Privacy notice
In short
- What we use. Your photo (full body or torso), your height and body measurements, and your skin-tone and hair-tone answers.
- What we use it for. Only to show outfits on you, check the fit and colour of the render, and style you on screen. We never use them for advertising, never sell or share them, and never use them to train AI models.
- Who processes it. To draw an outfit on your photo, we send your photo and the garment image to our virtual try-on provider, Google Asia Pacific Pte. Ltd., which processes them to create that render under Google Cloud's terms. The render is made outside Singapore, in the United States. For styling commentary we send an AI service only non-identifying details: your undertone, facial contrast, a height range, and garment details. It never receives your photo, measurements, name or email.
- How long we keep it. Your photo stays until you delete it. Turn on "Do not store my photo" and we delete your photo and its masks within 24 hours of your last try-on. Try-on results are deleted after 90 days.
- Your control. You can delete everything at any time in Settings → Privacy. Withdrawing consent deletes your data: removed from the app within 24 hours; disaster-recovery backups that still contain it are deleted within 14 days.
What this app does
Drape suggests what to wear in Singapore's heat and air-conditioning, and shows outfits on a photo of you.
What we collect and why
| What | Why | Where it lives |
|---|---|---|
| Email address (magic link) or Google account identifier | Sign-in and account authentication | Supabase Auth |
| Photo (full body or torso) | Virtual fitting room try-on, and an automatic check on our own servers that the photo is suitable (nobody looks at it and it is not sent to anyone for this) | Private storage bucket (encrypted at rest, short-lived signed URLs only) |
| Masks and pose landmarks derived from your photo | Try-on garment compositing and fit QA | Private storage bucket and database |
| Height, weight, body measurements, fit preference, skin tone, hair tone, and derived facial contrast | Tailoring fit rules, trans-thermal colour styling, and size suggestions for ready-to-wear garments (worked out on our own servers from the garment's published measurements; never sent to a retailer or a sizing service) | Our database |
| Selected weather area (one of 47 Singapore NEA areas) | Resolving live micro-climate conditions | Our database |
| Garments you save | Your saved list and the Fitting Room's rack | Our database (never shared with a retailer) |
| Price-tag codes you scan or type | To find that item in our catalogue. Only the code is sent; the camera picture is read on your phone or in your browser and never leaves it | Used for the lookup and not kept: we do not store the code or log it with your account |
| Try-on renders and automated quality metrics | Displaying your results; automated quality assurance | Private storage bucket and database |
| Usage events (recommendation views, garment views, vendor out-link clicks, try-on downloads, and whether a scanned tag was found, with the item when it was) | Measuring recommendation performance and merchant out-links | Our database (linked to your account; permanently deleted upon account purge) |
| Size feedback you choose to give (the size you wore and how it fit) | Measuring how often our size suggestions are right. It never changes your suggestions automatically | Our database (linked to your account; permanently deleted upon account purge) |
What we do not collect
- Your device coordinates: If you grant coarse location permission, your phone resolves coordinates to the nearest of the 47 NEA area centers locally on-device. Exact GPS coordinates are never sent to our servers or stored.
- Device identifiers: No contacts, ad IDs (IDFA/GAID), tracking cookies, or cross-app analytics are collected.
- Camera pictures when you scan a tag: the barcode is read on your phone (or in your browser). The picture is never uploaded, stored or sent to anyone; only the code it contains is sent to look the item up.
Who else handles your data
- Virtual try-on provider (Google Asia Pacific Pte. Ltd.): Receives the portrait photo and garment image to create the try-on render, under Google Cloud's terms. The render is made in Google Cloud's United States region, so the photo and garment image are transferred outside Singapore for that purpose only.
- Stylist AI service (Google Gemini API, free tier): Receives strictly non-identifying styling context: skin undertone, facial contrast, height band (
short,average,tall), venue/transit parameters, and garment attributes. It never receives your photo, raw measurements, full name, or email. On the free tier, Google may process submitted prompt context according to its developer terms; an upgrade to the paid enterprise tier is planned before commercial scale. - On-device stylist (optional, PRD FR-2.8): if you turn on Write stylist notes on this phone, the outfit notes are written by a small open-weights model running on your phone. Nothing about those requests leaves your device, and no one, including us, receives them. The model is a file you download from us once; it carries its own licence notice and is deleted when you turn the setting off.
- Infrastructure providers:
- Supabase (Singapore,
ap-southeast-1): authentication, the database, and private storage for your photo and try-on results. - Our servers (hosted in Singapore): run our API and background workers. Your requests, photo and measurements pass through them while we serve and process them.
- Cloudflare: hosts the web app and serves the public on-device model file for download. It handles ordinary web request data (such as your IP address and the browser or app version), and it never receives your photo, measurements, account details or try-on results.
- Supabase (Singapore,
- We do not sell your personal data or provide it to third parties for advertising or independent model training.
How long we keep your data
| Category | Retention Period |
|---|---|
| Photo and derived masks | Kept until you replace them or delete your account. With "Do not store my photo" enabled: deleted within 24 hours of your last try-on. |
| Try-on results | Automatically deleted after 90 days. |
| Account, measurements, tone preferences and saved garments | Kept for the life of your account; deleted within 24 hours of account deletion. |
| Unfinished or temporary uploads | Deleted within 24 hours by automated cleanup. |
| Database disaster-recovery backups | Retained for 14 days on a rolling daily cycle for business continuity. Accounts deleted from the live service are purged within 24 hours and completely rotate out of historical backups within 14 days. |
Your choices and rights under Singapore PDPA
- Full deletion ("Delete my account & data"): Go to Settings → Privacy → Delete my account & data. We immediately deactivate your account, and our automated maintenance pipeline permanently deletes all database records and storage files across private buckets within 24 hours; disaster-recovery backups rotate out within 14 days.
- Retention preference: You can toggle "Do not store my photo" at any time in Settings → Privacy.
- Access and correction: To request a copy of your personal data or submit a correction, contact our data protection contact at ben@evecount.com.
- Withdrawing consent: Deleting your data or deactivating your account withdraws consent under the PDPA.
Security & Local Storage
- Portraits and try-on results are stored in private S3-compatible buckets with encryption at rest and accessed solely via time-limited signed URLs (presigned PUT: 15 min; presigned GET: 60 min for portraits, 7 days for results).
- Auth tokens on native mobile are held in device SecureStore (
expo-secure-store). - Android cloud backup and device-to-device transfers are strictly disabled (
allowBackup="false"and data-extraction rules).
Age Attestation
Drape is restricted to users aged 18 and older.
Contact
Cybrdeck / Eve Count (UEN 53438315K), Singapore · Data protection contact: Benjamin Lim, ben@evecount.com · 11 New Punggol Rd, Singapore
Last updated: 2026-10-31 · Consent version: 2026-11