Privacy Policy

Effective Date: 2026-07-10 · Last Updated: 2026-07-10

This Privacy Policy explains how Cloura Team ("we", "our", "us", or "Cloura") collects, uses, discloses, and safeguards your information when you use the Cloura mobile application (the "Service"). By using the Service, you agree to this Privacy Policy and our Terms of Service.

1. Information We Collect

We collect information you provide directly and information generated through your use of the Service:

• Account Information: Email address, display name, and authentication credentials. If signing in with Apple or Google, your name and email are received as authorized.
• Clothing Photos: Photos uploaded for your digital wardrobe, stored in encrypted cloud storage. They are never shared with other users without explicit action. EXIF GPS coordinates are stripped on upload.
• Style & Profile Data: Display name, gender (optional), style preferences, and body measurements (optional) for personalized outfit recommendations.
• AI Chat Data: Messages sent to the AI stylist and its responses, stored to maintain conversation history and context.
• Wardrobe Data: Clothing item details, including AI-inferred attributes (category, color, style tags) and user-added notes.
• Subscription Data: Subscription tier, purchase and renewal dates, trial status, and transaction verification data from Apple's App Store or Google Play via RevenueCat. Payment card details are not received or stored by Cloura.
• Device Information: Device type, OS version, app version, language/region settings, and push notification token (if enabled).
• Log & Diagnostic Information: IP address (for coarse country-level identification and fraud prevention), crash logs, and performance metrics.

What we do NOT collect:

• Precise GPS location.
• Contacts, SMS, call logs, microphone, or background camera access.
• Persistent hardware identifiers (IMEI, MAC, IDFA, Android Advertising ID).
• Email content or email-inbox integration.

2. How We Use Your Information

We use your information exclusively to provide, secure, and improve the Service:

• Register and authenticate your account.
• Identify and classify clothing items you upload.
• Generate personalized outfit recommendations.
• Power the AI stylist chat with context.
• Maintain your conversation and outfit history.
• Process and verify subscription purchases.
• Send service-related notifications and optional daily styling reminders (if opted in).
• Detect and prevent fraud, abuse, and security incidents.
• Diagnose crashes and improve reliability.

We do NOT:

• Sell, rent, or trade your personal information to any third party.
• Use your photos or chat content to train any general-purpose foundation model.
• Use your data for cross-context behavioral advertising.
• Share your wardrobe content with other users without your explicit action.

3. AI-Generated Content Disclosure

The Service uses third-party AI models for core features:

• Clothing Image Recognition: Uploaded images are sent to Google Gemini to identify category, color, and style. Images are not retained by the provider after the request and are not used to train its foundation models.
• AI Stylist Chat: Chat messages and relevant wardrobe context are sent to Google Gemini (Gemini 2.5 Flash) for recommendations. The same retention and no-training conditions apply.
• AI output is informational only, not professional advice, and may be inaccurate. Users are responsible for decisions based on it.

4. Data Sharing & Third-Party Service Providers

We do not sell, rent, or trade your personal information. Data is shared only with the following service providers, bound by data-processing agreements:

• Railway (hosting + database): App hosting, database, file storage (All user data).
• Cloudflare (R2 storage + CDN): Image storage and delivery (Clothing photos).
• Google Gemini: Image recognition & outfit generation (Clothing photos, chat messages, wardrobe context).
• RevenueCat: Subscription lifecycle management (Anonymous user ID, subscription events, device model).
• Apple Inc.: Sign in with Apple, App Store purchases (Apple ID token, transaction events).
• Google LLC: Sign in with Google, Play Billing (Google account basic profile, transaction events).
• Apple Push / Firebase Cloud Messaging: Push notification delivery (Push token, notification payload).

Personal information may also be disclosed with user consent, when required by valid legal process, or in a business reorganization.

5. Data Retention & Deletion

• Account profile (email, display name): While active; 30 days after deletion, then erased.
• Wardrobe photos and items: While active or until deleted; 30 days from active storage, 60 days from backups.
• AI chat history: Until deleted, or up to 12 months.
• Subscription and transaction records: 5 years (for tax/accounting/consumer-protection law).
• Login and security logs: 180 days (up to 2 years for incident investigations).
• Email verification codes: 10 minutes, invalidated after use.

Account deletion:

• Accounts can be deleted from Settings → Account → Delete Account or by emailing cloura.support@gmail.com.
• Deletion removes profile, wardrobe, photos, AI chat history, and preferences from active storage immediately; backups are purged within 30 days.
• Some records may be retained where required by law.

6. Your Rights & Choices

You can exercise the following via in-app controls or by contacting cloura.support@gmail.com:

• Access: View data held and request an exportable copy (JSON).
• Correction: Update inaccurate data via in-app Settings.
• Deletion: Delete individual items, chat history, or your entire account.
• Withdraw consent: Revoke consent for marketing or optional features.
• Notifications: Manage push notifications via device's OS settings.

California (CCPA / CPRA): California residents have the right to know, delete, and correct personal information, and to non-discrimination. We do not sell or share personal information for cross-context behavioral advertising. To exercise these rights, email cloura.support@gmail.com with the subject "CCPA Request"; responses within 45 days.

Mainland China (PIPL): Residents have the right to be informed, to decide, to restrict or refuse processing, to portability, and to deletion of personal information.

7. Data Security

• Encryption in transit: TLS 1.2+ for all network traffic.
• Encryption at rest for stored data; credentials hashed.
• Access controls: least-privilege, audit logging.
• Rate limiting on public API endpoints.
• Token-based authentication: short-lived access tokens, rotating refresh tokens.

No online service is 100% secure. Users should protect accounts with strong, unique passwords and device-level biometric/passcode protection.

8. Children's Privacy

The Service is not intended for children under 13 (or under 16 in jurisdictions with a higher digital-consent age). We do not knowingly collect personal information from children below the applicable age. If a child has provided personal information, contact cloura.support@gmail.com for prompt deletion.

9. Cookies & Similar Technologies

The Cloura mobile app is a native application and does not use web cookies. It uses local device storage (e.g., SharedPreferences, NSUserDefaults) to save login tokens, consent versions, and preferences, and JWT session tokens for authentication. Uninstalling the app or clearing its data removes this local data.

10. Changes to This Policy

This Privacy Policy may be updated. The "Last Updated" date reflects the latest revision. Material changes will be communicated through in-app notice, push notification, or email in advance, and renewed consent will be requested where required by law. Continued use after the effective date constitutes acceptance.

11. Contact Us

• Operator: Cloura Team (individual developer)
• Governing law: laws of the People's Republic of China (mainland)
• Email: cloura.support@gmail.com
• In-app: Settings → Help & Feedback

We aim to respond to all privacy inquiries within 30 days.