Kootd Privacy Policy

1. Information we collect

The camera and photo library are used only when you take or pick a photo. We do not extract or store biometric data such as facial feature templates from your photos.

2. How we use it

• Providing AI features: outfit score, glow-up score, AI filters, virtual try-on, restyle, outfit swap, style sheet and "a better you" results
• Keeping your results in your account so you can view them again
• Account management: sign-in, verification, preventing abuse and repeat sign-ups
• Purchases and credits: verifying subscriptions and purchases, granting and deducting credits, applying refunds
• Community: publishing posts, handling reports and blocks, acting on inappropriate content
• Notifications: activity such as comments, likes and follows, and service notices
• Improving the Service: usage statistics and error analysis
• Advertising: showing ads to free users and measuring ad performance (Section 7)

We do not use your photos to train our own AI models.

3. Retention and deletion

• Uploaded photos and AI results are stored on our servers until you delete them in the app or delete your account. They are not deleted automatically after processing.
• Community posts and comments stay public until you delete them. If you delete your account, the text of your posts and comments remains so other people's conversations stay intact, but the author is replaced with an anonymous label ("deleted_…"). Attached photo files are erased when you delete your account. To remove a post entirely, delete it before deleting your account.
• Likes, follows, saves, notifications and device data are deleted immediately when you delete your account.
• Payment, credit and AI usage records must be kept under Korean law (the Act on Consumer Protection in Electronic Commerce, 5 years; the Framework Act on National Taxes, 5 years). On account deletion they are immediately de-identified so they can no longer be linked to you, kept for 7 years, then destroyed.
• Sign-in records in the authentication system shared by Kortress services (email address, sign-in provider identifier) are not removed automatically when you delete your account. You cannot sign up again with the same account for 30 days, and a one-way hash of your email is kept for that purpose. To have the sign-in record removed as well, email us (Section 11) and we will delete it after verifying the request.

When a retention period ends, the data is destroyed without delay in a way that cannot be recovered.

4. Deleting your data or account

• One result: delete it from your history. If another result still uses the same original photo, that photo may stay until every result using it is deleted. Deleting your account erases all files.
• Posts and comments: delete them from each post or comment menu.
• Your account: Settings > Delete account in the app. All stored photos and result files are erased right away, your profile (email, name, bio, profile photo) is wiped, and only the records described in Section 3 as legally required remain, in de-identified form.
• If you cannot use the app: email fortressofko@kortress.com from the address you signed up with.

Deleting your account does not cancel an App Store or Google Play subscription. Cancel it in your store's subscription settings.

5. Service providers and international transfers

We use the providers below to run the Service. All of them except Supabase process data outside the Republic of Korea, so the transfer details required by Article 28-8 of Korea's Personal Information Protection Act are listed here.

• When and how: at the moment you use the relevant feature, over encrypted connections (TLS).
• Retention by providers: each provider keeps data only as long as needed for the task we give it, as set out in its own privacy policy and our agreement with it.
• Refusing: if you do not want your data transferred abroad, you can stop using the feature or delete your account. AI features cannot be provided without these providers. You can opt out of ad measurement as described in Section 7.

We do not sell personal information and do not share it with anyone outside this list except when required by law.

6. About AI processing

• Your photo is sent to an AI provider only to produce the result you asked for.
• AI results (scores, suggestions, images) are model estimates and may be inaccurate.
• Your results are visible only in your account unless you publish them to the community or as an AI filter.

7. Advertising and tracking

• Users without a subscription see Google AdMob ads. Users in the EEA and the UK are asked for ad consent through Google's consent screen (UMP).
• On iOS, your advertising identifier (IDFA) is shared with ad partners (Google, Meta, TikTok) only if you allow tracking in Apple's App Tracking Transparency prompt. Every feature works if you decline.
• Even if you decline tracking, app events such as install, sign-up and purchase are sent to Meta and TikTok (iOS) without the advertising identifier to measure ad performance.
• To opt out: on iOS go to Settings > Privacy & Security > Tracking; on Android go to Settings > Privacy > Ads to delete or reset your advertising ID.

8. Your rights

You can at any time access your personal information, ask us to correct or delete it or stop processing it, and withdraw consent. You can edit your profile in the app; for anything else, email us (Section 11). We respond within 10 days after verifying your identity.

• EEA and UK users also have the right to data portability and to object to processing, and may lodge a complaint with their local supervisory authority.
• California users have the right to know what we collect, to request deletion and correction, and not to be discriminated against for exercising these rights. We do not sell personal information; you can opt out of sharing for targeted advertising as described in Section 7.

9. Children

The Service is for people aged 14 or older (or the higher minimum age set by the law of your country). We do not verify age at sign-up, but we do not knowingly collect personal information from children under 14. If we learn that we have, we delete the account and data without delay. A parent or guardian can request deletion by email (Section 11).

10. Security

• Encryption in transit (TLS) everywhere
• Row-level security in the database so each user can reach only their own data
• Private photos are served through signed URLs that expire after one hour
• Minimal administrator access
• On account deletion, de-identification with a keyed one-way hash

11. Privacy contact

• Operator: Kortress
• Privacy officer: Kortress representative
• Email: fortressofko@kortress.com

Users in Korea can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972).

12. Changes to this policy

We may update this policy when the law or the Service changes. We post the changes and the effective date on this page and announce significant changes in the app.