Privacy policy

Privacy Policy — Vèra (iOS & Android app)

Last updated: 6 November 2026

This is the privacy policy for the Vèra mobile app on the App Store and Google Play. It replaces, for the app, the founding-tester pilot policy at privacy.html, which continues to cover only the Vèra web pilot and its tester application form. If you used the web pilot, that policy still applies to that experience.

Questions about your data: Show email.

1. Who we are

Vèra is a personal wardrobe and styling app: you build a digital closet, get a style read, plan outfits, and — if you choose — preview clothes on a photo of yourself. Vèra is operated by Cannappy, the controller of the data described here.

You can use the app without an account, and without giving us your name, email address, or phone number. Signing in with Facebook is optional, and if you choose it, it shares the profile fields described in §7 — that is the only way we would hold your name or email. On first launch the app generates a private device code and stores it in your device's secure storage (the iOS Keychain / Android encrypted storage). That code is what the app trades with our server for a session, and it is the identifier your closet and usage are stored under. It stays on your device, and unless you sign in with Facebook we have nothing to link it to.

2. What stays on your device and is never sent to us

• Photos of your clothes, as you took them. When you add a piece, the photo is processed on your device, including background removal (the cut-out). The original photo stays on your device — with one exception you choose: if your phone cannot cut a piece out (some phones cannot), the app asks whether it may send that piece's full photo instead (see §3). Clothing photos are never sent to analytics.
• Your full-body photo, by default. A photo of yourself that you set for try-on stays on your device unless and until you start a try-on and agree to the on-screen consent (see §4). It is never sent to analytics.
• Anything you type into the donation drop-off finder beyond what is needed for that one lookup (see §5), and your diary notes, a borrower's name for a lent item, and the reminder time you pick — these stay on your device and are never sent to us.

3. What the app stores on our server, and why

Your closet needs to survive reinstalling the app or moving to a new device, so the following is stored on our infrastructure (Cloudflare) under your device code:

We also store each piece's cut-out — the garment with its background removed on your device:

• When you add a piece, its cut-out is uploaded so Vèra can understand the garment (an image embedding, which ranks your pieces for suggestions).
• When you use the layered preview or a try-on, the cut-out is sent through our server to our image provider, Runware, which draws the piece once on a plain mannequin (the preview then reuses that drawing), or on a photo of you for a try-on (§4).
• If your phone could not cut the piece out, the full photo is uploaded in its place for the same purposes — only if you said yes when the app asked, and you can turn this off at any time in Profile ("Send full photos when needed"). With it off, those photos stay on your device and such pieces are drawn flat in the preview and can't be tried on.

Cut-outs and photos are stored under your device code. When you delete a piece in the app, its cut-out or photo, and anything drawn from it, is deleted from our storage as soon as the deletion reaches our server (the next time your phone is online). To erase everything at once, use Profile, Delete account and data in the app: it deletes your whole account from our server (closet, cut-outs and photos, looks, plans, quiz answers, credits, your stored avatar and anything made from it) and clears this phone's copy (§11).

Creators interest list

If you fill in the form under Profile > Creators, we store what you enter on our server: the platform you post on and your handle there, your follower count, any other accounts and links you add, your note, your contact email, and the time you confirmed you are 18 or older. We use it only to decide whether to open a creator program and to contact you about it. It is never sent to our analytics. It is deleted when we delete your data at your request (§11), and you can ask us to delete it on its own at any time.

4. Try-on and scenes (only when you ask, and only with consent)

Vèra can preview an outfit on a photo of you ("try it on") and then restage that result in a shareable setting (a "scene"). These are the only features that send a photo of you off your device, and they run only after you agree on a one-time consent screen where you choose how your photo is handled.

• The try-on preview. When you start a try-on, a copy of your full-body photo and the cut-outs of the pieces you picked are sent — through our server (Cloudflare) — to our try-on provider, Runware (with fal as a fallback), to generate the image. There are two ways your photo is handled, and you choose:
• One-time: the copy is uploaded only for that one try-on and deleted from our storage the moment the try-on finishes, whether it succeeded or failed. A copy that was uploaded but never used is deleted within 30 minutes.
• Stored avatar (optional, one per account): you can instead keep the photo on our server as your reusable try-on avatar, so future try-ons show your own body and previous results can be reused without a fresh render. If you choose this, the photo is kept until you replace or remove it in the app; replacing or removing it deletes the previous photo.
• Layers on your avatar (founding members only). If you are a founding member and keep a stored avatar, you can ask the app to prepare your closet on it. Our server then sends your avatar photo and two plain garment images (a fitted tee and trousers) to Runware to make a neutral base: an AI-generated full-body image of you wearing those plain basics. Your avatar photo is sent again each time you ask for a new neutral base (at most three times a day). After that, each piece you choose is rendered alone onto that neutral base — which means the neutral base, an image of you, is sent to Runware with that piece's cut-out for every piece (at most 80 a day) — and our server keeps the part of the image that changed as that piece's layer. For trousers, shorts and skirts, any bare skin the piece shows (legs, ankles) is kept as a separate skin layer, so shoes can be drawn over it. The app stacks these layers to show any outfit on you without a new render. We keep the neutral base and the layers because they're what makes those previews possible, and they're used for nothing else: never analytics, advertising or training. They are deleted when you replace or remove your stored avatar, when you ask for a new neutral base (the old one and its layers go), when a piece is deleted (its layers go), when your founding membership ends, or when we delete your data at your request (§11).
• Scenes. After a try-on, you can restage that result in a setting (for example a red carpet or a magazine cover). Our server sends the try-on result — which already shows you — and the setting you picked to our image provider (Runware). Nothing new is uploaded from your device. The finished scene is held on our storage only until your app downloads it, and in any case no longer than one hour, then deleted. After that it exists only on your device.

Your photos are used only to create these images. They are never sent to analytics, never used for advertising, and never used to train models. If you decline the consent, nothing is uploaded and the preview stays on your device.

Try-on and scenes may cost in-app credits (see §8).

5. Weather and the donation drop-off finder

• Weather-aware suggestions use either the climate you chose in the style quiz (for example "warm" or "cold"), or — only if you choose "Use my location" and allow it — today's forecast where you are. In that case the app reads your device's approximate location (never precise GPS) and sends it to Vèra's server, which rounds it to about 11 km and asks Open-Meteo, a public weather service, for that day's forecast. Your location is not stored by Vèra or kept on your device, is never sent to analytics, and only the forecast comes back. You can decline the prompt and pick a climate instead, or turn location off for Vèra in your phone's settings at any time.
• The donation drop-off finder helps you find nearby places to donate clothes. The finder does not read your device's location. Instead you type a town or city, and that text is sent to OpenStreetMap's public services — Photon (to turn the place name into a point) and Overpass (to find drop-off spots nearby). What you type is used only for that lookup, is stored nowhere, and is never sent to Vèra. Opening directions to a spot hands the destination to your device's maps app.

6. Analytics (PostHog)

We use PostHog (hosted in the United States, us.i.posthog.com) to understand how the app is used and improve it. Analytics is configured conservatively:

• Autocapture is off and session recording/replay is off. We do not record your screen and do not capture raw taps or on-screen text. We send only a specific, named list of events.
• What those events contain: which screens and features you reach; your quiz answers as short labels (for example an aesthetic name or a count of occasions); counts and numbers (items added, your style score, timing); your device and OS type; app-generated identifiers (your device code, item and look identifiers); and an approximate location that PostHog derives from your IP address. The location the app reads for the forecast (§5) is never sent to analytics.
• No photos, ever. No clothing photo, full-body photo, try-on result, or scene image is ever sent to analytics — this boundary is built into the app.
• Diagnostics. If the app hits an error, we send a truncated error message and whether it was fatal, so we can measure and fix crashes. We do not send stack traces from the app's analytics path, images, or your personal content.
• Feedback. If you choose to send feedback from the star button, analytics records only that you did, which kind of note it was (bug, idea, praise, other) and your star rating if you gave one. The text you write is never sent to analytics; see section 9 for where it goes.
• Your device code is the identifier events are grouped under. Unless you sign in with Facebook, we hold no name or email, so this stays pseudonymous to us.

We do not use analytics for advertising, and our analytics does not track you across other apps or websites. Meta's install measurement is separate from analytics and is the one place the app tracks, and on iOS only if you allow it (§7).

7. Facebook: install measurement and optional sign-in

• Install and event measurement (Meta SDK). The app includes Meta's SDK so we can tell whether an install came from a Facebook or Instagram ad, and measure that ad. This is separate from our analytics (§6): Meta gets none of our analytics events, and PostHog plays no part in it. Meta receives that the app was installed and opened, basic device and app information, and your device's advertising identifier. This is the only tracking in the app (in Apple's sense: app data linked with another company's data to measure advertising). On iOS it happens only if you allow tracking when the app asks: if you decline, the advertising identifier is not read, and Meta receives the install and open without it. We do not send your closet, your photos, or anything you type to Meta. Meta handles what it receives under its own privacy policy.
• Continue with Facebook (optional). You can choose to sign in with Facebook. If you do, Meta shares with us the public profile fields you approve (your name and, if you allow it, your email address). We use them only to recognise you on a new device and to answer your requests. We do not post to Facebook or read your friends. You can remove Vèra at any time in Facebook under Settings, Apps and Websites; then ask us to delete what we hold (see the data deletion page).

8. Purchases

Vèra's try-on and scene features use in-app credits. Some try-on capacity is free (a small daily allowance); additional capacity may be offered as an in-app purchase.

When in-app purchases are enabled, they are handled by the App Store or Google Play, and validated for us by RevenueCat. In that case we (via RevenueCat) receive your purchase and entitlement status tied to your device code, and a store receipt to confirm the purchase — never your card number or full payment details, which are handled entirely by Apple or Google. We do not use purchase data for advertising.

9. Who we share data with

We share data only with the service providers that make the app work, each acting on our behalf:

• Cloudflare — hosts the app's backend, stores your closet record, your pieces' cut-outs (and a piece's full photo only if you allowed it, §3) and the images described in §4, and transiently holds a try-on photo or a scene image for as long as §3–§4 describe.
• Runware (with fal as fallback) — our image providers. They receive a piece's cut-out to draw it for the layered preview (§3); a copy of your full-body photo and garment cut-outs only when you run a try-on you consented to; for founding members with a stored avatar, the avatar photo and neutral base as §4 describes; and a try-on result plus a setting only when you ask for a scene.
• PostHog — our analytics processor (§6).
• Our feedback service (feedback.cannappy.org, on Cloudflare) — only what you type into the star button's feedback form, the kind of note, your star rating, the email you choose to leave, a screenshot of the screen you were on unless you untick it on the form, and your app version and device type. We read it to fix bugs and decide what to build, and use the email only to tell you when something you asked for ships.
• Meta — install measurement, and sign-in if you choose Facebook (§7).
• OpenStreetMap (Photon and Overpass) — only the town you type into the donation finder, and only when you use it (§5). No identifier is attached.
• RevenueCat and Apple / Google — only if you make an in-app purchase (§8).

We do not sell your data and we do not share it with data brokers. Apart from Meta's install measurement (§7) — on iOS only if you allow tracking — we do not use it for cross-app advertising or tracking.

10. How long we keep it

• Closet record and cut-outs: kept until you delete them — a piece and its cut-out when you delete that piece in the app, everything at once when you use Delete account and data in the app, or within 30 days when we act on a deletion request you email us (§11). A deleted piece's remaining details are cleared from our database within 30 days.
• One-time try-on photo: deleted when that try-on finishes (success or failure); if uploaded but never used, within 30 minutes.
• Stored avatar: kept until you replace or remove it in the app, or delete your account.
• Neutral base, layers and skin layers (founding members only): AI-generated images of you made from your stored avatar (see §4). Kept while you keep that avatar and your founding membership; deleted when you replace or remove the avatar, request a new neutral base, delete the piece a layer belongs to, lose founding membership, delete your account, or when we act on your deletion request (§11).
• Scene image: deleted as soon as your app downloads it, and within one hour regardless.
• Analytics: retained up to 12 months, then deleted or anonymised.
• Purchase/entitlement records (when purchases are enabled): kept as long as needed to provide and support your purchases and to meet legal and accounting obligations.

11. Your choices and rights

• You can use the app without ever running a try-on; decline the try-on consent and no photo leaves your device.
• You can remove a stored avatar at any time in the app.
• You can delete any piece in the app at any time, which deletes its cut-out or photo from our storage.
• You can delete your account yourself at any time: Profile, Delete account and data in the app. It erases your account and everything stored under it on our server, and clears this phone's copy. It cannot be undone. It does not remove analytics events already collected (§6): those are grouped under your device code, not your account, and are deleted or anonymised on the schedule in §10. To have them deleted sooner, email us before you delete your account, because the device code we find them by is retired with it.
• You can ask us to see, correct, or delete your data by emailing Show email; the steps are on the data deletion page, https://vera.cannappy.org/data-deletion.
• If you are in the EU or UK, you have rights under the GDPR / UK GDPR, including access, correction, deletion and portability.
• If you are a California resident, you have rights under California privacy law to know what is collected about you and to request its deletion. We do not sell or "share" your personal information as those terms are defined there.

12. Children

Vèra is not directed to, and is not intended for, anyone under 18. We do not knowingly collect data from anyone under 18. If you believe a child has used the app, contact Show email and we will delete the data.

13. Changes to this policy

If what we collect or how we use it changes, we will update this page and the date at the top.

Vèra · Cannappy