Your wardrobe. Your choices.

The short version

Wardrobe keeps your working closet on your device. There is no email account and no sync. In the separate friends-and-family beta, you can choose hosted encrypted backup, optional Wardrobe diagnostics, and feedback you review before sending.

We do not use your photographs to train models. Backup is separate from feedback and diagnostics. Apple TestFlight also collects its own crash and usage information automatically; our diagnostics switch does not control Apple’s collection.

• Encrypted backup — only when you ask. Encryption happens on your device; your recovery key is not sent to us.
• Diagnostics during the beta — crash and error reports, off until you turn them on. They carry no garment data and no photographs.
• Feedback you write and send — only when you type it and tap send.

Platform services

On Android, the optional cutout tool is built on a Google component, and turning it on brings Google’s own diagnostics with it. That is described in full further down.

We have never sold data, and there is no advertising component, no attribution component, and no third-party analytics component in Wardrobe on either platform.

What Wardrobe stores, and where

Everything you put into Wardrobe — garments, photographs, outfits, wear history, trips, packing lists, loans, notes — is written to private storage on your own device. On both platforms that is app-private storage other apps cannot read.

Your working wardrobe stays local. A beta build with Backup & recovery can upload an encrypted copy after you create and save a recovery key and choose to back up. An ordinary build does not activate the beta diagnostics collector.

This is true regardless of the diagnostics setting below. Turning diagnostics on does not send us your closet; it sends us crash reports.

Hosted encrypted backup in the beta

Backup is off until you choose it. Wardrobe encrypts a complete copy of your database, photographs and saved work on your device before uploading it to a separate Kettle & Haven service. Diagnostics consent cannot turn backup on.

You keep a randomly generated recovery key. That key is never sent to the server. We store encrypted bytes, a random vault identifier, an authentication check, file sizes and upload times. We do not have the key needed to read the backup and do not use your images for training.

Save the recovery key outside the app, preferably in a password manager. Anyone with that key can recover or delete your backup. If you lose the device and the key, we cannot reset it or recover the closet for you. Never include the key in feedback or support messages.

We retain the latest two completed backups, up to two GiB each, for one hundred eighty days after your last successful upload. The app confirms a backup only after the server accepts it. Failed or oversized uploads do not replace a completed backup. Recovery verifies the encrypted archive before restoring into an empty closet.

Use Delete hosted backups in Backup & recovery to remove both hosted versions. Deleting the app or a garment does not delete an older backup. The recovery key is not an email account, and backup is not live sync. This beta service runs on one host; encryption alone does not protect against every outage or loss of that host.

Your operating system may separately include local app data in its own device backup. Apple’s protection depends on your iCloud settings, including Advanced Data Protection. Those system backups are separate from Wardrobe’s hosted recovery service.

Apple TestFlight collection

If you install the beta through TestFlight, Apple automatically collects crash logs and usage information and shares it with us. TestFlight does not offer an opt-out for that collection. Wardrobe’s diagnostics switch controls only our additional reports.

Feedback or screenshots you submit through TestFlight go to Apple and the developer under Apple’s TestFlight terms. The in-app feedback form is a separate channel and does not attach screenshots or wardrobe data. Review Apple’s current TestFlight privacy information before accepting an invitation.

Apple’s TestFlight privacy information

Diagnostics during the beta (optional, off by default)

The separate friends-and-family beta offers Wardrobe diagnostics to help us understand failures. These reports are separate from the crash and usage reporting built into Apple TestFlight.

Wardrobe asks once, and the answer is no until you say otherwise. You can change it at any time in Settings, and the app works fully either way.

Two things follow from “off by default”, and we build them rather than merely promise them.

• Nothing is recorded before you say yes. The app does not quietly keep reports on your phone while it waits to ask. Recording starts when you turn it on; there is no backlog that gets sent later.
• Turning it off does not send one last report. Anything still waiting to be sent is deleted from your phone instead of transmitted, and that happens whether or not you are online at the time.

What a diagnostic report contains

Everything, exhaustively:

• A random installation ID.
• The app version.
• The platform and major operating-system version.
• A rough device capability tier: low, mid or high.
• The time, rounded to the minute.
• Which of five events occurred: a crash, an error, a screen reached, a capture failure, or a change to this setting.
• For a crash: where in our own code it happened — a file name and a line number from Wardrobe itself.
• For an error or a capture failure: a category, such as storage or io_failure.

About that installation ID

The installation ID is random and generated on your device. It is not your advertising ID, your device ID, your phone number, or anything derived from them. It lets us tell “one tester hit this crash forty times” from “forty testers each hit it once”.

It is not anonymous — it is pseudonymous, and we would rather say so plainly than claim more than the design delivers.

What a diagnostic report never contains

Garment names, photographs, image data, brands, notes, outfits, trips, destinations, calendar entries, file names, file paths, your location, your contacts, your IP address as stored data, or any text you have written.

This is not only a promise about our intentions. Our server refuses a report that carries a field outside the list above, rather than accepting it and discarding the extra — so if a future version of the app ever tried to send more, the report would fail rather than quietly succeed. The app will not build one either: the values it can put in a crash report are the only values it can represent.

Crash reports name lines in Wardrobe’s own code only. Error messages are never sent, because an error message can quote a file name, and a file name can be a garment name.

How long we keep it

Ninety days, and then it is deleted without anyone having to ask.

If you turn diagnostics off, collection stops immediately and we delete what was already collected for your installation. You do not have to write to us; the app issues the deletion itself.

Where it goes

To a server we run ourselves, at Kettle & Haven LLC, over an encrypted connection. It is not shared with anyone, not sold, and not used for advertising. No third-party analytics company is involved at any point.

Feedback you send

If you write us feedback from inside the app, that submission carries what you typed, the app version, and — only if you have diagnostics turned on — the same random installation ID.

It also carries four structural fields: which platform you are on, the schema version, the minute you sent it, and a one-off random ID for that one message, which exists so a retry does not become a duplicate and is never reused. No screenshot, no log file, and no garment data is attached.

With diagnostics off, your feedback carries no persistent identifier. The one-off message ID is still there and it points to nothing else you have ever sent, which is the point. The honest cost: we then have no way to find it if you later ask us to delete it, because nothing in it points to you. If that matters to you, say so in the message and we will search for it by hand.

The app shows you the exact payload before you tap send, so the list here and the thing on your screen have to agree. Because the message is yours to write, please leave out anything you would not want us to read.

Feedback is kept on the same ninety-day schedule. Feedback carrying your installation ID is deleted along with everything else when you turn diagnostics off; unlinked feedback is deleted when its ninety days are up.

The optional cutout tool (Android)

Wardrobe can cut a garment out of its background so it sits on a clean tile. On Android that feature is built on Google ML Kit subject segmentation, which ships as part of Google Play services rather than inside Wardrobe.

This is a separate decision from the diagnostics setting above. Agreeing to one does not agree to the other. The feature does not exist in the iPhone version, which contains no ML Kit.

• It is off until you turn it on. Wardrobe asks first, and the dialog says what turning it on means before you agree. Photographing garments works without it.
• Cutout processing runs on the phone and does not upload your photographs to Google. Choosing hosted backup is a separate action that uploads an encrypted archive to Kettle & Haven.
• Google’s component does talk to Google. Enabling it lets Play services download the segmentation model, and Google’s component reports its own usage and performance diagnostics, including device, app and installation identifiers. That data goes to Google under Google’s terms, not to us — we never receive it and cannot see it. Google documents what it collects at developers.google.com/ml-kit/android-data-disclosure.
• You can decline and keep using the app. Declining costs you the cutout, nothing else.

Today’s weather (optional)

Today can show a forecast for a place you choose. It is off until you add a place, and the rest of Wardrobe works the same without it.

• You can type a city. Your phone’s own place search turns it into a map position: Apple’s on iPhone, and the Android system’s on Android (usually Google’s). No other place-search service is used.
• Or you can tap “Use my approximate location”. Wardrobe asks for approximate location only at that moment, only while the app is open, and never asks for precise location. Typing a city needs no location access at all.
• Either way, the position is rounded to about 1 km before it is saved on your device or sent anywhere.
• To get the forecast, Wardrobe sends that rounded position straight from your phone to the US National Weather Service (api.weather.gov), a US government service. The request carries no account, installation ID or name. Like any web server, the Weather Service sees your IP address; its handling is governed by its own policies, not ours. We do not receive or store the position or the forecast on any server of ours.
• The forecast is kept on your device until the Weather Service says it is out of date, and replaced when it is refreshed. “Forget place” removes the place and its forecast from the device.
• The Weather Service covers the United States and its territories. For a place outside it, Wardrobe says so rather than showing a forecast.

Permissions

On Android: camera, to photograph garments, and only while you are on the camera screen; internet, for an encrypted backup or recovery you request, optional diagnostics, feedback you choose to send, and the weather forecast; and approximate location, asked only if you tap “Use my approximate location” on the weather card.

Installing the optional cutout tool causes Google Play services to add its own permissions to the app — network state, wake lock, boot-completed and foreground service. Those belong to Google’s component, not to Wardrobe’s own code. We list them because they are visible on your device’s app-info screen, and you deserve to know why they are there rather than find them and wonder.

On iPhone: camera, to photograph garments; the photo library, for the photos you pick when importing a garment; and location while using the app, approximate by default, asked only if you tap “Use my approximate location” on the weather card. Wardrobe does not browse or index your library.

What Wardrobe does not do

Stated explicitly, because absence is hard to prove by reading a policy:

• No cloud sync. Hosted backup is an explicit action in the beta; it does not upload every edit or connect your wardrobe across devices.
• No advertising, no ad identifiers, no attribution or install-referrer tracking.
• No selling or sharing of personal information.
• No profile of you, and no use of your data to train a model.

Children

Wardrobe is not directed at children. During the beta, diagnostics are off by default and are enabled only by the person using the device.

Deleting your data

There is no email account to delete. Deleting individual garments removes them in the app. To remove hosted copies, use Delete hosted backups before uninstalling. Device backups managed by Apple or your operating system have separate deletion controls.

For diagnostics and feedback, turning diagnostics off in Settings deletes what we hold for your installation. You can also write to hello@kettleandhaven.com and we will delete it; tell us the installation ID shown in Settings so we can find it.

Who is responsible

Kettle & Haven LLC, a Colorado limited liability company, publishes Wardrobe and is responsible for the data practices described here.

Changes

If this policy changes in a way that affects what leaves your device, the change will be described here with a new date rather than quietly replaced.