Privacy Policy

FitPick is operated by Nicholas Reyburn, an individual based in Cape Town, South Africa. Nicholas Reyburn is the responsible party (data controller) for personal information processed to operate the app. This notice explains our approach under South Africa's Protection of Personal Information Act (POPIA) and, where applicable, the GDPR. For privacy questions or requests, contact us via FitPick's contact page.

• Email, name and secure account credentials: to create your account, authenticate you and provide support.
• Closet and selfie photos, item details and AI prompts/results: to identify clothing and provide the styling features you request.
• Outfit history, preferences and usage data: to personalise suggestions, show your history and awards, enforce allowances, diagnose errors and prevent abuse.
• Approximate location or chosen city: for weather-based styling only. With your permission, browser location is used to identify your city; the app stores weather coordinates and sends coordinates to Open-Meteo for forecasts. It does not need continuous location tracking. You can enter a city instead.
• Contact-form name, email and message: to answer support, refund and privacy requests.
• Device/browser details, IP address and essential service logs: to deliver the service, maintain security and diagnose errors.
• Subscription identifiers, billing interval, status and renewal dates: to grant and manage paid access.

Legal bases, where required, include performing our contract with you, legitimate interests in security and service maintenance, compliance with legal duties and your consent for optional location access. You may withdraw optional consent without affecting earlier lawful processing.

When you request a scan or Fit Check, your photo and relevant styling information are sent through our AI service to our AI provider, Google Gemini, to understand clothing and generate suggestions. Do not upload intimate images or other people's photos without consent. We use the results to provide your requested styling features, not for facial recognition or identity verification. Provider processing is subject to its applicable data-handling terms; we do not claim that every provider has identical retention practices.

Closet and selfie photos are stored privately with access controls. We never sell your photos or personal information. If you choose to publish an Outfit Battle, its flattened outfit snapshot and battle details are available to anyone with its public link; private closet storage paths are not published. Exported story cards are shared only when you choose to download or share them.

We share only information needed with service providers, including Lovable Cloud for hosting, account services and private storage, our AI provider for styling, and Open-Meteo for weather. Paddle receives information needed for product sales, subscriptions, payment, tax compliance and invoicing. We may share information with professional legal/accounting advisers or authorities when legally required.

Paddle.com is our Merchant of Record and handles payment details. We never see or store your full card number or security code. Paddle processes billing, tax, invoices, subscription changes and refunds under its own Privacy Notice.

FitPick uses essential cookies and browser storage for sign-in, security and checkout choices. Paddle may use essential checkout cookies. Invite codes and campaign labels (utm_source, utm_campaign and utm_content) are temporarily kept in session storage and attached to your account at signup to attribute referrals and campaigns. Referral records store the referring account, qualifying closet setup, rewards and share actions; these are not confirmed message deliveries.

FitPick uses the hosting platform's built-in analytics to measure page visits and actions such as signup, scans, exports, paywalls and checkout starts. We do not install an advertising analytics SDK or send photos, names, email addresses or invite codes in custom analytics properties. Hosting analytics may process pseudonymous visit identifiers and device or request information under the platform's settings; we do not claim that all hosting analytics uses no cookies. Analytics observes platform consent and privacy controls where available. You can block or clear browser storage, although sign-in and checkout may stop working. Contact us to exercise your privacy rights.

We keep account data, photos and styling history while your account is active so the service works. Support requests are kept while needed to resolve the request and any related legal obligations; unnecessary information is deleted or anonymised. Security logs and backups may remain for the hosting provider's limited operational retention period and are not used to restore a deleted account for ordinary use.

Delete my account in Profile permanently removes your account, FitPick data and stored photos. Cancel renewing Pro subscriptions via Manage subscription first. Paddle may retain transaction records for tax, legal and fraud-prevention purposes under its own obligations. You can also request deletion through the contact page. We may retain information only where law requires it.

Subject to applicable law, you can request access, correction, deletion, restriction or objection to processing, and a portable copy of your information. You can withdraw consent where processing relies on it. We may verify your identity before fulfilling a request. For GDPR requests, we aim to respond within one month and will explain any lawful extension. POPIA requests are handled within applicable legal timeframes.

To exercise your rights, contact us via FitPick's contact page. You can complain to South Africa's Information Regulator at inforegulator.org.za, or your local supervisory authority where GDPR applies.

We use appropriate technical and organisational safeguards, including encryption in transit, private photo storage and account-scoped access controls. No online system is completely secure. Providers may process information outside South Africa, the UK or the EEA. Where required, international transfers rely on lawful safeguards such as adequate protection, contractual protections, standard contractual clauses or adequacy decisions, as applicable to the provider and transfer.

FitPick is for people aged 16 and older and is not intended for children under 16. Minors must have any parent or guardian permission required by local law. If you believe an under-16 child provided information, contact us via FitPick's contact page so we can investigate and remove it. We will update this notice when practices change and communicate material changes in the app.