ClosetOS Privacy Policy

Last updated: 3 November 2026

ClosetOS is a wardrobe app. Your wardrobe lives on your phone. Emma, its AI stylist, sees only what each feature you use sends her, and each of those requests is listed below. Photographs you keep as worn are never sent to her or to our service. This policy describes the narrow set of things that do leave it. It is written from the code rather than from a template: every claim here corresponds to a request the app actually makes or a table our service actually has.

Not yet reviewed by a lawyer. This is an accurate technical description intended as the basis for legal review, not a substitute for it.

Your wardrobe stays on your device

Every piece, photograph, look, profile and note lives in the app's own storage on your iPhone. There is no cloud wardrobe: no account holds your clothes. Settings → Backup & data → Erase everything deletes them from inside the app, and so does deleting the app. You can export everything yourself as a .cosbackup file from Settings → Backup & data. Photographs you keep as worn, and photographs added to looks, are left out of that file unless you switch on “Include worn / on-body photographs”, and the file goes wherever you send it.

Your iPhone's own backup, to iCloud or to a computer, includes the app's storage, as it does for any app. That backup is yours, and an iCloud backup is also held by Apple under Apple's terms; ClosetOS cannot read it.

Adding pieces, building looks by hand, editing, filtering and exporting all work with no network connection and no account.

What leaves your device, and when

No wardrobe content leaves until you have read the in-app disclosure — “Before Emma sees anything” — and continued past it. Until then the stylist features are inert: no photograph, no garment attribute and no typed direction is sent.

One request does happen before that, and it is fairer to name it than to let “nothing leaves” stand. On launch the app asks the stylist service for the current list of styles — the personas you can choose between — so that list can change without an App Store update. That request carries nothing about you or your wardrobe; it is the app asking what is on offer. Like any request to any server it arrives from your network address, which is handled as described below.

You can take back your agreement. Settings → Emma → What Emma can see → Turn Emma off withdraws it. From then on nothing new is sent to Emma until you read the disclosure and continue again: a request not yet sent is stopped, and one already sent may still bring back a reply, as a draft for you to review. It keeps your account, if you have one, and you can still sign in, sign out or delete it as “Accounts” and “Deleting your account” below describe; those steps send no wardrobe content. Your wardrobe, your looks and building looks yourself are not affected.

When you use a stylist feature, the app sends a request to the ClosetOS stylist service, which passes it to Anthropic for processing and returns the answer. There are four of those stylist requests, and this is what each one sends:

Feature	What is sent
Draft details for a piece	One Catalogue photograph of that piece, resized and re-encoded before sending. Nothing else.
Find the garments in a photo	One photograph, the same way.
Suggest looks	A short text summary of the pieces being considered — the app's own identifier for each one, plus its name, brand, category and subcategory, colours, material, fit, size, tags and seasons — the season you asked for, which pieces to include, exclude or build around, the pieces in each of your most recently saved looks so the same combination is not suggested again, and the direction you typed, if you typed one. Also the style you chose: one of ours is just which one, but a style you made yourself travels in full — its name, its description and the list of things you asked it to avoid — on every look it composes. And if you have turned down suggestions, a few of the reason categories you picked — "Wrong for the occasion", "It isn't my style", and the like — so the next suggestion can steer away from them. Not all of them: at most three, picked by weighing how often you chose each one against how long ago, counting only the style you are using, and only where that weight passes a threshold — so one rejection does not become a standing rule. Never a comment you wrote, and never the "Something else" option, which has no category behind it and is for that reason never sent. No photographs.
Create a style from your wardrobe	Aggregate figures only: how many pieces you have, and the most common colours, fits, materials, brands and kinds of piece across them. Those lists are built from your garments' own attributes, so where you typed a colour, a fit, a material or a brand yourself that word can appear in them — what is not sent is any photograph, any individual piece, and anything you wrote as prose or notes. Note that using the style afterwards sends its full text, as the row above says.

What is not sent to Emma or to our service

Photographs you keep as worn. A photograph you keep as worn is excluded in code, on every screen, and tests hold it there. No feature sends one today; if one ever does, it will ask you for each photograph, and this policy will change in the same release. Any other photograph is first checked on your phone for a person before Emma drafts from it or looks for garments in it, including the photograph of a piece you already have or one restored from a backup: if the check finds one, or cannot tell, it is not sent unless you confirm it is a catalogue photograph. The check can miss a person, so a photograph of yourself is safest kept as a worn photograph.
The private notes you write on a piece. They are not part of any request.
Your photo library. ClosetOS only ever reads photographs you pick.

What people expect to be private and is not

Much of what you type leaves this device — the table above covers the stylist requests, and the support form further down covers the other place it happens. This section adds nothing to either; it exists because three of those things are the ones people are most surprised by. Signing in, proving the app is genuine and deleting an account send things too, and the sections below describe them.

Worth being plain about the rest first: the words you type into a piece's own fields are sent too — its name, brand, material, colours, size, fit and tags all travel with a look request, as the table says. They are not in the list below because the list is about the places people do not expect it, not because they stay here.

The direction you type on the look-generation screen (“something for a cold evening, nothing formal”), sent with that request. Leave the field empty if you would rather it did not — the feature works without it.
A style you made yourself: its name, its description, and the list of things you asked it to avoid. The description begins as a summary written from your wardrobe and is yours to edit; the avoid list is yours from the start. All three are sent every time you generate a look with that style, not once when you create it. Choosing one of our styles instead sends only which one you picked.
A support message, if you write one, with the address you give — described in full under “If you write to support” below.

Your private notes on a piece are deliberately not in this list. They are never sent, as the section above says.

Accounts

You do not need an account to use ClosetOS. An account exists only to raise the limits on the stylist features.

Signing in uses Sign in with Apple. ClosetOS receives and stores the pseudonymous identifier Apple gives us for you (not your Apple ID), the private relay email address if Apple sends one, and a token that lets us revoke the sign-in on your behalf when you delete the account.

We never receive your Apple password, and we do not ask for your name.

What the stylist service stores

Your account row: the identifiers above, and when it was created.
Session tokens, stored only as hashes, so a breach of the database does not yield anything usable.
Counters: how many requests you have made against each feature in the current period.
Your subscription, if you buy one: the identifiers the App Store gives the purchase, which product it is, when it expires or was refunded, and whether it will renew. It comes signed by Apple, from the app when you buy or restore and from Apple when it changes, and it is how the service knows what you have paid for. We never receive your payment details. Deleting your account deletes this record; the subscription itself is Apple's, and only Apple can cancel it. If Apple reports on it again afterwards, the record that creates is tied to no account until someone restores the purchase.
Debugging copies, only for testers who turn them on. If your account is part of early testing and you turn on "Share my requests to Emma to help debug" in Settings → Emma, the text of each stylist request and the stylist's reply are kept for 14 days so a problem can be investigated. After that they can no longer be read, and they are deleted shortly afterwards. Photographs are never kept. It is off unless you turn it on; turning it off deletes what was kept at once, and so does leaving early testing or deleting your account.
A short-lived cache of a reply, so a request repeated after a dropped connection is not charged or re-processed twice. It contains the answer that was sent back — wardrobe content. It stops being readable 15 minutes after it is written, and is deleted by a sweep that runs every hour, so the row may sit unreadable for up to about an hour before it is removed.
A record of the app installation. Apple's App Attest gives each install a key, and its identifier, public key, Apple's attestation receipt and a last-seen timestamp are stored. This happens whenever the app proves it is genuine — the first stylist request, and also signing in and renewing a session — so it exists whether or not you have an account.
A link between that installation and your account, while a session lasts. A session row names both the account and the installation it was issued to, which is how a stolen token can be told apart from the device that earned it. Deleting your account deletes those session rows.
A fingerprint of the network address a request came from, used to count requests per address and refuse floods. The address itself is not stored: it is hashed with a secret held only in memory and regenerated every time the service restarts, and only that fingerprint and a count are kept.
Being accurate about how much that protects: it is pseudonymous, not anonymous. The fingerprint is deliberately stable while the service runs — it has to be, or repeat requests could not be counted — and the running service holds the secret, so somebody with both could test a guessed address against it. What it rules out is reading an address off the table, and it means a restart makes every earlier fingerprint meaningless. It does not mean we could not identify an address we already suspected.
Operational records of each request: which feature, whether it succeeded, how long it took, which model answered, what it cost, and the reference Anthropic gave for it. These carry no identifier for you — the table has no column for one.
Being accurate about what that does and does not mean. It is not a name on a row. But your account's counters are stamped with the time they were last changed, and these records are stamped with the time they were written, so we could line the two up and work out which record was yours. So: not anonymous, and not something a stranger with this table alone could attribute to you either.

The reference Anthropic gave is kept for support and debugging. We do not know whether it can be used to retrieve what was sent — that is Anthropic's to say, and we make no claim about it here.

Request logs deliberately contain no tokens, no keys and no prompt text.

Deleting your account

Settings → Emma → Delete your Emma account. This revokes the Sign in with Apple grant with Apple, takes you off the early-access list if you were on it, deletes your account row, your sessions, your counters and the record of any subscription, and purges the short-lived reply cache for your account. Deleting the account does not cancel a subscription: that is done in your Apple account's subscription settings.

About that early-access list: while the stylist is invitation-only we keep a list of the pseudonymous identifiers Apple gives us for the people invited. Deleting your account removes yours from it, and does so before the account itself goes. If that step fails, the deletion stops and the app tells you it did not finish, so trying again completes it rather than leaving the identifier behind. One consequence worth knowing: signing in again afterwards does not put you back on the list. We would have to invite you again.

That includes the case where the list itself has been damaged by a mistake on our side and our service cannot read the entries in it. Deletion stops there rather than go ahead and leave your entry inside the damaged list, and the damage is reported to us. Until we repair the list, a deletion keeps stopping at that step; once it is repaired, trying again completes it. Your account is not deleted in the meantime.

Deletion does not touch your wardrobe, which is on your phone and stays there. Some other things survive, and it is worth being plain about each.

Server logs. Our service writes a line for events like signing in and deleting an account, and those lines include the pseudonymous identifier for the account. They contain no wardrobe content, no photographs and nothing you typed — but they are written to our hosting provider's log store, which keeps them for 7 days on our current hosting plan, and never more than 30. Deleting your account does not reach back into them.
The operational records described above. They carry no identifier, so nothing in them names you — but deleting your account removes the counters whose timestamps were the way to line them up with you, which is what stops them being traced back afterwards rather than any property of the records themselves.
The installation record. The session rows that linked it to your account go, so nothing remaining connects it to you — but the row itself stays, and deleting the app does not remove it either: uninstalling destroys the key on the phone, and a reinstall simply attests as a new installation and writes a new row. What stops a reinstall claiming the free trial twice is Apple's own DeviceCheck, which is a per-device flag held by Apple rather than anything in this table.
Anthropic's copy of anything already processed, for the period described below.

Two honest limits: an access token already issued keeps working until it expires, at most 15 minutes; and the free trial is counted per device and does not return if you create a new account on the same phone.

Anthropic

Stylist requests are processed by Anthropic, acting for us. Anthropic does not use this content to train its models.

Anthropic keeps its own copy for a time. Under its standard API terms, inputs and outputs are retained for up to 30 days, and longer where it is required to investigate a policy violation or to meet a legal obligation: if Anthropic's safety systems flag a request as breaking its usage policy, that request and its reply may be kept for up to 2 years. That copy is Anthropic's, held under its own policy — so deleting your ClosetOS account removes what we hold and does not reach it. We say so here rather than leave "deleted your account" sounding more complete than it is.

Beta usage statistics

While ClosetOS is in testing, test builds — TestFlight, not the App Store version — send our service counts of how the app is used, so we can tell whether it works for people before anyone pays for it. You can turn this off in Settings → Test build → Share usage statistics; anything not yet sent is then discarded, though a batch already on its way still arrives.

What is sent, each with the time it happened on your phone:
- that the app was opened, at most once a day;
- that a piece was added, and how: by hand, by photograph, by import, or split from a photograph of several;
- the size of your wardrobe when it passes a few milestones, and which kinds of piece it has (tops, shoes and so on);
- for each look suggestion: how many pieces your wardrobe has and how many the suggestion considered, which kinds of piece it has, which kind of style was used, how many looks came back, how many were shown, how many repeated a look you already have, how long it took, and whether it failed or was cancelled;
- whether you kept, changed, turned down, skipped or undid each suggested look, and where it was in the list;
- when a free trial or allowance ran out, or a feature was not available to your account, and which feature (drafting a piece's details, finding pieces in a photograph, suggesting looks, or creating a style); and when our service refused a request, which feature and the code of the refusal.
Never a photograph, a garment's name, colour or any other detail, a note, or anything you type.
Under what identifier: a random one the app creates and keeps only in its own settings. It is not your Apple identifier, not your account, and not the installation record described above, and our service never links it to any of them. Deleting the app deletes it; deleting your account, or turning sharing off, replaces it with a new one, so nothing sent afterwards can be joined to what came before.
How long: 90 days from when each event happened, then it is deleted by a sweep that runs every hour. Statistics already sent under an identifier that has been replaced stay until then: they no longer connect to anything, which is why nothing finds them to delete sooner.
Who sees it: us. It is reported only in aggregate and is not shared with anyone. When the testing period ends, we stop collecting it and delete what is stored.

The beta waitlist

Boro is the new name for ClosetOS. Its home page has a form for joining the beta, which is described here in the same detail as everything else.

What is kept: the email address you give, the few words about your style if you typed any, and when you joined. The page also uses the same one-way fingerprint of your network address described above, for flood-counting; it is not stored with your address.
Why: to invite you to the beta, and for no other purpose. There is no newsletter, and the list is not shared with or sold to anyone.
How long: until you remove it, until Boro launches publicly, when the whole list is deleted, or 365 days after you joined, whichever comes first.
Removing it: the removal page deletes your address at once, at any time.

The page itself runs no script, loads nothing from any other company, and keeps no visit statistics. Like every request to our service, a visit leaves a request log line, described above.

Tracking

There is none. No advertising, no analytics SDK, no third-party trackers, no device fingerprinting, and no data sold or shared with anyone beyond what is described above. The beta usage statistics above are counts sent to our own service, not tracking: they are not linked to you or to other companies' data.

Children

ClosetOS is not directed at children under 13 and does not knowingly collect their data.

If you write to support

The support form is the one place ClosetOS collects anything you type that is not about your clothes, so it is described here in the same detail as everything else.

What is collected: the email address you give and the message you write — plus the same one-way fingerprint of the network address described above, for flood-counting. Nothing else: not your wardrobe, not which pieces you own, not whether you have an account.
Why: to answer you, and for no other purpose. It is not added to a mailing list and there is no mailing list to add it to.
Who handles it: the message is delivered by Resend, an email provider acting for us, to a private inbox. Resend processes it in order to deliver it.
How long: as long as the conversation is useful, in an ordinary email inbox. There is no support database.
Removing it: ask, in the message or afterwards, and the correspondence is deleted.

The form is not linked to your account and does not need one. An address is required, because without one there is no way to answer you — if you would rather not give one, the App Store listing's contact route is the alternative.

Contact

Support: closetos-gateway.onrender.com/support

Changes

If what leaves the device changes, this document and the in-app disclosure change with it, in the same release.