Privacy Policy
Last updated 2026-09-15 · Operated by zyfit
This policy explains what zyfit collects when you use zyfit, why, and what you can do about it. It is written to meet the Digital Personal Data Protection Act, 2023 (India) and to be readable.
1. What we collect
| Data | Why | Kept |
|---|---|---|
| Email, display name, @username, password (hashed) | Your account and sign-in | Until you delete the account |
| Google account ID, name and email (Google sign-in only) | To sign you in without a password | Until you delete the account |
| Style preferences (gender you dress for, vibes) | To tune your feed — optional | Until changed or deleted |
| Photos you upload (face, full body) | To generate try-on images. Your saved "digital twin" is stored in your browser; each generation uploads the photo to our server and to our AI provider | Uploads: until the look or session using them is deleted, or your account is · Twin: on your device until you remove it |
| Generated images and looks | To show you your results; public feed if you publish | Until you delete them |
| Product links and the outfits you assemble | The core feature | Until you delete them or your account |
| Payment order and payment IDs, amount, pack | To credit your purchase and handle refunds. Card/UPI details go to Razorpay and never reach us | 7 years (tax law) |
| Your acceptance of these policies: version, time, IP address, browser | Evidence that you agreed to the Terms and the Refund Policy before paying | 7 years, with the payment it authorised |
| IP address, browser type, timestamps | Security, abuse prevention, rate limiting | Server logs, rotated; kept only as long as needed for security review |
| Likes, saves, tries, comments, reports, blocks | Social features and moderation | Until deleted |
2. Who else sees it
- AI provider (Google Gemini) — receives your photo and the product images for each generation. It is used only to produce your image.
- Razorpay — processes payments under its own privacy policy.
- Resend — delivers verification and password-reset emails.
- Google — if you sign in with Google.
- Other users — see your display name, @username and any look you publish. Your email and photos are never shown publicly.
- Hosting — our servers and database run on infrastructure we control, protected by TLS.
We do not sell personal data and do not use it for advertising.
3. Cookies & local storage
We do not use tracking cookies. Your browser's local storage holds your sign-in token, theme, and — if you saved one — your digital twin photos, so they never have to be uploaded again. Clearing site data removes all of it.
For our own product statistics we also keep a random identifier and where your first visit came from (the referring site's name and any campaign tag in the link — never the full address you came from). With it we count a few steps: arriving from a search engine, starting and finishing sign-up, starting and finishing a try-on, and saving a look. These counts stay on our servers, are never sold or shared with advertisers, and never include your photos, generated images, email or name. If your browser sends Do Not Track or Global Privacy Control, none of this is recorded.
4. Your rights
You can view and edit your name, @username and preferences in Profile → Account, remove your saved photos from Profile → My photo, and delete your looks from the feed. To access a copy of your data, correct it, or delete your account entirely (including uploads and payment records not required by law), contact us via our Contact page from your account address. We respond within 7 days and complete deletion within 30.
If you are not satisfied with our response you may complain to the Data Protection Board of India.
5. Children
The Service is for adults (18+). We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will remove it.
6. Security
Passwords are stored as bcrypt hashes. Sessions use signed tokens. Reset links are single-use and expire within an hour. Traffic is encrypted in transit. No system is perfectly secure; if we learn of a breach affecting you we will notify you and the authorities as the law requires.
7. Changes
We will update the date above and, for material changes, ask you to review the policy again when you next open the Service.
8. Grievance officer
zyfit