Privacy Policy

Effective date: 23 October 2026

This policy explains what personal data the Wardroby app (iOS and Android) and this website collect, why, and what rights you have. We keep it short and only collect what the app needs to work. Analytics and crash reports are only switched on if you allow them.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Sulaiman Khan
Marienstr. 10
89231 Neu-Ulm, Germany
Email: privacy@getwardroby.com

We are not required to appoint a data protection officer. For any privacy question, write to the address above.

2. Your account

To use Wardroby you create an account with your name, email address and a password. We use Firebase Authentication by Google for this. Your password is stored by Firebase only in hashed form; we never see it. Firebase also assigns a random user ID and, to protect accounts against abuse (for example many failed sign-in attempts), processes your IP address and technical sign-in data.

• Purpose: creating your account, signing you in, resetting your password, changing your password, deleting your account.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR); for abuse protection, our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

3. Your wardrobe

Everything you add to your wardrobe is stored in your account so you can see it after reinstalling the app or on another device:

• item details: name, category, brand, seasons, colour, notes, price, favourite flag and the date you added it;
• your own categories;
• photos of your items that you take with the camera or choose from your photo library.

The app accesses the camera or photo library only when you choose to add a photo, and only uploads the photo you pick. We do not analyse your photos (no face or image recognition). Please avoid photographing other people.

The data is stored with Google Cloud Firestore and Cloud Storage for Firebase, under your user ID, and is only accessible to your account.

• Purpose: providing your wardrobe and the statistics shown in the app.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

4. Usage analytics (only with your consent)

If you allow analytics, the app uses Google Analytics for Firebase to understand which features are used, so we can improve them. It records events such as screens viewed, signing in, adding or editing an item, and filters used, together with non-identifying details like the chosen category, colour preset or whether an item has a photo, brand or price.

We never send what you type (item names, brands, notes, your name or email) to analytics. Google Analytics also processes your pseudonymous user ID, an app instance ID, device model, operating system, app version, language and an approximate location (country or region) derived from your IP address. We do not use the advertising ID, Google Signals or any advertising features.

• Legal basis: your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG for access to your device).
• Retention: analytics event data is deleted automatically after 14 months.
• Withdrawal: switch off Usage analytics in Profile › Privacy at any time. This stops collection from then on; it does not affect processing before the withdrawal.

5. Crash reports (only with your consent)

If you allow crash reports, the app sends technical reports to Firebase Crashlytics when it crashes or an unexpected error occurs: the error and the code location, the steps the app went through just before (without your personal content), device model, operating system, app version, free memory and disk space, time of the crash, a random installation ID and your pseudonymous user ID.

• Legal basis: your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG).
• Retention: crash reports are deleted automatically after 90 days.
• Withdrawal: switch off Crash reports in Profile › Privacy at any time.

6. Data stored only on your device

The app saves your consent choice and your appearance setting (light or dark mode) on your device. This is necessary to respect your choice and is not sent to us (§ 25(2) No. 2 TDDDG; Art. 6(1)(c) and (f) GDPR). It is removed when you uninstall the app.

7. Service providers and where data is processed

We use Google Firebase, provided in the EU by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor under Google's data processing terms (Art. 28 GDPR).

Where data is transferred to Google LLC in the USA, the transfer is based on the EU–US Data Privacy Framework, under which Google LLC is certified (Art. 45 GDPR), and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

For this website and for emails to us we also use Cloudflare (see sections 10 and 11). We do not sell your data and do not share it with anyone else, unless we are legally required to.

8. How long we keep your data

We keep your account and wardrobe data for as long as you have an account. When you delete your account:

• your sign-in account is deleted immediately, and
• all your wardrobe data and photos are deleted automatically within minutes.

Our database keeps short-term recovery copies for up to 7 days, after which deleted data is gone for good. Analytics and crash data are kept only for the periods in sections 4 and 5.

You can delete your account in the app under Profile › Delete account. If you can no longer use the app, see Delete your account.

9. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have incorrect data corrected (Art. 16 GDPR) — you can edit your items in the app at any time;
• have your data deleted (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• receive your data in a common machine-readable format (Art. 20 GDPR);
• object to processing based on our legitimate interests (Art. 21 GDPR);
• withdraw your consent at any time with effect for the future (Art. 7(3) GDPR), in Profile › Privacy.

To exercise these rights, email privacy@getwardroby.com from the email address of your account. We will answer within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where the alleged infringement took place (Art. 77 GDPR).

10. This website

getwardroby.com is hosted with Cloudflare Workers by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as our processor (Art. 28 GDPR). When you visit it, Cloudflare processes your IP address, the page requested, date and time, browser and referrer to deliver the page and protect it against attacks (Art. 6(1)(f) GDPR). Cloudflare may process this data on servers worldwide, including the USA; Cloudflare, Inc. is certified under the EU–US Data Privacy Framework (Art. 45 GDPR), and its data processing addendum includes the EU Standard Contractual Clauses.

This website uses no cookies, no analytics, no external fonts and no tracking.

11. Contacting us by email

When you email us, we process your email address, your message and anything you include in it to answer you (Art. 6(1)(b) GDPR if it concerns your account, otherwise Art. 6(1)(f) GDPR). Emails to getwardroby.com addresses are forwarded by Cloudflare Email Routing to our mailbox hosted by Google. We delete emails once they are no longer needed, unless the law requires us to keep them.

12. Other information

• We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
• Providing your name and email is necessary to create an account; without them you cannot use the app. Everything else is optional.
• Wardroby is not directed at children under 16.

13. Changes to this policy

We will update this policy when the app or the law changes. The current version is always available at this address; if a change requires your consent, the app will ask you again.