Privacy Policy

This policy applies to the Put Me In That app for iPhone and iPad, the service that runs it, and this information website.

Madhav Shroff, an individual developer, operates Put Me In That and is responsible for your personal data. In this policy, “we” and “us” mean Madhav Shroff as the operator of Put Me In That. To contact us, email founder@putmeinthat.com or founder@putmeinthat.com.

• Choosing a photo does not upload it.
• The first sharing sheet covers your account and the current disclosure. Allow submits those photos for that try-on; later Generate taps submit the photos then shown.
• The app does not scan your photo library or create face-matching data.
• Apple processes all payments. We never receive your card details.
• Each try-on result is labelled as AI-generated.
• Live uploaded photos expire after 24 hours and results after 30 days. Recovery backups can retain copies longer, as described in section 9.
• You can delete your account in the app.
• We show no ads. We do not sell your data. We do not track you across other apps or websites.
• The app is only for people aged 18 or older. If you are under 18, do not create an account or use the app.

You sign in only in the app. You can use one of these methods:

• A sign-in link or a one-time code that we send to your email address.
• Your Google account.
• Sign in with Apple.

Stytch, our authentication provider, receives your email address and operates your sign-in session. We keep an account identifier so that your credits, try-ons, and purchases stay with your account.

If you use Sign in with Apple, Apple gives us the email address that you choose to share. This can be a private relay address from Apple. We also store an encrypted token from Apple. We use this token only to revoke your Sign in with Apple authorization when you delete your account.

The app keeps your session token in the iOS Keychain on your device. Before you sign in, you confirm that you have read our Terms of Use and that you are 18 or older.

You select an outfit photo and a photo of yourself. Selecting a photo does not upload it. The first time you tap Generate under a sharing disclosure, the app shows a sheet. The sheet names the provider and purpose. It states how long data is kept and links to this policy. You can choose Allow or Not now. Allow submits the photos for that try-on. The app remembers Allow for your account and that disclosure. For each later try-on, Generate submits the two photos then shown. The button shows the credit cost. The sheet appears again if the provider, model, policy, purpose, retention, or privacy link changes.

Before upload, the app re-encodes each photo. This removes the photo’s source metadata, such as location. The photos still show you, so they are personal data.

Our service sends your two approved photos to Google Gemini to create the try-on image. A Google Gemini model also checks your approved photos and the result for safety. The service blocks nudity and images that appear to show minors. Automated safety checks can make mistakes.

Your photos and results are private to your account. The service does not give them public links.

The app uses the system photo picker so you can choose the two photos for a try-on. It does not scan your library or create face-matching data.

Before upload, the app re-encodes each chosen photo and removes source metadata, such as location. The sharing steps are described in section 4.

You buy subscriptions and credit packs through Apple In-App Purchase. Apple processes the payment. We never receive your card number or other payment card details.

Apple sends us signed transaction records, such as the product, the transaction identifier, and the purchase date. We link these records to your account so that we can give you the credits that you bought, and so that one purchase cannot give credits twice. You manage and cancel subscriptions in your Apple Account settings.

• Your credit balance and a record of how you used credits.
• Your approvals for try-ons and the status of each try-on.
• Service diagnostics, such as request status, timings, and error codes. We use them to keep the service reliable. We design these records to leave out your photos, face data, and sign-in tokens.

• Stytch operates sign-in and sessions.
• Google creates try-on images and checks photos and results for safety. If you sign in with Google, Google also authenticates you.
• Apple processes purchases and Sign in with Apple.
• Cloudflare carries network traffic between the app and our servers.
• Vercel hosts this website and processes request data, such as your IP address, to deliver its pages.

We do not sell your personal data. We do not show ads. We do not share your data with data brokers. We do not track you across apps or websites that other companies own.

• Your uploaded photos expire from the live service 24 hours after upload. Background cleanup removes the files.
• Try-on results expire from the live service 30 days after creation. You can delete a result earlier in the app.
• Restricted recovery backups can retain copies after deletion from the live service. Daily maintenance removes backups older than 14 days. Service outages or failed maintenance can delay removal. Separate deletion records prevent a restored backup from making deleted data available again. Maintenance removes those recovery records after at least 14 days, once neither the live service nor an eligible backup needs them.
• Looks that you download stay on your device until you remove them. Copies that you save to Photos stay there until you delete them.
• Google processes prompts, photos, and results to create your try-on. Google does not use them to improve its products. Google logs them for up to 55 days only to detect policy violations and for legal disclosures, and authorized people may review them. See Google’s abuse monitoring policy.
• We keep your account data until you delete your account.
• After you delete your account, we keep a one-way, salted fingerprint of your sign-in identity and email address. We use it only to stop the free welcome credits from being given again. It is not linked to any other data.

In the app, open the Account tab and tap Delete account. Deletion cannot be undone. Deletion does these things:

• It removes your uploaded photos, try-on results, account, credits, and unused approvals from our service.
• It deletes your user record at Stytch.
• If you used Sign in with Apple, it revokes the app’s Sign in with Apple authorization.
• It removes results and photo history from the app on that device, and signs you out.

Deletion does not do these things:

• It does not remove copies that you saved to your Photos library.
• It does not cancel an App Store subscription. Cancel it in your Apple Account settings.
• It does not remove limited purchase and deletion records needed to prevent fraud, duplicate credits, or renewed access to a deleted account. Recovery backups and their deletion records follow the maintenance schedule in section 9.

If you stop using Sign in with Apple for this app in your Apple Account settings, we end those sign-in sessions. That step alone does not delete your account data.

To request deletion without the app, email founder@putmeinthat.com from the email address of your account. We respond within 30 days. For details, read Delete your account.

Put Me In That is only for people aged 18 or older. If you are under 18, do not create an account or use the app. We do not knowingly collect personal data from anyone under 18. If you think a minor has used the service, contact us at founder@putmeinthat.com.

The app connects to our service over encrypted connections. Our service checks that each photo, result, and try-on belongs to the signed-in account before it returns data. We keep provider keys on our servers, not in the app.

Data protection laws, such as the GDPR and the UK GDPR, require a legal basis for each use of personal data. We use these bases:

• Contract. We use your account data, photos, try-on records, credits, and purchase records to give you the Service that you ask for. This includes sign-in, try-ons, purchases, credits, and account deletion.
• Consent. We send your photos to Google Gemini to create the try-on and to check it for safety only after you tap Allow in the sharing sheet. You can withdraw this consent at any time, as section 15 describes.
• Legitimate interests. We keep the Service secure and prevent fraud and abuse. For this, we use safety checks, usage limits, service diagnostics, and the purchase and deletion records that prevent duplicate credits.
• Legal obligation. We keep records when the law requires them, and we respond to valid legal requests.

Our servers are in India. When you use the app, it sends your data to those servers. Our service providers in section 8 process data in the United States and in other countries. These countries can have data protection laws that are different from the laws where you live.

We use providers whose data processing terms commit them to protect personal data. Where a provider includes the European Commission’s standard contractual clauses, or the UK equivalent, in those terms, those clauses apply to the transfer. For more information about transfers, email founder@putmeinthat.com.

• You can choose photos in the system photo picker. The app does not scan your library.
• You can cancel any try-on approval before upload.
• You can delete try-on results and your account in the app.

Depending on where you live, you can have the right to access, correct, delete, or export your personal data, to restrict or object to its processing, and to withdraw your consent. To make a request, email founder@putmeinthat.com. We respond within 30 days.

How to withdraw consent. The app sends your photos to Google only when you tap Generate. To stop sharing, do not tap Generate. You can also delete your results or your account in the app, or email founder@putmeinthat.com to withdraw your consent. When you withdraw consent, we do not send more of your photos to Google. Withdrawal does not make earlier processing unlawful.

If you live in the European Economic Area, the United Kingdom, or Switzerland, you can complain to your local data protection supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO). We ask you to contact us first, so that we can try to fix the problem.

Each try-on result is an image that AI creates. We label it in these ways:

• The app shows an “AI-generated” tag on each result.
• When you save or share a result from the app, the image file contains metadata that marks it as AI-generated. This is the IPTC digital source type “trained algorithmic media”.
• Google adds SynthID, an invisible watermark, to the images that Gemini creates.

Other apps and websites can remove metadata when they edit or upload an image. Do not remove these labels, and do not show a result as a real photo.

To report a result, or an image that shows you or another person without consent, email founder@putmeinthat.com with the subject “Report”. In the app, you can also use Report this result, which opens this email. Tell us what the image shows and why you report it. Do not attach intimate images.

We act on reports of intimate or non-consensual images, impersonation, and images of minors as fast as possible, and within 48 hours at most. We aim to act within 2 hours on reports of intimate or morphed images. We remove the content from our service and, where needed, close the account that created it, as our Terms of Use allow.

This website only gives information about the app. It has no accounts, no sign-in, no photo uploads, and no purchases. It sets no cookies and stores nothing in your browser. It uses no analytics or advertising tools, and it loads no content from other companies.

When we change this policy, we publish the new version on this page and change the date at the top.

For questions about this policy or your personal data, email founder@putmeinthat.com. For help with the app, email founder@putmeinthat.com.

Grievance Officer (under India’s Information Technology Rules): Madhav Shroff, founder@putmeinthat.com. We acknowledge a complaint within 24 hours and resolve it within 15 days.