are private, and files are served only through short-lived signed links.

8.3 Apple

Apple provides Sign in with Apple and takes all payments through the App Store. Apple receives what it needs for those functions and handles it under its own policies; we receive from Apple an account identifier, an email address or private relay address, and subscription transaction records.

8.4 Other

[[NEEDS INPUT: weather provider — none is selected in the codebase yet; if one is added, name it and say what is sent (a place name or coordinates)]]

[[NEEDS INPUT: affiliate networks or retailer feed providers, once commerce goes live — see the Affiliate Disclosure]]

[[NEEDS INPUT: crash and error reporting service, if one is added]]

9. Model training

Our intent, and our engineering default, is that your data is not used to train anybody's models: provider calls are to be made with the strictest available no-retention and no-training setting, and we would require explicit consent before any of your images were used for model improvement.

Two honest qualifications:

OpenAI states that data submitted through its API is not used to train its models by default. We have not verified the configuration of the specific account this app uses. [[NEEDS INPUT: confirm the OpenAI organisation's data-controls settings and retention window, and whether a zero-data-retention arrangement and a data processing agreement are in place — then state the verified position here rather than the intended one]]
The in-app training opt-out control described in our internal design is not built yet. There is no toggle in the app today. We describe the default we operate under; we do not claim to offer you a control that does not exist.

10. How long we keep things

The retention rules the product is designed around:

Garment photographs are kept for as long as you keep the item, since they are the item's record.
Reference selfies and body images are kept for as long as you keep them saved as a reference. An upload that is never used to complete a generation is treated as abandoned and deleted automatically after a short window — 24 hours by default.
Generated Style Studio images expire after a set window — 30 days by default — unless you explicitly save one, which makes it permanent until you delete it.
Everything else is kept while your account exists, and is removed when the account is deleted (section 11).

Stated plainly, because it matters: the scheduled job that enforces these expiry windows is not built yet. The windows above are the designed policy; until the automated sweep is implemented and monitored, abandoned reference images and expired generations will not delete themselves. This must be built, or this section must be rewritten, before publication. [[NEEDS INPUT: confirm final retention windows, and confirm the retention sweep is live before publishing this section as written]]

11. Deleting your data

What deletion is built to do, and what happens today, are not the same thing, and the difference is set out fully in the companion document Astra Style — Deleting your account and your data. In summary:

Deleting your account removes your authentication identity, which cascades through the database and removes your profile, style profile, body profile, lifestyle profile, closet items and their images records, outfits, outfit contents and wear history, style feedback, style memories and their embeddings, conversations and messages, occasions, daily briefs, Style Studio generation records, subscription records and product evaluations.
The files themselves — your photographs and generated images — are deleted from storage by a separate step, because removing the database record and removing the stored file are two different operations.
The shared product catalogue is not deleted, because it is not your data.
A deletion record survives, holding a one-way hash of your identifier rather than the identifier itself.

The gap, stated rather than hidden: the database side of deletion — the request function, the cascade, the audit record, the finalisation function — is implemented. The server function that would orchestrate the whole sequence, including the deletion of the stored image files and of the authentication identity, does not exist yet, and there is no in-app delete-my-account screen. Until both are built, deletion must be requested by email and carried out manually. Do not publish a claim that deletion is available in the app until it is.

12. Your choices and requests

Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, to receive a copy of it, and to complain to a supervisory authority. To make any request, contact us at [[NEEDS INPUT: privacy contact email address]].

What exists in the app today, honestly stated:

You can edit and correct your profile, measurement, appearance and lifestyle answers.
You can archive and edit closet items and outfits.
An in-app account deletion screen is not yet available — requests go by email.
Data export is not yet available — requests go by email and are fulfilled manually.
Per-image deletion of individual reference and generated images is not yet available in the app.
An in-app control to inspect and delete individual style memories is not yet available.

These controls are designed and specified, and this policy will be updated as each ships. We would rather list them as missing than promise a button that is not there. [[NEEDS INPUT: response time commitment for access, export and deletion requests — e.g. 30 days — and whether identity verification is required before we act on one]]

13. Security

Every user-owned table enforces per-user access at the database level, so one account cannot read another's rows.
File storage is private. No image is served from a public URL; access is through short-lived signed links, granted only for files under your own account's path.
Privileged service credentials exist only in server functions and are never shipped in the app.
Transport is encrypted.

No system is perfectly secure, and we do not claim otherwise. [[NEEDS INPUT: breach notification commitment and process]]

14. Where your data is processed

Our hosting and our model provider operate infrastructure in more than one country, so your data may be processed outside the country where you live. [[NEEDS INPUT: the Supabase project region, OpenAI's processing regions, and the transfer mechanism relied on for any international transfer — e.g. standard contractual clauses]]

15. Children

Astra Style is for adults. It is not directed at children, and you must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we will delete it. Given that the app handles face images and body measurements, an age below this is not something we are willing to design for. [[NEEDS INPUT: confirm 18 is the intended minimum, that it matches the App Store age rating, and that it satisfies the age-of-consent rules in every market where the app will be listed]]

16. Changes to this policy

If we change this policy we will update the date at the top and, for material changes, tell you in the app before the change takes effect.

17. Contact

Privacy questions and requests: [[NEEDS INPUT: privacy contact email address]]
Postal address: [[NEEDS INPUT: registered entity address]]
If you are in the UK, EU or another jurisdiction with a supervisory authority, you may also complain to it: [[NEEDS INPUT: lead supervisory authority, or a statement of which authority applies]]