Privacy policy

1. Who we are

TryOn is an AI virtual try-on studio available at toolsifyfree.com. We are the data controller for the account information and images described below.

2. What we collect

• Account details — your email address, display name, an optional avatar URL and whether the address has been verified. If you sign in with Google we also store Google’s stable account identifier (sub), your name and profile picture.
• Credentials — passwords are stored only as a bcrypt hash with a per-user salt. We never store or log the plain text. Accounts created through Google have no password until you add one.
• Images you upload — the person photo and the garment photo. Both are re-encoded server-side into JPEG, which strips EXIF metadata including GPS coordinates, and the longest edge is limited to 1600 px.
• Generated previews — the resulting try-on image, plus a record of the job (status, provider, timestamps).
• Security data — the email verification codes you request (stored as a hash, discarded after use or expiry) and basic sign-in timestamps.

We do not run advertising or behavioural analytics, we do not build profiles, and we do not sell or rent your data.

3. How we use it

• To create and secure your account, verify your email and let you reset a forgotten password.
• To generate the virtual try-on preview you asked for.
• To show you your own history of previews and to let you delete it.
• To keep the service working, prevent abuse and diagnose failures.
• To review reports of prohibited generated content, decide what action to take, and keep a minimal record of the outcome — the category, date and result — so that repeat violations can be identified. We do not publish who reported a case.

Our legal bases are the performance of our contract with you (delivering the previews you request) and our legitimate interest in keeping the service secure. We do not use your images to train AI models.

4. Cookies and sign-in

We set one cookie, tryon_session. It is an httpOnly, same-site cookie holding a signed session token that tells the API who you are. There is no advertising or tracking cookie, and the token is never written to localStorage. Signing out deletes the cookie immediately. Because this cookie is strictly necessary, there is no consent banner to dismiss.

5. Who we share it with

• Google — when you choose “Continue with Google”, Google authenticates you and shares your email, name and profile picture with us. We request only openid, email and profile scopes.
• Resend — our email provider, which receives your email address solely to deliver verification codes.
• Our AI provider — when real generation is enabled, the person and garment images of that single job are transmitted to api.fashn.ai to produce the result. When the studio runs in sample mode, nothing leaves our server and the preview is clearly watermarked as a sample.
• Hosting — our own server holds the database and the image files. We do not use a third-party CDN for your uploads.

We may disclose data if we are legally required to, but we will never do it for marketing or resale.

6. Storage and retention

Account records live in our database and images are stored on our own server. Uploads are never exposed as public URLs: every image is served through an authenticated route that checks the session cookie and the owning account.

We keep your data for as long as your account exists. Deleting a preview removes both uploads and the result from disk. Deleting your account removes your profile, your OAuth link, every job and every image immediately — there is no soft-delete window.

7. Your choices and rights

• Access and correction — your profile, sign-in methods and preview count are visible in your account center, where you can edit your display name.
• Deletion — delete individual previews, wipe all previews, or delete the whole account from the account center. Account deletion requires a code emailed to your address.
• Portability and objection — write to us and we will export or erase the data we hold about you.

If you are in the EEA or the UK you also have the right to lodge a complaint with your local data protection authority.

8. Children

TryOn is not intended for children. You must be at least 13 years old to create an account, and at least 16 if you are in the European Economic Area. If we learn that a child has created an account we will delete it.

9. Changes

If this policy changes in a way that affects what we store, we will update the date at the top of this page and tell signed-in users by email before the change takes effect.

10. Contact

Questions, requests or complaints: support@toolsifyfree.com. We answer within 30 days.