Overview
Woredrobe is an iOS app for wardrobe planning, outfit memory, social closet posts, and style suggestions, including Sophia and Treat Yourself. Your wardrobe lives on the device. Shared posts, follows, and marketplace records can also be stored in iCloud and on the Woredrobe server. This policy names the data the current app processes and the services that receive it.
Information the app processes
Depending on what you use, Woredrobe processes:
- Sign in with Apple: an Apple user identifier, and, if Apple provides them, a name and an email address or Apple private-relay address. The server account stores the Apple subject. The name and email are kept in the on-device account record. The server does not store the email.
- A backend session token. The server stores only a hash of that token, with an expiration time.
- Profile fields you set for the shared closet: display name, username, and avatar.
- Wardrobe items, outfit photos, notes, style tags, wear history, and saved style ideas, stored in on-device SwiftData. That store is not synced through CloudKit.
- People and relationship memory you add or import: names, relationship labels, and notes tied to outfits. Contact import can also save a phone number, email, organization, and contact photo on the device.
- Calendar events the app reads, when you allow calendar access, so it can prepare outfits. Attachments you save stay on the device.
- Location, when you allow it, used to request a weather forecast. The app does not keep a location history on the Woredrobe server.
- Photos and camera images you attach to wardrobe items, people, posts, or your Style Model.
- A Style Model photo, if you opt in. It is stored in the app’s local files and may also be saved in your private iCloud database. It is not placed in the public CloudKit database.
- Microphone audio and the text produced by Apple speech recognition when you talk to Sophia. The spoken text, and a generated voice reply, can be sent through the Woredrobe server.
- Sophia chat, including recent turns and a compact context summary that can include wardrobe facts, people you may see, and calendar context.
- Item and outfit photos sent for Sophia vision, and Style Model plus garment photos sent for Treat Yourself or virtual try-on image generation.
- Social posts (caption, image, visibility), comments, likes, follows, and the image bytes for posts stored on the server.
- Marketplace listing text, price, photos, and size or brand details. Seller payout setup can create a Stripe Connect account record. Orders, when they exist, include price, tax, shipping region and postal code, and Stripe payment identifiers.
- Treat Yourself product search: style search text, a price range, and a clothing-presentation value. The server removes the account id from that request before search.
Contact Support, Report a Bug, Feature Request, and Feedback open the device Mail composer addressed to support@woredrobe.xyz when Mail can send. If Mail is not set up, the app tries to open a mailto link. Woredrobe does not store these messages. A message counts as sent only when Mail reports that it sent. Writing to that address does not, by itself, confirm that anyone received it. There is no third-party analytics SDK in the app. Purchases are not currently offered.
Who receives data
- Apple. Sign in with Apple, iCloud and CloudKit for social closet records and an optional private Style Model, and speech recognition for Sophia Voice. Photos, contacts, and calendar entries are read through Apple’s system frameworks and are not uploaded as a contact book or calendar feed.
- The Woredrobe server (hosted on Railway, with a PostgreSQL database). It receives the Apple subject, session, profile, social posts and image bytes, follows, likes, comments, marketplace listings, and Sophia and Treat Yourself requests.
- OpenAI, when the server is configured with an API key and you use Sophia or image generation. The server sends chat and stylist text, vision images, text to be spoken, and the photos used for Treat Yourself or virtual try-on. OpenAI’s reply text, generated image bytes, and generated voice audio can be stored on the Woredrobe server. A separate product-rerank call to OpenAI stays off unless the server explicitly enables it.
- Channel3, from the server, for Treat Yourself product search. Channel3 receives the search query, price bounds, and gender presentation. It does not receive your photos or account id from that search.
- Open-Meteo, which receives the latitude and longitude used for the weather forecast. Those coordinates are not sent to the Woredrobe account database.
- Stripe. Purchases are not currently offered, and Stripe is not used for an active checkout. In-app subscription buying is off. Marketplace checkout stays unavailable until sales tax is configured on the server, and it starts disabled. If you choose Set Up Payouts and the server has Stripe configured, Stripe-hosted onboarding can collect seller information. Woredrobe then stores the Connect account id and payout status, not your card number.
Woredrobe does not sell personal data. Content is still sent to the services named above when you use the related feature. Public or friends-only closet posts and listings are visible to the people that visibility setting allows.
How long data is kept
The code does not define a general retention period. What can be verified:
- On-device wardrobe, people, wear history, and calendar attachments stay until you clear local data in Settings, a successful account deletion wipes them, or you delete the app.
- A backend session stays until you sign out and the server revokes that session, account deletion removes the session rows, or the session expires. The default lifetime is 90 days. The server may be configured between 1 and 365 days. If sign-out cannot reach the server, that session can remain valid until it expires.
- Social posts, comments, likes, follows, post image bytes, and listings stay until a successful account deletion removes them. Listings are not removed when order history is kept. See deletion below.
- Sophia and image-generation records, including generated image bytes and voice audio, are kept on the server. Account deletion does not delete them, and the code does not say when they expire.
- Marketplace orders and their financial records are kept when they exist. The code does not say for how long.
- How long OpenAI, Channel3, Open-Meteo, Apple, or Stripe keep their own copies is not defined in this app.
Account deletion
When backend sign-in is available and you are signed in, Settings includes Delete Account. It asks you to confirm twice, then asks the server to delete the signed-in account. The server uses the session only. It does not accept an account id from the request body. If the server call fails, the account and the on-device wardrobe are left in place.
When deletion succeeds and you have no marketplace orders, the server deletes:
- Your posts, the likes and comments you made, comments and likes on your posts, and the image bytes stored for your posts.
- Follows in both directions.
- Your marketplace listings and the Woredrobe record of a seller Stripe account, if you had one and there is no order.
- Every backend session for the account, which signs those tokens out.
- The account row itself.
Orders are not erased. If you have an order that is anything other than cancelled or failed — including a checkout still open, a paid, shipped, delivered, completed, disputed, or refunded order — the server refuses deletion and keeps the account. If the only orders are cancelled or failed, the server still deletes the social data and sessions above, then anonymizes the account instead of deleting it: it clears the Apple identifier, legacy CloudKit id, display name, username, and avatar, and marks the account inactive. The order, its financial records, the related listing, and the seller Stripe record stay attached to that anonymized account.
After the server accepts deletion, the app also:
- Clears the on-device session and Apple account metadata. It does not revoke the Sign in with Apple credential with Apple.
- Attempts CloudKit cleanup. Marketplace listing records are deleted when that succeeds, and hidden when delete fails. Closet posts are marked inactive, not deleted. The closet profile is marked private, not deleted. This cleanup is best-effort. If it fails, those iCloud records can remain. Follow records in CloudKit are not removed by this cleanup.
- Clears in-memory social and marketplace caches, then tries to delete the local SwiftData wardrobe, outfits, people, wear history, and calendar attachments. If that local wipe fails, the server deletion has already completed and those on-device records can remain.
- Clears on-device Sophia memory and style-profile settings. The product-tour “seen” flag is kept.
Account deletion does not delete:
- Server records of Sophia and image generation, including stored prompt results, generated image bytes, and generated voice audio (
AiUsageEntry, includingresultData). AI entitlement rows and any Apple subscription status rows are also left in place. - The on-device Style Model photo, its private iCloud copy, Treat Yourself preview files, virtual try-on preview files, or the product-image cache.
- Marketplace orders, or the listings and seller record kept with cancelled or failed orders.
- A Stripe connected account on Stripe’s side. Woredrobe only removes its own seller-account row when there is no order history.
Clear all local app data in Settings removes the on-device wardrobe and people records. It does not delete the server account. Deleting the app removes on-device files and does not, by itself, delete the server account or iCloud records.
Reports and blocks
Objectionable content is not allowed. You can report a post, comment, listing, or profile, and you can block an account. Blocking hides that account’s posts from your feed. You can unblock an account in Settings.
Contact
Privacy requests can be sent to privacy@woredrobe.xyz. Product support can be sent to support@woredrobe.xyz. The in-app support form opens Mail, or a mailto link, to support@woredrobe.xyz. Woredrobe confirms a message was sent only when Mail reports that result. Writing to these addresses does not, by itself, confirm that anyone received a message.