Privacy Policy

Effective date: October 2, 2026 · Stilai (com.omeryildiz.aitryon)

Stilai ("we", "the app") processes your personal data in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR"). This policy explains what we process, why, on what legal basis, who we share it with, how long we keep it, and your rights.

1. Data Controller

Ömer Yıldız (individual developer) — Contact: support@aitryonapp.com

2. Data We Process

Data	Purpose	Legal basis
Account: the user ID, email address and name provided by Google or Apple at sign-in; for Google, a profile photo link	Sign-in, linking your credit balance to your account	Performance of contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b)
Photos: the photo of a person and the clothing image you upload	Generating the virtual try-on image with AI	Explicit consent — collected in an in-app consent screen before your first try-on (KVKK Art. 5/1, 9; GDPR Art. 6/1-a)
Try-on result: the generated image and the job's technical record (job ID, status, model used)	Delivering the result; delivering it later if the connection drops; refunding credits for failed try-ons	Performance of contract
Outfit advice: the categories of the items in your wardrobe (no images are sent)	AI outfit suggestions	Performance of contract
Purchases: store transaction/purchase ID, order ID, product, date, refund status	Verifying credit packs, preventing duplicate use and abuse after refunds	Performance of contract; legal obligation
Device and security: a random device ID generated by the app, IP address, and on Android the Google Play Integrity result	Request integrity, rate limiting, preventing fake accounts and free-credit abuse	Legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f)
Usage events: in-app events (e.g. "try-on started", "credit screen viewed"), platform, app version — linked to your account when signed in	Measuring and improving the service	Legitimate interest
Crash reports (Sentry): stack trace, device model, OS version, account ID (no email or name)	Finding and fixing bugs	Legitimate interest
Consent record: the date and version of your AI data processing consent	Proof of consent	Legal obligation
Deleted-account marker: a one-way hash of your account ID	Preventing the welcome credit from being granted twice to the same account	Legitimate interest

Your body measurements (height, weight, etc.) are used only on your device to calculate a size recommendation; they are never sent to our servers.

3. How Your Photos Are Processed

Your photos are sent to AI providers only after your explicit consent and only for the virtual try-on. You can withdraw consent at any time in Settings → AI Data Consent.

Providers: Google — Gemini API (generates the image); fal.ai — FASHN model (backup if Google does not respond). Images are transmitted over an encrypted (HTTPS) connection via our own server (Cloudflare Workers).
On our servers: uploaded photos are not stored. The generated result is kept for at most 72 hours so it can be delivered if your connection drops, and is deleted immediately when you delete your account.
At the providers: under the paid Gemini API, Google may retain submitted content for a limited period solely to detect abuse, according to its terms, and does not use it to train its models. fal.ai may temporarily host the generated image in its storage. See the providers' policies in Section 5.
On your device: your gallery and wardrobe are stored only on your device, separated per account. They are hidden when you sign out, are not visible to anyone else who signs in on the same device, and are deleted from the device when you delete your account.
Images are never used for marketing or any other purpose, and are never shared or sold.

You may only upload your own photo or a photo of an adult who has given you explicit permission. Uploading photos of anyone under 18 is prohibited.

4. Device Permissions

Camera: used only when you take a photo. Photos taken are not added to your photo library automatically.
Photo selection: only the images you select are read; your library is not scanned. (On Android 12 and below, the system requires a storage read permission.)
Saving to your library: only when you tap "Save" or turn on "Auto Save".
Internet, vibration: for server communication and touch feedback (no personal data).

5. Recipients

Recipient	Data	Policy
Google (Sign in with Google, Gemini API, Google Play Billing, Play Integrity)	Sign-in data, photos (try-on), category data for outfit advice, purchase records, device verification	Link · Gemini API terms
Apple (Sign in with Apple, App Store)	Sign-in data, purchase records	Link
fal.ai	Photos (backup try-on engine)	Link
Cloudflare (servers, database, storage)	Account, credit, purchase and usage records; try-on results (72 hours)	Link
Sentry (crash reporting)	Crash reports	Link

Data may also be disclosed to competent authorities where required by law.

6. International Transfers

The servers of the providers above are located outside Türkiye (mainly in the USA and the EU). The transfer of your photos is based on the explicit consent you give in the in-app consent screen. Other transfers are necessary to provide the service and rely on the safeguards set out in KVKK Art. 9 and the providers' standard contractual commitments.

7. Retention

Account data: until you delete your account. In-app deletion takes effect immediately.
Try-on results (server): at most 72 hours. Technical job records (no images): 30 days.
Usage records and events: at most 2 years; deleted immediately when you delete your account.
Purchase records: 10 years as required by financial regulations. After account deletion they are kept de-linked from you (anonymous).
Deleted-account marker: indefinitely; as a one-way hash it cannot be traced back to you.
Crash reports: at most 90 days at Sentry.
Sessions: expire after 60 days of inactivity.

8. Age Requirement

The app is intended for users aged 18 and over. If we learn that we are processing data of someone under 18, we will delete the account and its data.

9. Security

All network traffic is encrypted with TLS; requests are signed and time-stamped against replay.
Session and identity data on the device are kept in encrypted storage (EncryptedStorage).
AI provider keys are never on the device; all calls go through our server.
Session tokens are stored on the server only as hashes.

10. Your Rights (KVKK Art. 11 · GDPR Art. 15-22)

Learn whether your data is processed and request information or a copy
Rectification and erasure — delete your account instantly via Settings → Delete Account
Restriction, objection and data portability
Withdraw consent — Settings → AI Data Consent
Lodge a complaint with the Turkish Personal Data Protection Authority (kvkk.gov.tr) or your local supervisory authority

For other requests, email support@aitryonapp.com; we respond within 30 days.

11. Cookies

The mobile app does not use cookies.

12. Changes

We will notify you in the app of material changes; if photo processing terms change, your consent will be requested again. The effective date on this page always reflects the latest version.

13. Contact

support@aitryonapp.com