Privacy Policy

Last updated: 2 September 2026

Kolav is a smart wardrobe app. To work, it has to see your clothes, and for some features your face. This page explains in plain language what is collected, who it is sent to, how long it is kept and how to delete it.

Who is responsible

The controller of your data is the operator of the Kolav app ("we"). For any privacy matter, write to support@kolav.app.

What we collect

1. Account and sign-in

You sign in with Apple, with Google, or with a one-time code sent to your phone. The sign-in service (Google's Firebase Authentication) holds a user identifier and the email address or phone number you signed in with. We store that identifier, and the email address if one was provided.

2. Profile and preferences you give us

• First name, display name and username.
• Gender, age band, and date of birth if you chose to give one.
• App language and your device timezone.
• Height, weight in kilograms (optional), body type and skin tone.
• Clothing sizes (top, bottom, shoes).
• Preferred style, favourite colours and preferred brands.
• Dress and modesty preferences: sleeve length, neckline, skirt length, head covering and layering.
• Goals, how you found us, and your answers to the getting-dressed questions during onboarding.

3. Photos

• Photos of clothing items you add, plus thumbnails and background-removed versions generated from them.
• A selfie you upload to build an avatar, and the avatar generated from it.
• A face photo you upload for Try On Yourself.
• Try-on images generated by combining your items with an avatar or with your face.
• Photos you take for a marketplace listing.

4. Marketplace (only if you use it)

City, phone number in international format, and the listings you publish (photo, size, condition, price and note). Also reports you file and users you block. Your phone number is never returned on any marketplace screen. It leaves the server only when a buyer taps to contact you on a listing, and only to open a WhatsApp conversation with you.

5. Subscription and payment

Plan type, status and renewal date. The purchase itself happens against your App Store account and is managed for us by RevenueCat. We never see or store card details.

6. Device and app

An Expo push notification token, whether notifications are on, your daily look time, the app language, and the timezone sent with each request so dates display correctly.

7. Crash reports and product analytics

• Crash reports go to Sentry. Before they are sent, on the device, auth tokens, cookies and the bodies of requests that carry images are stripped from the report.
• Product analytics go to Mixpanel and are tied to a random identifier created at install, not to your name or account. Name, first name, full name, email address and phone number are blocked in code and are never sent to analytics.
• On iOS you are shown Apple's tracking prompt. If you decline, the advertising identifier is not used.

Why we use it

• To recognise the items you photograph and tag them by category, colour, season and style.
• To build outfits that fit your sizes, preferences and the weather.
• To generate try-on images on an avatar or on your face.
• To run the marketplace, including handling reports and preventing abuse.
• To manage your subscription and the free plan limits.
• To send the notifications you asked for, such as the daily look or a finished try-on.
• To fix problems and improve the product.

Who else processes it

Our sub-processors. Each receives only what it needs to do its job.

We do not sell personal data and we do not pass it to advertisers. The providers listed above may use the data only to provide the service to us, and we do not permit them to use your photos to train their own models. We do not train models on your photos either.

Where data is stored

Photos are stored in Amazon S3 in Ireland. Try-on generation runs on Google's Vertex AI in the Netherlands. Some of the providers above operate infrastructure outside the European Union, so data may also be processed in other countries under our data processing agreements with them.

How long we keep it

• The Try On Yourself face photo: deleted automatically 90 days after your last try-on. Every successful try-on extends that by another 90 days. A daily job at 03:00 deletes expired photos from both storage and the database record.
• The mathematical representation of your face: never stored. It is computed in memory during a try-on, used only to check the result still looks like you, and discarded immediately.
• Wardrobe items, looks, try-ons and listings: kept while your account is open, or until you delete them.
• Crash reports and analytics: kept by those providers under their own retention periods.

Deleting your account

In the app: Settings, Privacy, Delete my account. It is immediate and cannot be undone, and it deletes:

• All wardrobe items, including their photos and thumbnails in storage.
• All try-on results, including the generated images.
• Your avatars and the selfie uploaded to build them.
• Your saved looks.
• All of your marketplace listings.
• Your profile record, including sizes, preferences and your marketplace phone number.
• Blocks other users placed on you.

The sign-in record held by the identity provider (Firebase Authentication) is handled separately. If you want that removed immediately as well, write to support@kolav.app and we will remove it.

To delete only the face photo, without deleting your account: Settings, Privacy, Biometric Data, Delete all my face data.

Your rights

You have the right to know what data is held about you, to receive a copy, to correct it, to delete it, and to withdraw a consent you gave. For a copy or a correction, write to support@kolav.app from the address you registered with, and we will handle the request within 30 days.

Use of your face photo for Try On Yourself is based on a separate consent you give on a dedicated screen before your first try-on. You can withdraw it at any time from the Biometric Data screen, and withdrawing deletes the stored photo.

Age

Kolav is for ages 13 and over. Anyone who selects an age under 13 during onboarding cannot continue. The marketplace is for ages 18 and over only, both to publish a listing and to contact a seller. If we learn that an account was created by a child under 13, we will delete it.

Security

All traffic is encrypted. Images are served only through signed, short-lived addresses, so there is no permanent public link to your photos. Access to data is limited to the staff who need it to operate the service and answer support requests.

Changes to this policy

If we change this policy we will update the date at the top of the page. A material change to how the face photo is handled will require you to re-confirm your consent inside the app.

Contact

support@kolav.app