Privacy Policy

What we collect

When you create a Soira account, we collect your email address and (optionally) a display name. During onboarding you provide a gender identifier and mannequin preference, both used to render the virtual figure you build outfits on.

You voluntarily upload photos of your clothing. We process those photos to remove backgrounds (on your device — the image data does not leave your browser for this step) and to auto-tag the item using a third-party AI provider (OpenAI). Tags include category, subcategory, primary color, pattern, and seasonality.

We log every AI outfit suggestion plus your response (saved, ignored, etc.) so we can improve the stylist prompt over time.

When you browse the Discover catalog, we log impressions and clicks per brand item to power sponsored placement reporting.

What we share

We share only the minimum needed to make the app work:

• OpenAI— bg-removed item photos for auto-tagging; wardrobe item summaries (categories, colors, tags) for outfit recommendations. OpenAI's usage policy prohibits training on API data by default.
• Supabase — our authentication + database provider. Your account info, wardrobe data, outfits, trips, and uploaded photos live in our Supabase project.
• open-meteo.com — for trip weather forecasts, we send the destination string + date range. No personal identifiers are sent.
• Brand affiliate networks— when you tap a Buy button in Discover, you leave Soira and continue on the brand's site. Their privacy policy applies from that point.

We do not sell your data, share it with advertisers (beyond aggregate sponsored-placement reporting that contains no personally identifying information), or use it to train AI models.

Your rights

You can download a full JSON export of your data from Profile → Your data → Download my data.

You can permanently delete your account from Profile → Your data → Delete account. This drops your profile record, which cascades to your wardrobe items, outfits, trips, recommendations, and event logs.

Depending on where you live, you may have additional rights (access, correction, portability, objection, restriction) under laws like GDPR or CCPA. Contact us to exercise them.

Security

We use industry-standard security practices: TLS in transit, encryption at rest, row-level access control on every database table, and security headers on every HTTP response. We don't store passwords ourselves — authentication is handled by Supabase Auth, which uses Argon2id hashing.

Children

Soira is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes

When this policy changes materially, we will update the effective date at the top and notify active users via email.

Contact

Reach us at hello@soira.app.