Privacy Policy

We collect only what the Service needs to work:

• Account data: your email address, display name, password hash (or the identifier from a sign-in provider such as Google or GitHub), and email-verification status.
• Uploaded images: the model and garment photos you upload, plus technical metadata we derive from them (dimensions, file hash, and a short text description produced by an AI model to guide generation).
• Generated images and job records: the output images, the settings you chose, timestamps, and the status and error code of each generation.
• Safety review records: moderation decisions for image bytes and submitted text, the policy version, hashes, request/job references, and minimal audit metadata. We do not store rejected image bytes for appeals.
• Credit ledger: every credit grant, charge and refund, with a reference to the purchase or generation that caused it.
• Payment data: Stripe processes your card; we never see or store card numbers. From Stripe we receive and store the checkout session and customer identifiers, the order amount and payment status, and the name and email on the payment; our server logs record webhook event types and ids together with the internal order, checkout-session, customer and account identifiers they concern — never card data.
• Technical data: IP address, browser type and request logs, kept by our hosting provider for security and abuse prevention.

To run the Service (authenticate you, generate and store images, keep your credit balance correct); to check uploaded content and prompts against our safety policy before paid work; to bill you; to prevent fraud and abuse — including the anti-bot check on sign-up and limits on generation volume; and to answer your support requests. We do not sell personal data and we do not use your images to train AI models.

Your images and account data are processed by third-party providers, including:

• Cloudflare (Workers, D1, R2): hosting, database and private image storage.
• kie.ai: the AI gateway that runs both the photo analysis and the generation on Google's models. kie.ai fetches your uploaded images from our storage through short-lived signed links. Any retention of requests or results on kie.ai's side is governed by kie.ai's own privacy policy, not by us.
• OpenAI: our server sends image bytes and submitted text to OpenAI omni-moderation for the safety check. We use the response to allow or reject the request and retain the decision metadata needed for abuse prevention and audit; rejected image bytes are not retained as appeal copies.
• Stripe: payment processing.
• Resend: transactional email (verification, password reset).
• Cloudflare Turnstile: the anti-bot check on sign-up.

These providers are located in, or transfer data to, the United States and other countries. By using the Service you consent to that transfer.

Uploaded and generated images are stored in a private storage bucket under a prefix unique to your account, and are only readable through your signed-in session or a short-lived signed link handed to the generation provider.

Safety review event logs are retained for 30 days, then removed by the scheduled cleanup. Content decisions, hashes and your policy acknowledgement remain associated with your account to enforce content access and are removed when your account is deleted. Rejected image bytes are not kept as appeal material.

Deleting a generation from your history hides it from your account immediately; the underlying files are removed when your account is deleted, or earlier on request to support@tryonswap.com.

Deleting your account (from your dashboard, or by emailing support@tryonswap.com) deletes your account record, sign-in methods, generation history, credit ledger and order records from our database immediately, and removes your stored images from our storage bucket in the same operation; an automated check runs every minute and deletes any stored image whose account no longer exists, so a failed clean-up is completed without anyone having to ask. Stripe keeps its own records of payments under its policy; we do not control those.

With your analytics permission, our own first-party analytics uses a site-specific anonymous cookie to connect page interactions to sign-in, uploads, generations and orders. It does not copy photos, prompts, email or full URLs into event properties. It honors Global Privacy Control and your Analytics preferences. Necessary account, job and payment records remain available for service operation; their completed milestones may be counted separately even without browser tracking. Analytics events, sessions and links are eligible for scheduled deletion after 90 days, in bounded batches; account deletion also removes associated analytics records.

We use a session cookie to keep you signed in and a preference cookie for theme and language. With your permission, Google Analytics measures visits to our public pages. It stays off until you allow analytics, and you can change your choice through Analytics preferences. We do not send your photos, account page URLs or URL query details to Analytics. We do not use advertising cookies. Stripe and Turnstile set their own cookies when their components load, governed by their policies.

Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to or restrict its processing, and to complain to a supervisory authority. Email support@tryonswap.com to exercise these rights; we respond within 30 days.

The Service is not directed to anyone under 18 and we do not knowingly collect data from them. Uploading images of minors is prohibited by our Terms; if you believe such an image has been uploaded, contact support@tryonswap.com and we will remove it.

We may update this policy; the date at the top shows the current version. Material changes will be announced in the product. Questions or requests: support@tryonswap.com.