THE DETAILS MATTER

Privacy Policy

Last updated September 11, 2026

Pre-launch policy draft. The legal operator and business location must be confirmed before public launch.

wearitfirst.ai creates AI clothing previews from the photos you choose. This policy explains what the service collects, why it is used, and the controls available to you.

Information you provide

When you sign in with Google, we receive your verified email address, profile name, and a Google account identifier. We store a keyed hash of the identifier to recognize your account. We do not receive your Google password, contacts, email messages, or browsing history.

You may provide a photo of yourself, dress reference images, and a product-page URL. Choosing a local photo does not upload it automatically. Creating a preview sends the selected photos to our server and image-processing providers. Saving a photo or look stores it privately for your account.

Checkout information

When you use checkout, Stripe hosts the payment form. wearitfirst.ai does not receive or store full card numbers or security codes. We send Stripe a purchase identifier, an internal account identifier, and the credit pack details. We store the purchase amount, currency, credit quantity, payment identifiers, timestamps, and fulfillment status to deliver credits and resolve payment issues. Purchase records are retained after account deletion for payment reconciliation. Your try-on photos are not sent to Stripe. See Stripe’s Privacy Policy. Live checkout charges the amount shown before you confirm payment.

How photos are processed

We currently route try-on generation through OpenRouter to Meta’s Muse image service. Your selected person and garment images, together with instructions for the preview, are transmitted for that request. Providers process data under their own terms and privacy practices. Review OpenRouter’s Privacy Policy and Meta’s Privacy Policy. We do not promise that providers immediately delete every copy.

We do not operate a face-recognition service or use your photos to identify you. We do not sell your photos or intentionally use them to train our own AI models. The generated preview may alter appearance or clothing details and is not a measurement or fit assessment.

Storage, retention, and deletion

Supabase stores account, session, credit, and generation records. Supabase private storage holds saved photos and generated previews. Saved photos and looks remain until you delete them or your account. Generated previews are accessible for 24 hours. Scheduled cleanup removes expired previews and temporary files in batches; storage outages or backlogs can delay physical removal. Product-import records expire after 20 minutes.

You can remove your saved photo in the fitting room, delete individual saved looks, export your account summary, or delete your account from My account. Account deletion removes access and schedules removal of stored photos. Limited pseudonymous credit and abuse-prevention records, including a keyed Google identifier hash, may be retained to prevent repeated free-credit claims. Deletion from active storage does not guarantee immediate deletion from infrastructure backups or provider systems.

Sessions and abuse prevention

Essential cookies keep you signed in and protect the Google sign-in process. An anonymous session tracks the guest allowance. The server uses a keyed hash of your IP address to limit automated or repeated free requests, and records request times, outcomes, and credit usage. Creating new accounts or clearing cookies is not permitted to bypass these limits.

Optional analytics and advertising measurement

With your permission, Vercel Web Analytics measures visits to our public pages, approximate visitor counts, referring sites, countries, browsers, and devices. It does not use analytics cookies. We remove query strings and fragments from page URLs and exclude private account, authentication, and image routes. We do not send photos, account identifiers, or purchase details to Vercel Web Analytics. Your existing Privacy choices also controls this collection. See Vercel’s Web Analytics privacy information.

With your permission, PostHog helps us count unique visitors, understand where people leave the try-on and checkout flows, and measure repeat use. We send selected action names, timestamps, broad device category, campaign labels, payment amounts and currency, and pseudonymous browser and account identifiers. Signing in connects your earlier consented activity to your account. We do not send photos, image contents, product URLs, names, emails, or payment details to PostHog. Session recordings and automatic form capture are disabled. PostHog hosts this project in the United States; its retention settings govern previously delivered events. See PostHog’s Privacy Policy. Privacy choices turns off future analytics and advertising collection.

When advertising measurement is enabled, we ask before using the Meta Pixel or sending marketing events to Meta’s Conversions API. You can decline and continue using the fitting room. Use “Privacy choices” to withdraw consent. We respect Global Privacy Control and Do Not Track signals.

With permission, we record page visits, campaign tags and ad click identifiers, registration, product imports, try-on outcomes, saves, downloads, shares, extension download clicks, and checkout outcomes. Meta can receive browser identifiers, IP address, browser type, and hashed email or account identifiers for event matching and ad measurement. Hashing does not make this information anonymous. Photos, image URLs, product URLs, names, and authentication/payment query strings are not included in server marketing events.

Consent and campaign attribution expire after 90 days. Identifiable marketing event records are retained for at most that period. Queued matching data is removed after successful delivery or permanent failure; undelivered events expire after six days. Temporary checkout attribution expires after two days. Withdrawal removes this browser’s stored marketing records and stops future delivery; an event already in transit may complete. Account deletion removes marketing events linked to that account. Previously delivered information may remain with Meta under Meta’s Privacy Policy. Contact us for assistance with privacy requests.

Product links and infrastructure

When you import a product URL, our server requests that public page and selected image URLs. The retailer receives the server’s request. Infrastructure and service providers may process technical logs and data in countries outside your own. We share information needed to provide the service, protect it from misuse, respond to lawful requests, or support a business transfer subject to applicable protections.

Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, or receive a copy of your personal information. Where processing relies on consent, you can withdraw it for future processing by stopping use and requesting deletion. Contact support@wearitfirst.ai for privacy requests or to ask about a relevant supervisory authority. We may verify account ownership before fulfilling a request.

Adults only

wearitfirst.ai is intended for people aged 18 or older. Do not upload images of minors or photos of another person without their permission. If you believe a minor’s information has been provided, contact us so we can investigate and remove it.

Changes and contact

We may update this policy as the service changes. We will update the date above and provide additional notice for material changes where required. Questions: support@wearitfirst.ai.