Privacy policy
Version 1.0 · Effective October 26, 2026
This policy explains how ClothesSwitch collects, uses, and shares information when you use clothesswitch.com. Read it alongside our terms of use.
1. Who is responsible for your data
ClothesSwitch is operated by an individual under the ClothesSwitch brand at clothesswitch.com. The individual operator determines how personal information is used for this service. Contact support@clothesswitch.com for privacy questions or requests. This policy covers our website, accounts, outfit visualization tool, and subscription features.
2. Information we collect
Account information: your email address, account identifier, name, and verification date. If you choose Google sign-in, we receive your Google identifier, verified email, name, and profile image through the authentication process. We request basic identity information, not access to Gmail or Google Drive. Email-code sign-in does not require a password.
Studio content: the person photo, outfit reference, and styling instructions you submit for generation. Selecting a local photo previews it in your browser; generating sends the selected images and instructions to our server after sign-in and subscription checks. Importing an Amazon reference sends the product URL to our server, which retrieves the product page and image from Amazon or its image hosts.
Billing information: account and checkout identifiers, subscription order identifiers, subscription status, paid-through dates, and verified payment notifications needed to reconcile access. Payment card details are entered on Waffo Pancake's hosted pages; we do not receive or store full card numbers or card security codes.
Technical information: our hosting infrastructure receives standard network request information, including IP addresses and browser request headers, and may record request times, errors, and operational logs. The application uses hashed network identifiers for generation and import limits, and keyed hashes of network and email identifiers for email-code sending limits. These identifiers are pseudonymous, not necessarily anonymous.
Support information: if you contact us, we receive your email address, correspondence, and any information you choose to provide. Please do not email payment card details, verification codes, or unnecessary sensitive photos.
3. How and why we use information
We use account information to authenticate you, studio content to fulfill generation and import requests, and billing records to manage subscriptions and verify paid access. Where data protection law requires a legal basis, these activities support performance of our agreement with you.
We use technical information and request limits to protect accounts, prevent fraud and abuse, investigate errors, and keep the service available. We rely on legitimate interests where applicable, subject to your rights. Support and necessary service notices support our agreement or legitimate interests. We process records when necessary to meet applicable legal obligations. Where consent is required for a particular activity, we will request it separately; merely reading this policy does not provide that consent.
4. Cookies and browser storage
Necessary authentication cookies keep you signed in and protect the sign-in process. The session uses an encrypted, HttpOnly cookie with a configured maximum age of 30 days; continued sign-in activity may renew it. Temporary security and callback cookies support authentication. Signing out clears the current browser session.
The application currently includes no advertising trackers, marketing pixels, or analytics SDK, and serves its fonts locally. We do not offer a cookie preference center. You can block or delete cookies in your browser, but blocking necessary cookies may prevent sign-in and paid access.
Selected photos, instructions, and generated previews are held in the studio's current browser state. Use Start fresh or close the page to clear that application state. Copies you download remain on your device until you delete them. Browser caching and device backups are controlled by your browser and device settings.
5. Service providers and disclosures
We do not sell personal information or share it for cross-context behavioral advertising. We disclose information as needed to run the service:
- Cloudflare hosts the application and stores account, billing, and request-limit records in D1. Its infrastructure processes network requests and operational information.
- Google handles Google sign-in when you select that option and supplies the basic identity information described above.
- Resend receives the recipient email address and verification email, including its code, to deliver email sign-in messages.
- Waffo Pancake receives your account identifier and email to associate checkout with your account, and processes payment information on hosted payment pages.
- The configured third-party image API provider receives selected photos and styling instructions for generation. The service is configured for GPT Image 2.5 through a provider gateway; this does not necessarily mean a direct connection to OpenAI.
- Amazon and its image hosts receive requests from our server when you import a product reference. Opening an external product link also connects your browser to that third party.
We may also disclose information where required by law, to address fraud or security threats, to protect lawful rights, or at your direction. If responsibility for the service changes, we will provide notice where required and continue to protect information under applicable obligations.
6. Security and image processing
The public website uses HTTPS. Login sessions use encrypted, HttpOnly cookies. Email verification codes are stored as keyed hashes rather than plaintext in our database. Codes expire after 10 minutes, allow at most five verification attempts, and can be used once. Access checks and request limits help protect generation and payment features.
The application processes uploaded photos and generated results in memory rather than saving them to a permanent ClothesSwitch gallery, database, or image file store. Uploaded images are normalized before forwarding, removing embedded metadata. This does not remove personal information visible in the image itself. We do not operate a model-training pipeline using your uploads. The image provider's own processing, logging, retention, and training practices are separate; we do not promise zero retention or training restrictions on that provider's behalf.
No online service can guarantee absolute security. If an incident requires notification, we will notify affected people and authorities as required by applicable law. Keep your email account and devices secure and report suspected unauthorized access promptly.
7. How long information is kept
Photos, instructions, and results: the application holds these during request processing and in the current studio browser state, without a permanent server-side image history. This does not set retention periods for infrastructure logs, backups, or the image provider's systems.
Verification challenges: codes become invalid after 10 minutes and are deleted on successful use. Expired challenge rows are eligible for cleanup one hour after expiration during a later code-sending request. Email sending-limit windows last one hour, with expired rows cleaned during later requests; cleanup is request-driven, so physical deletion can occur later.
Generation and import limits: counters use one-hour windows and are reset on subsequent requests after expiration. Expiration is not automatic deletion of the stored hashed identifier.
Accounts and billing: records persist across logout and subscription cancellation. The application currently has no automatic fixed-age deletion schedule for these records. Contact us to request deletion. We assess what can be removed and what must be retained for an active subscription, payment reconciliation, fraud prevention, disputes, or applicable legal obligations. We will explain relevant retention exceptions in response to your request.
Support correspondence and provider logs do not currently have a uniform automatic deletion period configured by the application. Contact us about a specific record. Third-party providers may retain their own records under their policies and legal obligations.
8. Your privacy rights and choices
Depending on applicable law, you may have rights to receive information, access or correct personal data, request deletion, restrict or object to processing, receive a portable copy, and withdraw consent where processing relies on consent. Withdrawal does not affect processing that was lawful before withdrawal. You may also complain to the relevant data protection authority and exercise applicable rights without unlawful discrimination.
Send requests to support@clothesswitch.com, preferably from your account email. We may ask for proportionate verification before disclosing or deleting data. We respond within the deadlines required by applicable law and explain any permitted extension or reason we cannot fully fulfill a request. We will not ask for your password or email verification code.
Removing a photo from the studio does not recall data already sent for generation. Signing out does not delete your account. To stop recurring charges, cancel renewal through Subscription & billing before requesting account deletion. See our terms for cancellation instructions.
9. Email and marketing
The current application sends requested verification emails and does not operate a promotional mailing list or SMS marketing program. Necessary billing, support, security, and policy messages may still be sent where appropriate. If we introduce optional marketing, we will provide the choices and unsubscribe mechanism required before using your information for it.
10. International processing
Cloudflare's network and our authentication, email, payment, and image providers may process information outside your country, where privacy laws may differ. This service does not promise storage in a particular country. Applicable transfer requirements depend on the provider and processing involved. Contact us for details about a particular transfer or relevant safeguards; this policy does not claim that a specific transfer agreement or certification is in place where it has not been confirmed.
11. Adults only
ClothesSwitch is for people aged 18 or older. Do not upload images of minors. We do not knowingly collect children's information for this service. If you believe a child has provided personal information or appears in an uploaded image, contact us so we can investigate and take appropriate deletion or access-restriction steps.
12. Third-party policies and links
Third-party websites and providers have their own privacy practices. This policy describes our processing and does not replace their notices. Review the policies linked below, along with the notices displayed by Waffo Pancake at checkout. Contact us for information about the image provider used for your request.
13. Changes to this policy
We will update the effective date when this policy changes. For material changes, we will provide advance notice through the website or your account email where required. If a new use of data requires consent, we will obtain it separately.
14. Contact
For privacy requests, account deletion, security concerns, and questions about this policy, contact the individual operator of ClothesSwitch at support@clothesswitch.com. Use the same address for customer support.