Legal

Privacy Policy

Last updated · AI Clothes Changer: Dressy for iOS

1. Who we are

Dressy is an iPhone app by Melih Arık, based in Türkiye ("we", "us"). This policy explains what the app does with your photos and other data. Contact: apps@meliharik.dev.

2. Short version

  • To create a try-on, Dressy uploads the photo of you and the photo of the garment to Replicate, a third-party AI hosting service, and receives the result image back.
  • The same uploaded photos, and the finished result, are also checked by moderation models that run on Replicate. An image that fails the check, or cannot be checked, is not used.
  • Your try-on history (your photo, the garment photo, the result and your description) is stored on your device only. We do not keep a copy on a server of ours.
  • The app deletes the files it uploaded to Replicate when each try-on finishes or fails.
  • We do not sell your data, there are no ads in the app, and your photos are not used to train a model of ours.

3. What stays on your device

Dressy keeps your wardrobe on your phone. For each try-on it saves the photo of you, the garment photo, the result image and the text description you typed in the app's documents folder, together with your Favorites list and a few settings such as your language. This is not backed up or synced by us.

Face detection happens on your device. When you pick a photo of yourself, the app uses an on-device face detector (Google ML Kit) only to check that exactly one face is visible. This check does not send the photo anywhere.

The height, gender and body-type questions in the first-run flow are used inside the app and are not sent to our servers or to any third party by the app's code.

4. Photos sent to Replicate for the try-on

When you tap Generate, Dressy resizes both images (the longest side is at most 1536 pixels, and each file is compressed to about 1 MB), then sends them to Replicate (replicate.com) through its Files API over HTTPS. Replicate runs the virtual try-on model and returns a result image, which the app downloads and saves on your device.

What is sent to Replicate for each try-on: the photo of you (which shows your face and body), the garment photo, and the text description of the garment that you typed. The app also sends the Replicate access token it uses to make these requests. No name, email address or account details are included in these requests.

When the try-on finishes, fails or is stopped by a moderation check, the app asks Replicate to delete the two uploaded files. This is a best-effort request; if your connection drops at that moment the deletion request may not arrive. Replicate also expires uploaded files on its own schedule (the app's code assumes 24 hours). How Replicate logs, stores or uses data it receives is governed by Replicate's own terms and privacy policy, which we do not control.

5. Content moderation

Dressy is meant for everyday clothing and refuses photos that show nudity, underwear, swimwear, sheer or revealing clothing, sexualized content, or people who appear to be under 18. To enforce this, each try-on is checked three times: the photo of you, the garment photo and the generated result.

Each check uses two models that run on Replicate: a Google Gemini vision model (Replicate hosts it, so the image is processed through Replicate and Google's model) and the open model falcons-ai/nsfw_image_detection. The images are the same Replicate-hosted copies described above, and the text instructions sent with them are the app's fixed moderation instructions, not your personal data. Both models must approve an image.

The checks fail closed. If a model cannot be reached or does not give a clear answer, the image is treated as not allowed and you are asked to try again. No person reviews your photos as part of moderation.

6. Firebase (Google)

The app uses Firebase services provided by Google:

  • Authentication: the app signs you in anonymously. This creates a random Firebase user ID. There is no sign-up and no email address or password.
  • Cloud Firestore: when you first open the app we create a record that contains your Firebase user ID, your device's vendor identifier (the identifierForVendor that iOS gives to all apps from the same developer on your device), your device model and iOS version, whether you have a Pro subscription, the plan name, and creation and update times. The record is updated when your subscription status changes. Photos are not stored in Firestore.
  • Firebase Analytics: the app logs screen views, paywall views, purchases (plan identifier, price and currency), and events for generating, saving and sharing a try-on. A generation event records whether it succeeded and, when it failed, a short error message. Firebase Analytics also collects standard device and app data such as an app instance ID, device model, OS version, language and approximate location derived from IP address.
  • Remote Config: the app downloads settings from Firebase when it starts, including the access token it uses for Replicate and a few feature flags. This request carries standard technical data such as your IP address.

7. Subscriptions and RevenueCat

Purchases are handled by Apple. We use RevenueCat (revenuecat.com) to check your subscription status and unlock Pro. RevenueCat receives your device's vendor identifier (used as your RevenueCat user ID), your purchase receipt and subscription information, and standard technical data. We never see your payment card or Apple Account details.

8. Push notifications (OneSignal)

The app uses OneSignal (onesignal.com) to send notifications. If you allow notifications, OneSignal receives your push token. The app also gives OneSignal your device's vendor identifier as a user ID and your app language, and OneSignal collects standard device data such as device model, OS version and country. You can turn notifications off at any time in iOS Settings.

9. Other network requests

  • More apps list: the Settings screen shows other apps by the same developer. The app downloads this list from a small Google Cloud endpoint that we run. The request carries only your IP address and standard technical data.
  • Country lookup: when a Remote Config flag is switched on, the first-run flow asks ipwho.is for the country that matches your IP address, to adjust what is shown in the onboarding. That request sends your IP address to ipwho.is. We can switch this flag on or off without an app update.
  • Result download: the finished image is downloaded from Replicate's delivery servers.

10. Reporting a result

Each result screen has a report button. If you tap it, the app writes a report record in Firestore containing the outfit's ID, your device's vendor identifier, a timestamp and the stored references of the two input images. In the current version those references are paths to files on your phone, so the report does not upload the photos themselves. We use reports to review problems with the app and to decide whether moderation needs changes.

11. What we do not do

  • We do not sell or rent personal data.
  • The app shows no advertising and contains no advertising SDK.
  • The app does not ask for App Tracking Transparency permission.
  • We do not use your photos to train or improve any model of our own, and we do not publish or share them.
  • We do not read your photo library. Dressy only receives the photos you choose, or that you take with the camera inside the app, and it saves a result to your Photos only when you tap Save.

12. Camera and photo permissions

Dressy asks for camera access to take a photo of yourself or a garment, and for photo library access to choose one or to save a result. You can change these at any time in iOS Settings.

13. How long data is kept, and how to delete it

  • On your device: long-press an outfit in Wardrobe and choose Delete to remove it and its stored images. Removing the app removes everything the app stored locally.
  • On Replicate: uploaded files are deleted by the app when each try-on ends, as described above, and otherwise expire on Replicate's schedule.
  • In our Firebase project: the Firestore user record and any report record, and Firebase Analytics data, are kept until you ask us to delete them. Email apps@meliharik.dev from any address, include the in-app Settings version line if you can, and we will delete the records we can link to your device. The app does not yet have a one-tap delete-my-data button.
  • RevenueCat, OneSignal and Apple keep their own records under their own policies. Purchase records are also kept as the law requires.

14. Children

Dressy is not for people under 18, and the app refuses photos that appear to show a minor. Do not upload photos of children. If you believe a child's photo has been sent to us, email apps@meliharik.dev.

15. Photos of other people

Only upload photos of yourself or of people who have agreed to it. You are responsible for having that permission. See the Terms of Use.

16. Security and where data goes

The app talks to Replicate, Firebase, RevenueCat, OneSignal and our own endpoint over HTTPS. Those providers run servers in several countries, including the United States, so your data may be processed outside Türkiye and outside your country. No method of storage or transmission is completely secure.

17. Your rights

Depending on where you live (for example under the GDPR in the EU and UK, or the KVKK in Türkiye) you may have the right to access, correct or delete your data, to object to processing, and to complain to your data protection authority. Email apps@meliharik.dev and we will reply within a reasonable time.

18. Changes to this policy

If we change what the app collects or who receives it, we will update this page and its date before or when the update reaches the App Store.

19. Contact

Melih Arık, Türkiye. Email: apps@meliharik.dev.