Privacy Policy

Last updated: August 29, 2026

1. Who We Are

FitFind is operated by NDR Group FZCO. We are the data controller for the personal information described in this policy. You can reach us at fitfind.main@gmail.com.

2. Data We Collect

We collect only what is needed to run the app. The table below matches our Apple App Privacy declarations.

Data type	Purpose	Linked to identity?
Name (display name, username)	App Functionality	Yes
Email Address	App Functionality (account & login)	Yes
Photos or Videos	App Functionality (outfit posts & AI detection)	Yes
Other User Content (captions, tags)	App Functionality	Yes
User ID	App Functionality	Yes
Product Interaction (taps, views)	Analytics	Yes
Precise Location	App Functionality (nearby stores, regional pricing)	No
Crash Data	App Functionality (stability)	No
Performance Data	App Functionality (speed & reliability)	No

No data is used for tracking. We do not use data brokers, serve targeted advertising, or sell personal data.

3. How We Use Your Data

• Account & profile: Your name, email, and user ID let you sign in, maintain a profile, and interact with other users.
• Outfit posts: Photos you upload are displayed to other users and analysed by AI to detect clothing items (see Section 4).
• Product search: Detected item attributes (category, colour, brand) are sent to product-search services to find matching products and nearby stores.
• Push notifications: We send notifications about likes, follows, and comments via the Expo push-notification service.
• Analytics: We record product-interaction events (e.g. which items users tap) to understand how the app is used. These analytics are not used for advertising.
• Crash and performance data: We may collect crash logs and performance metrics to diagnose issues. These are not linked to your identity.

4. AI Processing & Third-Party Processors

When you upload an outfit photo, FitFind sends it to third-party AI services for automated garment detection. Product and store searches are executed through additional services. Below is the complete list of processors that handle personal data or content on our behalf:

• OpenAI — your outfit photos (downscaled) are sent to OpenAI's GPT-4o Vision API for garment detection, categorisation, and attribute extraction. OpenAI's data-usage policies apply; we do not permit use of your photos to train AI models.
• Google Cloud Vision — photos may be sent to Google Cloud Vision as a fallback detection service for object recognition and labelling.
• SerpAPI — item attributes and, optionally, your geographic coordinates are sent to SerpAPI to query Google Shopping, Google Maps, and Google Lens for product matches and nearby retail stores.
• Amazon Associates (Product Advertising API) — product-search queries are sent to Amazon to find matching items. Outbound links carry our Amazon Associates partner tag.
• Awin — outbound links to participating retailers may be wrapped with Awin affiliate parameters.
• Supabase — provides authentication, the PostgreSQL database, and cloud storage for photos and profile data.
• Expo — delivers push notifications to your device using Expo push tokens.
• Railway — hosts our backend infrastructure.

Each processor is bound by its own privacy policy and, where applicable, data-processing agreements.

5. Precise Location

FitFind may request access to your device's precise location. This is used only to show nearby stores that carry items similar to those in an outfit and to display region-appropriate pricing. Location access is optional — you can deny or revoke it at any time in your device settings. Your coordinates are sent to our product-search service (SerpAPI/Google Maps) to return local results but are not stored against your identity in our database.

6. Photo Library Access

FitFind requests photo-library access so you can select outfit photos to post and analyse. Photos are uploaded to our servers and sent to AI processors as described in Section 4. We access only the specific photos you choose — we do not scan or index your photo library.

7. Affiliate Links

FitFind earns commission on purchases made through outbound product links. Outbound URLs may carry affiliate parameters (Amazon Associates tag, Awin publisher ID). No personal data is shared with retailers through these parameters — they identify FitFind as the referral source, not you as an individual.

8. Legal Basis for Processing (GDPR)

• Contract: Processing your account data, posts, and photos is necessary to provide the FitFind service you signed up for.
• Legitimate interest: Analytics and product-interaction data help us improve the app. We balance this against your privacy by not linking crash or performance data to your identity and by never using data for advertising.
• Consent: Location access and push notifications require your explicit permission, which you may withdraw at any time.

9. Data Retention

We retain your account data, posts, and photos for as long as your account is active. When you delete your account (see Section 10), we permanently remove your profile, posts, photos, detected items, and associated data from our database and cloud storage. Cached product-search results expire automatically within 24 hours. We do not retain copies of your data after deletion except where required by law.

10. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data via your profile settings.
• Delete your account and all associated data. You can do this in the app: go to Profile → Edit Profile → Delete Account. This permanently removes your posts, photos, and profile.
• Port your data — request a copy in a machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw consent for location access or notifications at any time via device settings.

To exercise any of these rights, email fitfind.main@gmail.com. We will respond within 30 days.

11. California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information. To exercise your rights, contact us at the email above.

12. Children

FitFind is rated 16+ on the App Store and is not directed at children under 16. We do not knowingly collect personal information from anyone under 13. If we learn that a user is under 13, we will delete their account and data promptly. If you believe a child under 13 has created an account, please contact us.

13. International Transfers

Our users and processors are located in multiple countries. Your data may be processed outside of your country of residence — for example, our database and hosting are provided by Supabase and Railway, and AI processing is performed by OpenAI and Google. Where data is transferred internationally, we rely on processor contractual commitments and, where applicable, Standard Contractual Clauses to safeguard your data.

14. Changes to This Policy

We may update this policy from time to time. We will post the revised policy with a new "Last updated" date. If we make material changes, we will notify you through the app. Continued use of FitFind after changes are posted constitutes acceptance of the updated policy.

15. Contact