Privacy Policy
Aggregate visit statistics
To understand this website’s audience, the server counts public page requests, including reloads, and groups totals by day, page and broad traffic source. Administration, prefetches and known bots are excluded. The counter does not need cookies or identifiers on your device and works even if you decline Google Analytics.
We also estimate each day’s unique visitors. The connection IP address and browser family are temporarily processed on the server using a key that changes every day. The statistics database stores no IP addresses, full browser agents, individual identifiers or visitor list: it retains only counters and an aggregate statistical structure. We do not link visits across days. Sharing a connection and browser can group people, while changing them can produce duplicates; this is not a count of identified people.
We also count daily acceptances and rejections of the Google Analytics notice in aggregate, without linking them to individual visits or accounts. Changing a decision can count in both options. The sole purpose is to measure Trikapp’s audience. These statistics are kept on the website server for 180 days, are not sent to Google and are not combined with accounts, beta signups or other sources. These counters do not store searches, arbitrary URL parameters or form content. For privacy questions, contact privacidad@trikapp.es.
When browser exclusion is requested from administration, the functional cookie trikapp-traffic-excluded is saved for 180 days with the sole value 1. It only remembers that preference: it does not identify visitors, grant admin access or get sent to Google. It excludes that browser and its Analytics decisions on both trikapp.es and www.trikapp.es.
Analytics on this website
If you accept analytics, we use Google Analytics through Firebase to measure public page visits, traffic sources, technical browser data and completed beta requests. This uses pseudonymous identifiers and cookies; the data are not completely anonymous. We do not send the form email address or Trikapp account identifiers to Analytics. Administration and private content are excluded.
The basis is your consent. Before acceptance, or if you decline, we do not load the Google tag or send events to Google Analytics. You can withdraw permission through Cookie settings; Google measurement stops and the Analytics cookies accessible to this website are deleted. Withdrawal does not itself delete data Google has already processed.
The _ga and _ga_* cookies are configured to last no more than 30 days. Your choice is saved in browser local storage under trikapp-web-analytics-v1 for 180 days. You can keep browsing and request beta access if you decline analytics.
Google provides the service and may process data on its international infrastructure. Event data retention depends on the Analytics property settings. To ask about those settings or exercise your rights, contact privacidad@trikapp.es.
Beta registration
If you sign up on the website, we store your email, chosen platform (Android, iPhone or both), language, request dates and notice version. We use these details only to manage your participation and send the invitation and instructions for your chosen platforms as access to each test becomes available. The basis is the consent you give by requesting the invitation; this does not subscribe you to advertising or create a Trikapp account.
Requests are stored with restricted access on the website server. They are deleted if you withdraw your request and, in any event, 180 days after your latest registration. To request access, correction or deletion, or to withdraw consent, contact privacidad@trikapp.es.
We use Resend (Plus Five Five, Inc.) to send invitations. It receives your email address and the message content, including instructions for your chosen language and platform. We store sending status, dates and the provider’s message ID to prevent duplicates and handle issues. We do not enable open or click tracking. Resend may process data in the United States and provides standard contractual clauses for international transfers in its data processing agreement. Local sending records are deleted with your request; data processed by the provider is governed by that agreement.
To manage access to testing, on Android we use the email you provide to check and manage membership of the Google Workspace test group. If you choose iPhone, we provide that email to Apple to create and manage a personal TestFlight invitation. Apple sends its own invitation, in addition to Trikapp’s instructions. You do not need to give us your password or Apple ID. We record the administrative actions needed to manage invitations and removals; local records are deleted with your request.
To verify that the beta works, restricted administration can view invitation delivery and rejection states and the session, crash and feedback metrics Apple provides for identified testers. If we verify the link to your Trikapp account, we can show counts per profile (garments, outfits, posts, diary entries and other features) and PRO access status. This panel does not show photos, text or body attributes from your private content. The link is verified explicitly: your signup email may differ from your account email. These checks do not create browsing tracking or identify anonymous TestFlight signups. Local copies and history are deleted with the request.
1. Data controller
The data controller for the Trikapp service is Trikapp. For any question about your personal data, contact us through the channels listed at the end of this policy.
You can contact us at any time at privacidad@trikapp.es.
2. What data we collect
2.1 Data you provide directly
- User account: email address, username, display name and profile picture.
- Wardrobe content: photographs of clothing items you upload and the metadata you add (name, brand, description).
- Outfits: private clothing combinations you create and organise in your closets. They are always private.
- Posts: when you choose to share an outfit, you can create a post with a photo of the outfit being worn, descriptive text, hashtags and choose its audience (only me, followers or everyone).
- Social interactions: profiles you follow, content you like or save as favorites.
- Communications: messages you send us via support email.
2.2 Automatically generated data
- Profile photo review: Before uploading a new photo, we request specific permission to store it in Google Cloud Storage and send a copy to Google Vertex AI (Gemini) to check for inappropriate content. Only the image is sent for this review, without wardrobe data or preferences. This permission is separate from automated wardrobe processing and community contribution; it does not enable either permission. You can continue without a photo or reuse a previously approved photo without another analysis.
- Automated analysis: If you allow automated processing, we send Google Vertex AI (Gemini and embedding models) the garment or outfit photos, wardrobe attributes, preferences and search text or requests needed for classification and results. We show this information and record your decision before the first transfer. You can withdraw permission in Settings; manual wardrobe features remain available and operations already started may finish.
- One-off digitization: Even with general AI permission disabled, you can authorize a specific digitization before uploading its photos. This authorization covers only that garment’s front and back photos: review and analysis with Google Vertex AI (Gemini) and background removal in Google Cloud. We record the date, disclosure version and authorization purpose, without photos or text in that record. It does not enable recommendations, AI searches or community contribution. The authorization also covers creating and maintaining search indexes (embeddings) for that garment from the details you review and save; it does not index the rest of your wardrobe. You can withdraw these permissions in Settings. The indexing record also stores the garment identifier. Later digitizations ask again. You can also enable general permission from the same dialog and withdraw it in Settings.
- One-off ideas and outfit permission: You may also authorize an idea, outfit compatibility analysis, a completion suggestion or its name and description while keeping general AI off. The notice explains the necessary data sent to Google Vertex AI. Idea permission is tied to your profile and that idea and covers its results and alternatives for 30 minutes; another idea or action requires separate authorization. It does not enable community contribution or background AI jobs. We record purpose, version and date and, for an idea, its identifier and expiry. You may enable general AI from the same notice and withdraw it in Settings.
- One-off post photo analysis: You may authorize analysis of the 1–4 selected photos before uploading them to Google Cloud Storage. Google Vertex AI (Gemini) receives these photos and the necessary associated outfit data to moderate them, check consistency and suggest views, a name, description, tags and occasion. You can edit the suggestions before confirming publication. Permission covers that analysis and creating and maintaining search indexes (embeddings) for the saved post and its composition. It does not index the original outfit or wardrobe or enable general AI or community contribution. You can withdraw these permissions in Settings; existing content and indexes remain until you delete the content. We record its purpose, version, date and, for indexing, the post identifier. Another analysis needs fresh permission; you may also enable general AI from the notice.
- Semantic embeddings: Numerical representations of garments, outfits, posts or preferences used for search and recommendations. They are linked to your resources and profile within our service and are treated as personal data associated with your account.
- Community recommendations: This is a separate option, initially disabled. If you enable it in Settings and keep processing permission, we use outfit attributes to produce aggregate statistics with a minimum number of distinct contributors. Results do not expose individual garments, outfits or identities. You can disable it at any time.
2.3 Technical and usage data
- Device data: model, operating system, app version, Firebase installation identifier.
- Usage analytics: screens visited, features used, session duration. This data is collected in aggregate form through Firebase Analytics / Google Analytics 4.
- Crash reports: Firebase Crashlytics receives stack traces, device information, installation and profile identifiers. Firebase Analytics records activity and may link it to your profile identifier. These data help diagnose problems and measure usage; they are not completely anonymous. Firebase Performance Monitoring collects response times and technical request data.
2.4 Subscription data
Apple or Google Play handles payment. We do not store card details. RevenueCat receives the stable account identifier, products, transactions and purchase history, dates, renewal status and access entitlements to verify subscriptions and restore purchases.
3. How we use your data
| Purpose | Legal basis (GDPR) |
|---|---|
| Manage your account and authentication | Performance of contract (Art. 6.1.b) |
| Provide the digital wardrobe, outfits and social network service | Performance of contract (Art. 6.1.b) |
| Analyze garments and generate automatic classifications | Consent (Art. 6.1.a) |
| Review new profile photos for inappropriate content | Specific consent (Art. 6.1.a) |
| Generate personalized outfit suggestions | Consent (Art. 6.1.a) |
| Display your posts to your chosen audience in the social feed | Performance of contract (Art. 6.1.b) |
| Manage premium subscriptions | Performance of contract (Art. 6.1.b) |
| Improve the app through aggregate analytics | Legitimate interest (Art. 6.1.f) |
| Detect and fix technical errors | Legitimate interest (Art. 6.1.f) |
| Prevent fraud and abuse | Legitimate interest (Art. 6.1.f) |
| Service communications (important changes, security) | Performance of contract (Art. 6.1.b) |
4. Who we share your data with
We do not sell your data to third parties or share it for advertising purposes. We only share information with the providers strictly necessary to deliver the service:
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud Platform (Cloud Run, Cloud Storage) | Hosting, image storage, database | EU (europe-west1) |
| Firebase (Google) | Authentication, analytics, crash reporting | Authentication in the US; analytics and diagnostics on Google global infrastructure |
| Vertex AI / Gemini (Google) | Automated clothing analysis, embedding generation and review of new profile photos | European endpoints configured for Gemini and embeddings |
| RevenueCat | In-app subscription management | USA |
Providers publish their data processing terms and safeguards for international transfers. You can request details of the agreements and services used from our privacy contact.
5. International transfers
Our main servers are located in the European Union (Google Cloud region europe-west1, Belgium). Some third-party services may process data in the United States under the safeguards of the EU-US Data Privacy Framework or Standard Contractual Clauses of the European Commission.
6. How long we keep your data
| Data type | Retention period |
|---|---|
| Account and profile | While your account is active |
| Approved profile photos and review records | We retain approved photos, the review date and the permission and review policy versions so you can reuse the photos. Removing the current photo keeps this history; permanent profile or account deletion removes it. The temporary copy of a new upload is deleted when the review ends, including on rejection or error. |
| Clothes, outfits, posts | While your account is active. If deleted, moved to trash for 30 days then permanently removed. |
| Analytics data | As configured in the Google Analytics property; contact privacy for the applicable retention period |
| Crash reports | 90 days before removal from the provider’s live and backup systems begins |
| Subscription data | While the account or subscription is active; account deletion requests removal of its RevenueCat record. Apple and Google retain purchase records under their own terms. |
Confirming Delete account immediately blocks access and records a permanent request with no recovery period. The process removes profiles, content, images and our subscription provider record. A temporary, non-reversible technical identifier prevents an old session from restoring the account. Provider records and backups have their own retention periods: Firebase states that authentication data is removed from live and backup systems within 180 days after a deletion request. Cancel subscriptions in the store to prevent renewals.
7. Your rights
Under the GDPR, you have the following rights:
- Access: request a copy of your personal data.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request deletion of your data ("right to be forgotten").
- Restriction: restrict processing in certain circumstances.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interest.
- Withdraw consent: at any time, without retroactive effect.
To exercise any of these rights, send an email to privacidad@trikapp.es specifying your username and the right you wish to exercise. We will respond within a maximum of 30 days.
If you believe we have not adequately addressed your request, you may file a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.
8. Security
- All communications are encrypted via HTTPS/TLS.
- Images are stored in Google Cloud Storage with restricted access via signed URLs with expiry.
- Authentication is managed through Firebase Auth (JWT tokens).
- Data is stored in monitored databases with restricted access.
- We perform periodic security and dependency reviews.
9. Children's privacy
Trikapp is not directed at children under 13. We do not knowingly collect data from children under this age. If we discover we have collected data from a child under 13, we will delete it immediately. If you are a parent or guardian and believe your child has provided us with personal data, contact us at privacidad@trikapp.es.
10. Your privacy and control over your content
You decide who can access your content. Your garments, wardrobes, outfits and diary are not public. Wardrobes can only be shared in private circles through explicit permissions that you can revoke at any time. Only posts can be made public; for each one you choose Only me (private draft), Followers or Everyone. Creating a post does not change access permissions to your wardrobe or publish your original outfits.
11. Automated analysis and decisions
For garment classification and wardrobe recommendations:
- Analysis is performed exclusively to improve your app experience (auto-classification, suggestions, search).
- It has no legal effects nor significantly affects you in any similar way.
- You can edit or delete any automatically generated classification at any time.
- Images are processed on Google Cloud servers in the EU and are not used to train third-party models.
12. Changes to this policy
We may update this privacy policy periodically. If we make material changes, we will notify you through the app or by email before the changes take effect. The "last updated" date at the top of this page indicates when it was last modified.
13. Contact
- Email: privacidad@trikapp.es
- Service: Trikapp