TR ▸

Privacy Policy

Effective: May 22, 2026 · AI Try On (com.omeryildiz.aitryon)

AI Try On ("we", "our app") respects your privacy. This policy explains what data we collect, why we collect it, how we protect it, and your rights under the EU GDPR, UK GDPR, CCPA (California), and the Turkish KVKK.

1. Data Controller

Controller: Ömer Yıldız (individual developer) — Contact: support@aitryonapp.com

2. Data We Collect and Purposes

Category	Data	Purpose	Legal basis
Account (Google Sign-In)	Google account ID (sub), email, name, profile photo URL	Authentication, linking credit balance to your account, preventing multi-account abuse	Consent · Contractual necessity (GDPR Art. 6(1)(b))
Image data	Your uploaded personal photo + clothing image	Generating the virtual try-on result via AI	Explicit consent (per upload)
Device identifier	App-generated UUID (device_token)	Request integrity (HMAC), rate limiting, abuse detection	Legitimate interest (GDPR Art. 6(1)(f))
Usage metrics	Which screen opened, crash logs, app version, OS version — anonymized	Debugging and performance	Legitimate interest
Purchase data	Google Play purchase token, product ID, validation timestamp	Credit pack validation, duplicate-purchase protection	Contractual necessity

3. How Images Are Processed

During virtual try-on, your photo and clothing image are sent over HTTPS through our Cloudflare Workers proxy to the AI provider:

• Provider: fal.ai (Leffa model) — virtual try-on generation
• Processing time: Only during result generation (~15-30s)
• Storage: Your images are not persistently stored on our servers. Only the generated result is stored locally on your device.
• Third-party sharing: Images are processed solely for AI generation; not sold or shared for marketing.

4. Device Permissions

• Camera: Active only when you choose to take a photo.
• Photo library (READ_MEDIA_IMAGES): Only selected images are read; gallery is not scanned.
• Storage (legacy Android ≤ 12): Writing result to "AI Try On" album.
• Vibration: Haptic feedback (no personal data).
• Internet: For AI server communication.

5. Third-Party Service Providers

Provider	Data processed	Policy
Google (Sign-In, Play Billing, Play Integrity)	Account ID, email, purchase token	Link
Cloudflare (Workers + D1)	Request metadata, credit balance keyed on user ID	Link
fal.ai	Uploaded image (no persistent storage)	Link
Google Gemini (outfit suggestions — optional)	Text prompt	Link
Sentry (crash reporting)	Anonymous crash stack trace, device model/OS version	Link

6. International Transfers

Cloudflare and fal.ai servers are located outside the EU/UK/Turkey. Transfers are made under standard contractual clauses (SCCs) over encrypted channels.

7. Retention

• Account data: Until account deletion (anonymized within 30 days of deletion request).
• Credit/purchase records: For the statutory period (10 years — Turkish Commercial Code).
• Images: Not retained on any server.
• Usage logs (Sentry): 90 days.

8. Children's Privacy

The app is not designed for users under 13. We do not knowingly collect data from children under 13. If we discover such an account, we delete it immediately.

9. Data Security

• All network traffic encrypted with TLS 1.2+.
• Sensitive on-device data (Google ID token, device token) encrypted with AES-256 (EncryptedStorage).
• Requests signed with HMAC-SHA256 (replay protection).
• API keys never stored on device; all AI calls go through server-side proxy.

10. Your Rights

You have the right to:

• Access your data (request a copy)
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a data protection authority (EU: your local DPA; Turkey: kvkk.gov.tr; California: CCPA)

Requests: support@aitryonapp.com · Answered within 30 days.

11. Cookies

The mobile app does not use cookies.

12. Changes

Material changes will be notified in-app. The effective date above always reflects the current version.

13. Contact

Questions: support@aitryonapp.com