Privacy Policy

This Privacy Policy applies to the DrapeAI mobile application ("Application") provided by Atekian ("Service Provider", "we", "us"), who is the data controller for the personal data described here. This service is provided on an "AS IS" basis. It also covers our website, drapeai.app; see Section 12 for what the website collects.

Effective date: November 6, 2026

1. Information We Collect

We may collect the following categories of data:

• Account data: email address, user ID, and auth/session metadata.
• Age information: a year of birth (not your full date of birth), worked out from the age you give in the app. See Section 8.
• User content: person photos, selfies you use to create an avatar, garment/product photos, photos you add to your wardrobe and their studio images, product/list URLs, generated try-on results, generated avatars and your colour analysis result (colour type).
• Photo quality indicators: when you add a selfie for an avatar, the app checks it on your device (for example, whether exactly one face is visible, and its angle, lighting and sharpness). Only coarse results of this check (such as "one face" or an angle range) are recorded; the photo itself and any face coordinates are not.
• Billing/subscription data: subscription status, purchase/receipt metadata, entitlement and credit state.
• Device and usage data: IP address, device model, OS version, app events, timestamps, diagnostics, and security logs.

The Application does not collect precise GPS location for core functionality.

2. How We Use Information

• To provide virtual try-on, avatar creation, colour analysis, wardrobe studio photos and related AI features.
• To authenticate users and manage accounts.
• To manage subscriptions, purchases, credits, and restore purchases.
• To detect abuse, fraud, and policy violations.
• To apply our age rules and safety checks (see Section 8).
• To maintain, troubleshoot, and improve service quality and security.
• To comply with legal obligations.

3. AI Processing and Your Permission

Before any of your photos are sent for AI processing, the app asks for your explicit permission and names the AI providers involved. If you do not agree, no photos are sent and AI features do not start. You can withdraw this permission at any time in the app's Settings. Withdrawing stops further processing; it does not affect processing that already took place.

• Try-on: your selected person and garment photos are uploaded to our cloud storage (Supabase) and processed by our AI providers, Google Gemini and FAL.ai, to generate the result. For Studio quality (HQ) try-ons, FAL.ai also sends these photos to OpenAI, which processes them as part of FAL.ai's try-on service.
• Avatar: your selfie is sent directly to our backend and to Google Gemini to generate your avatar. It is not saved to our storage. See Section 4 for how facial features are used.
• Colour analysis: only a cropped section of your photo showing your face and hair is sent to our backend and to Google Gemini to find your colour type. It is not saved to our storage. See Section 4.
• Wardrobe photos: when you add a piece to your wardrobe, its photo is sent to our backend and to Google Gemini to recognise the type of item and turn it into a clean studio product photo. Faces in the photo are blurred on your device before it is sent. The photos sent are not stored on our servers; the studio image and your original photo are kept only on your device and are deleted when you delete the piece. You can switch any piece back to its original photo. If you later use a piece in a try-on, its image is handled like any other garment image (see Section 6).

This data is used only to generate the results you request and to keep the service secure and reliable.

4. Face Data

Some features use photos that show your face.

What we do not do. We do not perform facial recognition. We do not identify or verify anyone from their face, and we do not create or keep face templates or other biometric identifiers.

What happens when you create an avatar.

1. On your device: the app checks your selfie for image quality: whether exactly one face is visible, whether it is cut off, its angle, lighting and sharpness. This check runs entirely on your device. The photo is not sent anywhere for it.
2. At our AI provider: Google Gemini produces a short written description of visible facial features (for example face shape and hair colour). It is used only as input to generate your avatar within the same request. We do not store it, and it is not written to our logs.

Wardrobe photos. Faces in photos you add to your wardrobe are blurred on your device before the photo is sent. If the app cannot check a photo for faces, the photo is not sent.

What happens when you run colour analysis. When colour analysis runs (when you start it, or during sign-up when you create your avatar from your own photo), only a cropped section of your photo showing your face and hair is sent to Google Gemini, which determines the colour type that suits you (spring, summer, autumn or winter) along with your undertone, contrast and colour clarity. The cropped photo is not stored. The result is stored in your account, so it is not lost when you change phones. Google Gemini also estimates a coarse skin-tone depth level (light, medium or deep). We do not store it with your result or your account, and it is never shown to you or used for advertising or profiling: each analysis only adds one to an anonymous count (by outcome, season and depth level), which we use to check, in total, that the analysis works equally well across skin tones. The counts do not contain your account ID or the time of the analysis. Your answer to "Did these colours suit you?" is stored with your account, together with the colour type it is about, to measure the accuracy of the analysis. You can delete your colour type at any time from the "My colours" screen in the app; your earlier answers, and the colour type they are about, stay until you delete your account. If you delete your account, your colour type and your answers are deleted from our servers. Our analytics provider also receives your colour type and your answers; they are not deleted automatically with your account, so email us and we will delete them.

Safety check on person photos. When a garment you want to try on may be swimwear, underwear, lingerie or revealing nightwear, Google Gemini estimates from the person photo whether the person could be under 18. This is an automated estimate, not facial recognition or age verification, and it is not stored with your account. See Section 8.

What face data is used for. Only to produce, and to check the safety of, the try-on result, avatar or colour type you asked for, and for the anonymous accuracy check of colour analysis described above. It is never used for advertising, marketing, identity verification, profiling or training AI models.

Who processes it. Google Gemini (AI inference, paid-service terms: not used to train or improve Google's products; may be kept by Google for a limited period solely to detect abuse), FAL.ai (AI inference; the images it generates are deleted from its servers within 7 days, and its request records, which can include the submitted image, are kept for up to 30 days), OpenAI (for Studio quality try-ons, through FAL.ai; under OpenAI's API terms not used to train its models; may be kept for up to 30 days solely to detect abuse, unless the law requires longer) and Supabase (cloud storage). They process it only on our behalf.

How long it is kept. See Section 6.

5. Third-Party Services We Use

We only share data with third-party providers that are necessary to operate the Application and our website. We require service providers to protect data under safeguards that are no less protective than this policy.

• Supabase (authentication, storage, backend infrastructure) - Privacy Policy
• Google Gemini API (AI inference for try-on, avatar, 360° views, colour analysis and wardrobe photos, and for safety checks) - Privacy Policy
• FAL.ai (AI inference; the images it generates are deleted from its servers within 7 days, and its request records, which can include the submitted image, are kept for up to 30 days) - Privacy Policy
• OpenAI (AI inference for Studio quality try-ons, used by FAL.ai; not used to train OpenAI's models; may be kept for up to 30 days to detect abuse) - Privacy commitments
• PostHog, EU cloud (product analytics and crash reports; does not receive your photos) - Privacy Policy
• RevenueCat (subscriptions and entitlement infrastructure) - Privacy Policy
• Apple (App Store/TestFlight platform and iOS billing) - Privacy Policy
• Google Play (Android platform and billing) - Privacy Policy
• Vercel (website hosting and cookieless website analytics) - Privacy Policy
• Google Analytics (website analytics; see Section 12) - Privacy Policy
• Cloudflare Turnstile (spam protection when you submit an idea on our website) - Privacy Policy

We do not sell personal data.

6. Data Retention

We retain data only as long as necessary for the purposes described above, including legal, security, and operational needs.

On our servers:

On your device: your avatar, try-on results, 360° Looks, history and wardrobe photos (originals and studio images) stay on your device until you delete them, clear the app's data or uninstall the app. When a try-on needs your avatar and the server copy has expired, the app uploads it again from your device, and that copy is again deleted within 30 days.

• Account-related data is retained while your account is active and for a limited period afterward as required by law or security obligations.
• Local copies saved on your device (history/gallery) remain until you delete them, clear app data, or uninstall the app.

To request deletion of account-related data, contact us at atekiandev@gmail.com.

7. Legal Disclosures

We may disclose data:

• to comply with law, legal process, or regulatory requests;
• to protect rights, user safety, and platform integrity;
• to prevent fraud, abuse, and security incidents.

8. Children, Teens and Age

• Your age. From version 1.1.3, the app asks how old you are during sign-up, or before your first AI feature if you already have an account (version 1.1.2 asked for your year of birth instead). You choose an age range; if you are 13 to 17, you also choose your exact age. From your answer the app works out an approximate year of birth, and that year (not your full date of birth) is what we keep. We use it to decide whether you can use the Application and which limits and content filters apply to your account. It is stored with your account, together with a record of any changes, so that the same rules apply on all your devices. To correct it, contact us. It is deleted when your account is deleted. Until we know your age, for example while you use an older version of the app, your account is treated as an adult account.
• Under 13. The Application is not for children under 13, and we do not knowingly collect personal data from them. If your answer during sign-up shows that you are under 13, sign-up stops: no account is created, no photos are sent and analytics stop in that installation of the app. The app keeps a note of this answer on the device (it stays after signing out and, on iPhone, after reinstalling the app), and AI features stay off on that device. If your answer shows that an existing account belongs to someone under 13, analytics stop, the user is signed out and the account is scheduled for deletion. Signing in again does not cancel this deletion.
• 13 to 17. Users aged 13 to 17 may use the Application with permission from a parent or guardian. Accounts that may be under 18 have stricter limits: AI requests use stricter content filters, swimwear, underwear, lingerie and revealing nightwear cannot be tried on, and Studio quality (HQ) try-ons are not available. Because we keep a year and not your birthday, someone who has just turned 18 may keep these limits until the end of that calendar year or, in some cases, the end of the next one.
• Age and analytics. We do not send your year of birth to our analytics provider or to our AI providers, and we do not use age information for advertising or marketing. For users aged 18 and over only, the app works out a broad age band from the year (for example 25–34), which we use to choose the examples shown during sign-up and in our product analytics. No age band is sent for users who may be under 18. If a request is refused because of an age rule, our analytics may record that type of refusal, which can show that an account may be under 18.
• Garment and photo safety check. Before a try-on or a 360° Look, Google Gemini checks whether each garment (for a 360° Look, the outfit in the result) is swimwear, underwear, lingerie or revealing nightwear. If it is, the request is refused for accounts that may be under 18; for other accounts, Gemini also estimates from the person photo whether the person could be under 18, and the request can be refused. This check is automated: it can be wrong, it does not identify anyone and it is not age verification. Its result is not stored with your account; the outcome (the garment type, whether the person was estimated to be under 18, and whether the request was allowed) is kept in our server logs with a shortened account ID, normally for up to 30 days, so that we can check that the safety check works. For Studio quality (HQ) try-ons, Google Gemini also checks each result for nudity or sexual content before it is shown; a flagged result is withheld and its looks are returned. No looks are used for a refused request.

If you believe a child under 13 has provided personal data, contact us at atekiandev@gmail.com and we will delete it.

9. Security

We use reasonable technical, organizational, and procedural safeguards to protect data. No method of transmission or storage is 100% secure.

10. International Data Processing

Our service providers may process data in countries other than your own. Where required, we apply appropriate safeguards for cross-border data transfers.

11. Your Choices and Rights

• Withdraw AI consent: Settings → AI consent.
• Delete your colour type: My colours → Delete my colour type.
• Delete your account and data: Settings → Delete account. Your account is deleted after a 14-day grace period, during which you can cancel (except for an account deleted because it belongs to someone under 13; see Section 8). Photos, results (including 360° Looks), avatars, garment images and colour analysis data on our servers are deleted with it.
• Access, correction, deletion or objection: email atekiandev@gmail.com. We respond within 30 days.

12. Our Website (drapeai.app)

This section covers our website only. Browsing it does not create an account and does not connect your visit to your account in the Application.

• Google Analytics. On drapeai.app we use Google Analytics to understand how the website is used: the pages you view, the website or campaign link that brought you here, your approximate location (country or city, derived by Google from your IP address), your device and browser type, and which download or call-to-action buttons you click. Google does not log or store your IP address in Google Analytics. Event-level data is kept for the retention period set in our account (at most 14 months). We do not use this data for advertising: advertising features are always switched off.
• Analytics cookies and your choice. When you first visit, a banner asks whether we may use Google Analytics cookies. Only if you accept does Google Analytics set first-party cookies (_ga and _ga_QQBJ03E98X) that keep a random ID for your browser for up to 2 years, so repeat visits can be counted. Until you accept, or if you decline, no analytics cookies are set and Google Analytics receives only cookieless signals (for example that a page was viewed or a button was clicked, with device and browser type) that are not linked to an ID kept in your browser. We use Google's Consent Mode for this. Your choice is saved in your browser's local storage and is not sent to us. You can change it at any time with "Cookie settings" in the website footer or here; if you decline after accepting, we delete the _ga cookies. You can also delete or block cookies in your browser, or install Google's opt-out add-on.
• Vercel Web Analytics. We also count page views with Vercel Web Analytics (page, referring website, country, device, operating system and browser). It does not use cookies or store an identifier on your device.
• Download links. When you open a DrapeAI download link (drapeai.app/get), we record the click: the source and campaign named in the link, your device type (iPhone, Android or computer) and whether your browser language is Turkish or English. Our server sends this to Google Analytics with a new random ID for each click and without your IP address, browser details or cookies, so a click cannot be linked to you or to your other visits. The same details are written to our hosting logs, which are kept only briefly. You are then sent to the App Store, Google Play or our home page; the link passes on the source and campaign so the store can report which link led to a download.
• Ideas board. When you vote or submit an idea on our ideas page, your browser keeps a random voter ID and the list of ideas you voted for in its local storage. With each vote or idea we store that voter ID and a hashed (one-way encoded) form of your IP address in our cloud database (Supabase) to limit spam and repeated voting. Before you submit an idea, Cloudflare Turnstile checks that you are not a bot, which involves your IP address and browser information. Ideas you submit (title and description) are shown publicly on the board, so do not include personal information in them.
• Account deletion form. If you use the form on our delete-account page, the email address, user ID (optional) and message (optional) you enter are sent to us by email and used only to handle your request.
• Hosting. The website is hosted by Vercel, whose servers process your IP address and browser information to deliver the pages and keep short-lived technical and security logs.

Google Analytics is the only service that sets cookies on our website, and only after you accept them. Our fonts are served from our own domain, not from Google Fonts.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes are effective when posted on this page.

14. Contact Us

If you have privacy-related questions or requests, contact: atekiandev@gmail.com