← back to Whatsmystyle
public/privacy-policy.html
95 lines
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>WhatsMyStyle — Privacy</title>
<link rel="stylesheet" href="/css/app.css" />
<style>
body { max-width: 720px; margin: 40px auto; padding: 0 24px; font-family: ui-sans-serif, system-ui, -apple-system, sans-serif; color: #1d1d1f; background: #faf7f2; }
h1 { font-size: 36px; font-weight: 600; letter-spacing: -0.02em; margin: 0 0 8px; }
h2 { font-size: 22px; font-weight: 600; margin: 32px 0 8px; }
p, li { font-size: 16px; line-height: 1.6; color: #1d1d1f; }
.muted { color: #707070; }
ul { padding-left: 22px; }
.card { background: #fff; border: 1px solid #e6e1d8; border-radius: 20px; padding: 22px 28px; margin: 14px 0; }
.back { display: inline-block; margin-bottom: 18px; color: #555; text-decoration: none; font-size: 14px; }
.back:hover { color: #1d1d1f; }
code { background: #efe9dd; padding: 2px 6px; border-radius: 6px; font-size: 13px; }
</style>
</head>
<body>
<a class="back" href="/">← back to app</a>
<h1>Privacy</h1>
<p class="muted">Last updated: 2026-05-12 · short version, written in plain English. The legal version lives below it.</p>
<h2>What we collect</h2>
<div class="card">
<ul>
<li><strong>Photos you upload.</strong> Closet pictures, source photos for try-on, old photos for Time-Travel. Stored on our server only.</li>
<li><strong>Style signals.</strong> Every duel A-or-B pick. The 32-axis taste vector is computed from these. We don't sell this vector and we don't ship it to ad networks.</li>
<li><strong>Onboarding answers.</strong> Body shape, budget band, location for "stores near me", optional age/hair/undertone. All stored on us, none required except body shape, budget, and city.</li>
<li><strong>Receipts (opt-in).</strong> If you connect Gmail or Stripe Financial Connections, we parse shipping/order emails to seed your closet. Raw email bodies are never persisted — only brand + title + price.</li>
<li><strong>Try-on renders.</strong> If a render uses a paid AI provider (FASHN, Gemini, OpenAI), the input photo + garment image are sent to that provider per its TOS. Cost is logged in our per-user budget ledger.</li>
</ul>
</div>
<h2>What we don't do</h2>
<div class="card">
<ul>
<li>We don't sell your photos, taste vector, or receipts to anyone.</li>
<li>We don't share data with ad networks or trackers. There are zero ad-network pixels on the app.</li>
<li>We don't train a global ML model on your private photos. The 32-axis projection is deterministic + local-only.</li>
<li>We don't expose which AI provider does the try-on — to you the result is "WhatsMyStyle's proprietary stylist system."</li>
</ul>
</div>
<h2>Three user tiers</h2>
<div class="card">
<ul>
<li><strong>Admin.</strong> Steve and the team. Gated by hostname or <code>?admin=1</code>. Sees the config console and can preview the public / set-decorator views without leaving session.</li>
<li><strong>General user — public.</strong> The retail experience: duel, recs, closet, try-on, time-travel. Default tier on signup.</li>
<li><strong>General user — set decorator.</strong> Film/TV trade tier. Same retail features plus per-production tagging so closet pieces + try-ons can be grouped by show. Productions live only on your account; nothing about your shows is exposed publicly.</li>
</ul>
</div>
<h2>Couples / shared-closets mode</h2>
<div class="card">
<p>The couples pilot is <strong>flag-gated and off by default</strong>. When two users opt in:</p>
<ul>
<li>Each partner controls per-garment privacy: <code>shared</code> (visible to both, eligible for joint outfit picks) or <code>private</code> (your eyes only).</li>
<li>Gift mode requires the receiving partner to approve each render slot before it generates.</li>
<li>Either partner can hit <strong>Exit couple</strong> at any time. Exit marks the couple <code>exited</code>, locks the join, and purges cross-twin training data.</li>
</ul>
</div>
<h2>Retention + deletion</h2>
<div class="card">
<p>Hit <strong>Forget me</strong> (footer of the app, or POST <code>/api/me/forget</code>) and we hard-delete:</p>
<ul>
<li>Your user row, taste vector, taste-history snapshots.</li>
<li>All closet rows + photo files on disk.</li>
<li>Your avatar + every try-on render.</li>
<li>All outfit picks, debate rows, productions, waitlist entries.</li>
<li>Couples links you've created (and any cross-twin training tied to them).</li>
</ul>
<p class="muted">There is no soft-delete. Once you've hit forget-me, your data is gone from disk and from backups within 30 days.</p>
</div>
<h2>Receipt parsing — ephemeral</h2>
<div class="card">
<p>Receipts are processed in-process. We extract <code>brand</code>, <code>title</code>, and <code>price_cents</code>, then drop the email body. We don't persist <code>from</code>/<code>to</code> headers, subject lines, or any other email metadata.</p>
</div>
<h2>Resale guardrails</h2>
<div class="card">
<p>Per the 2026-05-12 design verdict, any "sell this" nudge requires you to have owned the piece ≥ 90 days OR confirmed "I won't wear it again." Even then, repair/recycle options surface first — we don't accelerate fast-fashion churn for affiliate revenue.</p>
</div>
<h2>Contact</h2>
<div class="card">
<p>Privacy questions: <a href="mailto:steve@designerwallcoverings.com">steve@designerwallcoverings.com</a>.</p>
</div>
</body>
</html>