Privacy Policy
Last updated: [date]
Languages: this draft is in English only. [Add the German version before launch; the app and the vote page speak EN and DE.] Vorerst nur auf Englisch.
Before Going Out helps you decide what to wear before you go out: you take a photo of your outfit, get an instant AI verdict for the occasion and the weather, and can ask friends to vote by a private link. This policy explains what data we process, why, for how long, and what rights you have. We wrote it to be read, not skimmed past.
1. Who is responsible
The controller is [company name, legal form, address, country]. Contact for privacy questions: hello@beforegoingout.com. [EU representative under Art. 27 GDPR, if the company is outside the EU]
2. The short version
- Adults only (18+). We ask for your birth year once to confirm this.
- No public feed, no profiles, no comments. Friends can only vote and pick a preset reaction.
- Photos are deleted automatically: check photos after 7 days, vote photos 24 hours after the vote ends. Only a tiny blurred thumbnail is kept in your history.
- We judge clothes, never people. The AI looks at garments, colours, fit and the occasion — never bodies, faces or attractiveness.
- We don't sell your data and don't use it for advertising.
- You can delete everything in the app: Settings → Account and data → Delete my account and data.
3. What we store and why
| Data | Why | How long |
|---|---|---|
| Anonymous account id (and, if you link it, your Apple or Google sign-in) | To keep your checks, votes and subscription together | Until you delete your account |
| Birth year, country, language, style preferences, time zone, reminder settings | Age check (18+), language and local context of verdicts, reminders | Until you delete your account |
| Outfit photos you check | To create the verdict | Deleted after 7 days |
| Tiny blurred thumbnail of each check | So your history is recognisable | Until you delete the account |
| Verdict text, occasion, weather choice | Your history and streak | Until you delete the account |
| Photos copied for a friend vote, the question, the vote results | To run the vote | Photos deleted 24 hours after the vote ends; results until you delete the account |
| Votes from friends: chosen option, optional preset reaction, optional first name | To show you the results and who voted | Until the poll owner deletes their account |
| Approximate location (rounded to about 10 km), only if you allow it | To look up today's weather | Not stored |
| Push notification tokens | To tell you when friends voted | Until you sign out or delete the account |
| Subscription status (from the App Store / Google Play via RevenueCat) | To unlock Pro features | Until you delete the account; billing records as required by law |
| Usage records of AI calls (token counts, cost, timing — no photos) | Cost control and fair-use limits | [e.g. 13 months] |
| Reports about a vote (reason only, plus a salted hash of the reporter) | Moderation | [e.g. 12 months] |
| Analytics and crash reports | To improve the app | On by default; switch off anytime in Settings → Anonymous usage stats. No advertising ID; [retention] |
Friends who vote in the browser
The vote page works without an account. To allow only one vote per device and to stop abuse, the page creates an anonymous sign-in in your browser and keeps a random device id in a first-party cookie (dv, 1 year) and in local storage. On our servers we store only salted hashes of that device id and of IP addresses (for rate limits) — never the raw values. If you add your first name, the person who asked sees it next to your vote. Bot protection on the vote page uses Google reCAPTCHA Enterprise (Firebase App Check), which may set its own cookies and is subject to Google's privacy policy.
4. How the AI check works
Photos are resized on your phone (max. 1024 px, location metadata removed) and sent to our servers in the EU, which forward them to our AI provider for the verdict. [Confirm the AI provider's commercial terms: no training on customer content, retention period, transfer safeguards.] If a photo shows nudity, underwear or swimwear as the outfit, or a person who appears to be under 18, it is not analysed and is deleted immediately.
5. Who processes data for us
- Google Firebase / Google Cloud (hosting, database, file storage, sign-in, notifications, App Check) — servers in the EU region (europe-west1, eur3).
- Anthropic (AI analysis of outfit photos).
- RevenueCat, Apple and Google (subscriptions and payments — we never see card details).
- MET Norway or Open-Meteo (weather; they receive only rounded coordinates from our server, not from your phone).
Where data leaves the EU/EEA or Switzerland, we rely on adequacy decisions or the EU Standard Contractual Clauses. [List the transfer mechanisms per processor.]
6. Legal bases
We process data to provide the service you asked for (Art. 6(1)(b) GDPR), for our legitimate interest in security, abuse prevention and cost control (Art. 6(1)(f) GDPR), and with your consent for analytics, crash reports, location and notifications (Art. 6(1)(a) GDPR), which you can withdraw at any time in the app settings.
7. Your rights (GDPR and Swiss FADP)
You have the right to access your data, to correct it, to have it deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time. You can also lodge a complaint with a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country of residence. To exercise your rights, write to hello@beforegoingout.com; we answer within 30 days.
8. Deleting your account
In the app, go to Settings → Account and data → Delete my account and data. This deletes your profile, checks, polls, votes on your polls, all stored photos and thumbnails, the people you blocked, and your sign-in (including the link to Apple or Google; if you signed in with Apple, we also disconnect the app from your Apple ID).
- Votes you cast on other people's polls are deleted. The vote totals on those polls stay as plain numbers, because their owners have already seen the results, and your first name is removed from their list of voters.
- Usage and billing records are anonymised, not deleted. Records of AI usage (token counts, cost, timing) and of subscription events are kept for accounting and tax purposes, with your account id replaced so they no longer point to you.
- Blocks other people set become anonymous. If someone blocked you from voting on their polls, that block keeps working for your device but no longer carries your name or any link to your account.
- Your record at RevenueCat (our subscription service) is erased. [This happens when the RevenueCat server key is configured; keep this sentence only if it is.]
- Your App Store or Google Play subscription is not cancelled by deleting your account. Purchases are managed by Apple or Google, so cancel the subscription in your store's subscription settings as well; the app links you there before you delete.
Backups are overwritten within [e.g. 30 days].
9. Children
Before Going Out is for adults (18+) only. We do not knowingly process data of minors. Photos that appear to show someone under 18 are not analysed and are deleted, and votes can be reported with the reason "Shows someone under 18".
10. Security
Photos are private: they are never public and are shown only through links that expire after 15 minutes. Vote links are random and expire. Access to our database is restricted by security rules; identifiers used for abuse prevention are hashed.
11. Changes
We will update this page when our practices change and tell you in the app about important changes.