Privacy Policy

Last updated: 31 October 2026

1. Who is responsible

Nitido is made and operated by Kevin Baur, an individual developer. The controller is Kevin Baur, Hochstraß 542, 3033 Klausen-Leopoldsdorf, Austria. Contact: nitido@kevin-baur.com.

Nitido uses photos and colour measurements to suggest colours, compare garments and organise your wardrobe. This policy explains local processing, online storage, service providers and deletion.

2. The essentials

• Selfie analysis runs on your device. Nitido does not send the selfies used for colour analysis, the fitting-room portrait, facial landmarks or live camera frames to a third-party cloud AI service.
• Derived colour measurements are personal data and are stored with your Nitido account in Supabase, including when the account has not been linked to Apple or Google.
• The next app update makes usage statistics opt-in and removes measurement results and image-derived scores from PostHog events. Earlier test builds and test data are explained in section 7.
• Garment photos are backed up to Supabase only for a linked account. If a garment photo includes a person or face, the saved image can include that person or face too.
• Studio photos are optional. If you allow it, or tap “Create studio photo”, a garment photo is sent to OpenAI to create a picture of the garment like in an online shop. The result is saved only on your device. Details are in section 5.1.
• You can choose to share an image through your device's share sheet. The recipient you choose then receives that image.

3. Face data: collection and on-device processing

3.1 What is processed

When you start a colour measurement and allow camera access, Nitido processes selfies, facial contours and landmarks, face position and orientation, eye-opening estimates, and skin, iris and eye-white colour values on your device. These data are used to assess image quality and provide your colour classification and colour characteristics.

The current measurement engine does not sample hair colour. Older stored measurements may contain numerical hair-colour values from earlier versions.

Face detection uses Google ML Kit locally on the device. Nitido's colour calculations also run locally. ML Kit does not send the input photographs or face-detection outputs to Google servers. Its separate technical telemetry is explained in section 8.

The app does not use face data to recognise your identity, authenticate you, match you against other people, infer your ethnicity or health, or build an identity-recognition database. Nitido does not sell face data or use it for advertising targeting. Numerical measurements may be used to diagnose and improve the accuracy of Nitido's colour calculations; they are not sent to a cloud AI service for training or inference.

3.2 Fitting-room portrait and live mirror

Nitido stores a fitting-room portrait privately on your device. Background removal happens locally where available; otherwise the original background may remain. The portrait is not uploaded to Nitido's account backup.

The live mirror processes camera frames and facial contours on your device to display colours around your face. It does not record video or upload frames or contours.

3.3 Local storage and retention

The active portrait is retained for the fitting-room feature until you replace it or delete the app and its local data. Earlier app builds can leave previous portrait files on the device, including after account deletion. The next app update adds removal of the previous portrait when it is replaced and of all saved portraits during in-app account deletion, with an error shown if removal fails. Until that update is installed, deleting the app and its local data removes these remaining local portrait files.

The latest measurement, including numerical results and facial and sampling-area geometry used to display the result, is stored locally until replaced by a new measurement or cleared during in-app account deletion. This geometry is not uploaded to Supabase.

Original camera files, normalised images and temporary images generated while processing or sharing may remain in the app's local cache. Nitido does not guarantee immediate deletion of these temporary files after a measurement. They remain until removed by the app, cleared by the operating system, or removed when the app and its local data are deleted. Live-mirror frames and its tracking contours are held only for the active preview, rather than saved as a video.

Device backups managed by Apple, Google or your device settings are separate from Nitido's Supabase backup. Depending on those settings, a device backup may contain local app data. Manage those copies through your device or backup provider.

4. Face-derived measurements and account data stored online

Nitido creates an account with a random identifier without requiring your name or email. This account is pseudonymous, not a guarantee of anonymity. Linking it through Sign in with Apple on iOS or Google on Android enables restoration across installations; the provider supplies an identifier and may supply an email address, including an Apple private relay address.

Supabase stores face-derived colour measurements with your account identifier and measurement date: colour classifications and confidence, colour characteristics (undertone, depth, contrast and clarity), numerical skin and eye-colour samples, and capture-quality and processing diagnostics. Historical measurements may include hair-colour values. These records contain no selfies, fitting-room portraits or facial landmark coordinates.

These records support saving and restoring your result, palette-based features, and diagnosing and improving colour-measurement accuracy. Each new measurement can create a new record; remeasuring does not erase the online measurement history.

If you explicitly save a reference measurement for calibration, Supabase also stores the reference and calculated classifications, numerical colour characteristics, confidence, processing diagnostics and any note you enter, linked to your account. This supports measurement-quality improvements and does not include photographs or facial geometry.

Other account records include clothing preferences, language, onboarding completion, wardrobe categories, numerical garment colours and scores, garment-photo references, saved outfit names, garment selections, layouts and scores, how many studio photos you have used in the current subscription period, and access-code redemption records where applicable.

Supabase provides database and storage services on our behalf. Our selected project region is Frankfurt, Germany, on AWS infrastructure. Account access controls restrict users to their own records; authorised operational access by the controller and service providers is limited to providing, securing and supporting the service.

Legal basis: providing requested app and account features, Article 6(1)(b) GDPR; diagnosing and improving measurement accuracy, our legitimate interest under Article 6(1)(f) GDPR.

5. Garment photos and sharing

Garment photos taken with the camera or selected through the system photo picker are processed locally and saved in the app's storage. The picker gives Nitido the image you select, rather than access to browse your entire library.

While the account is anonymous, Nitido does not upload garment photos to its account backup. Once you link an account, the app uploads saved garment images to a private Supabase storage area to restore your wardrobe on another device. The uploaded image is the saved garment image, which may have been resized or had its background removed. Nitido does not guarantee that people or faces have been removed from a garment image. Any remaining person or face is therefore included in the backup. Apart from studio photos, described in section 5.1, these images are not processed by a cloud AI service.

Removing a garment requests deletion of its backed-up image. Network or service failures can delay or prevent that individual request; contact us if a deletion needs assistance. Successful account deletion removes all garment images in that account's backup before removing the account. Local garment files and temporary cached images can remain until the app and its local data are deleted.

Sharing is optional and starts only when you use the sharing feature. A shared card may include your portrait, a garment or another image you selected. The app or person you select receives it under their own terms. Deleting your Nitido account cannot delete copies already shared with someone else.

Legal basis: Article 6(1)(b) GDPR for requested storage, backup and sharing features.

5.1 Studio photos

Nitido can turn a garment photo into a studio photo: a new picture of the same garment with even light and no background, similar to a product photo in an online shop. This happens only if you agree to automatic studio photos when you first add a garment to your wardrobe or later in Settings (“Automatic studio photos”), or if you tap “Create studio photo” for a single garment. Studio photos are never created by the garment scanner, from selfies or from the fitting-room portrait.

For each studio photo, the app sends the saved garment image and its wardrobe category through Nitido’s server to OpenAI, which generates the new picture and returns it. The request to OpenAI contains no account identifier, name, email address or colour measurement. If the garment image still shows a person or face, OpenAI receives that too. The studio photo is saved only on your device and is not part of the account backup. Nitido’s server stores neither the garment image nor the studio photo.

To apply the allowance of your subscription, Nitido’s server checks your subscription status with RevenueCat and stores, with your account identifier, how many studio photos you have used in the current subscription period and when the last one was requested. These counts are deleted with your account.

OpenAI processes the images on our behalf as a service provider in the United States. Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models. OpenAI may retain API inputs and outputs for up to 30 days to detect and prevent abuse; after that they are deleted unless the law requires longer retention.

You can switch off automatic studio photos in Settings at any time; this stops future uploads. “Show your photo” removes the studio photo of a garment from your device. Colour measurements and scores always use your own photo, never the studio photo.

Legal basis: Article 6(1)(b) GDPR for the studio photos you request. Automatic sending to OpenAI is based on your consent, Article 6(1)(a) GDPR, which you can withdraw in Settings at any time without affecting earlier processing.

5.2 Automatic categories

When you add a garment, Nitido suggests its wardrobe category. If you allow AI category recognition, the app sends each new garment photo through Nitido’s server to OpenAI, which returns only the category. The request to OpenAI contains no account identifier, name, email address or colour measurement. If the photo shows a person, a face or background, OpenAI receives that too. The category is saved with the garment. Nitido’s server stores neither the photo nor OpenAI’s answer. To limit misuse, it counts, with your account identifier, how many recognitions you requested today and when the last one was. Garment photos you saved earlier are not sent.

Without this permission, or when OpenAI gives no answer, the category is suggested on your device by Apple Vision or Google ML Kit, or you choose it yourself. When the suggestion comes from your device, Nitido records which words the on-device recognition returned and which category was chosen, without the photo and without any account identifier, to improve the suggestions.

OpenAI processes and retains the photos as described in section 5.1. Legal basis: your consent, Article 6(1)(a) GDPR. You can withdraw it in Settings at any time without affecting earlier processing.

6. Subscriptions and advertising measurement

Subscriptions are handled by Apple or Google. Nitido does not receive your payment-card details. RevenueCat manages subscription status using the Nitido account identifier, purchase and renewal information and technical information such as app and device information and network request data. RevenueCat does not receive facial images, facial geometry or sampled face-colour values from Nitido.

Legal basis: Article 6(1)(b) GDPR. Deleting a Nitido account does not cancel an App Store or Google Play subscription; cancellation is managed in the relevant store. Transaction records may remain subject to applicable legal retention obligations.

The app contains no advertising SDK and does not read an advertising identifier. On iOS, supported advertising attribution can use Apple's SKAdNetwork.

When a subscription is started, RevenueCat can report that event to the platform on which Nitido is advertised, for example Meta or TikTok, to measure campaign results. Depending on the integration, this can include the event, plan, price, currency, time and technical attribution information such as IP address and device type. These reports contain no photographs, facial geometry or colour-measurement data. The receiving platform processes the report under its own privacy policy. The stated legal basis is our legitimate interest in evaluating advertising, Article 6(1)(f) GDPR; you can object by contacting nitido@kevin-baur.com.

7. Optional usage statistics and test data

The next app update enables PostHog usage statistics only after you explicitly agree in Settings. The permission screen identifies the recipient, data and purpose. Declining does not restrict app features. Existing installations must also agree; the earlier default-on setting is not treated as consent.

With permission, PostHog's EU service receives general usage events (screens, subscription and account actions, wardrobe actions and sharing completion), a random analytics identifier, app/device and operating-system information, and the IP address used for network requests. The identifier is not explicitly linked to your Nitido account. These data are pseudonymous. Session recording and IP-based geographic enrichment are disabled.

The updated app does not send photographs, facial geometry, face measurements, colour classifications, confidence, capture-quality results, measurement failure categories, individual colour samples or garment/outfit matching scores to PostHog. Statistics help us understand feature usage and improve the app. You can withdraw consent at any time under Usage statistics in Settings, stopping future collection without affecting the lawfulness of earlier consent-based processing.

Earlier test builds enabled statistics by default with an opt-out and could send classifications, confidence, capture-quality/demo indicators, failure categories, garment/outfit scores and sharing details, but no facial photographs, facial geometry or individual face-colour samples. Until you install the update, that behaviour applies; statistics can be disabled in Settings. The update does not load or transmit the earlier analytics client's locally queued events. It does not erase events already received by PostHog during testing.

PostHog guarantees one year of event and metadata retention under our current plan. Older data may be deleted; deletion exactly on day 365 is not guaranteed. Nitido has no separate automatic event-deletion schedule. Disabling statistics or deleting your Nitido account does not erase existing analytics. Contact nitido@kevin-baur.com for access or erasure; locating events may require the relevant analytics identifier.

Legal basis for optional analytics in the updated app: consent, Article 6(1)(a) GDPR. Analytics in earlier test builds were described as based on legitimate interest under Article 6(1)(f); you may object and request erasure by contacting us.

8. On-device SDKs and updates

Google ML Kit processes image inputs and their analysis outputs on the device without sending those inputs or outputs to Google. The SDK may contact Google for model updates, compatibility information and fixes and sends performance and usage metrics and associated technical information. Google describes this separately in its ML Kit terms and privacy information. Using an on-device ML Kit model is not a transfer of the selfie to Google's cloud AI.

On Android, background-removal models can be downloaded through Google Play services. Google sign-in exchanges authentication tokens with Supabase if you choose to link an account. On iOS, Apple sign-in provides the corresponding account-linking flow. These authentication exchanges do not contain the selfie.

Expo provides application updates. Update requests disclose technical information such as app version, platform and IP address. Nitido does not send facial images or colour measurements as part of those update requests.

Legal basis: our legitimate interest in a functional, maintained app, Article 6(1)(f) GDPR; requested sign-in under Article 6(1)(b).

9. Service-provider protection and international transfers

We require service providers processing personal data on our behalf, including Supabase, PostHog and OpenAI, to provide the same or equal protection for that data as described in this policy. This includes processing for the agreed service purposes, confidentiality, appropriate security measures, restrictions on further disclosure, and assistance with deletion and data-subject rights. These protections also apply to stored face-derived measurements, analytics from earlier test builds described in section 7 and any faces visible in backed-up garment photos or in garment images sent for studio photos.

Our processors' data-processing terms include Supabase's DPA, PostHog's DPA and RevenueCat's DPA and OpenAI's DPA. International transfers, where applicable, are subject to the relevant contractual safeguards, including EU Standard Contractual Clauses. Selecting an EU storage region does not mean that every service provider's support or operational processing is necessarily confined to that region.

10. Retention and deletion

• Face photographs and geometry on the device: the portrait, measurement-display geometry, live frames and temporary files follow the separate lifetimes described in section 3.3. There is no blanket promise that every temporary image disappears immediately after processing.
• Online measurements, including face-derived colour data: retained in the active account until the account is deleted. There is no automatic time-based expiry in the app. Remeasuring does not delete earlier online measurements. The same applies to explicitly saved calibration records.
• Account, wardrobe, outfits and backed-up photos: retained while the account is used, subject to individual deletions and successful account deletion. The in-app Delete account and data action removes the authenticated account, its related database rows and its backed-up garment photos from active Supabase storage. It also clears local account-related app state. Removal of portrait files depends on the installed app build, as explained in section 3.3.
• Studio photos: stored only on your device until you remove the garment, choose “Show your photo” or delete the app and its local data. Copies at OpenAI follow the period in section 5.1. The counts of used studio photos stay with the active account until it is deleted.
• Service backups: Our Supabase project uses the Free plan, which does not include project backups. We do not create additional database backups or manual database exports. This describes our project backup configuration, rather than a guarantee about all internal operational retention by the infrastructure provider.
• Usage statistics, including measurement results: retained for the period specified in section 7. Disabling statistics or deleting the Supabase account does not retroactively erase them.
• Purchase and support records: retained for their stated purpose and any applicable legal obligations.
• Copies shared with others and device backups: managed by the chosen recipient or backup provider, as described in sections 3 and 5.

Deleting the app is different from deleting your account. Uninstalling does not send a server-deletion request. If you use an anonymous account, delete it in the app before uninstalling: without its local credentials, we may be unable to identify or authenticate that account for you. Account deletion applies to the authenticated account, not unrelated accounts created on other installations.

11. Contact and this website

If you contact us, we use your email address and message to respond and retain them until the matter is resolved, unless a legal obligation requires longer retention. Legal basis: Article 6(1)(b) or (f) GDPR.

The website is delivered through Cloudflare, which processes IP addresses and technical request information for delivery and security. The website uses DataFast for cookieless visitor statistics and self-hosted fonts. Choosing a language sets a language-preference cookie; this is separate from the cookieless visitor statistics. Legal basis stated for these purposes: Article 6(1)(f) GDPR.

12. Your rights

Under the GDPR you may request access, correction, erasure, restriction and portability where applicable, and object to processing based on legitimate interests. Contact nitido@kevin-baur.com. You may complain to the supervisory authority where you live or to the Austrian Datenschutzbehörde.

For pseudonymous accounts, we need enough information to locate the relevant records and verify that the request concerns your account. In-app deletion authenticates the request using the session already on your device.

13. Children and changes

Nitido is not directed at people under 16. If you believe a child has provided personal data, contact us so we can investigate and delete it where appropriate.

We update the date when this policy changes and provide notice of material changes as appropriate. The Terms of Use explain subscriptions and the limits of the colour analysis.

Kevin Baur — nitido@kevin-baur.com