Privacy Policy
Last updated: 2026-10-05
This is the privacy policy for Luqora — a private personal-style collection app. We've tried to write it in plain language. If something here is unclear, contact support@luqora.app.
Who we are
Luqora is provided by SignArm Solutions (FZE), a Free Zone Establishment licensed by the SRTI Free Zone Authority, Sharjah (licence SC241060701), Block C VL05-082, Sharjah Research Technology and Innovation Park, Sharjah, United Arab Emirates. We decide how your personal data is used (we are the "controller"). Contact for anything about Luqora or your data: support@luqora.app. Company contact: contact.us@signarm.com.
Summary
- You can use Luqora without creating an account. In that mode your pieces, photos and notes stay on your device and are never uploaded. The weather lookup, App Store subscription checks and any anonymous diagnostics you choose to turn on still work without an account — all described below.
- If you choose to sign in, your items and photos sync to your account so they follow you across devices.
- We never sell your data. We don't run ads. We don't track you across other apps or websites.
- You can export a backup of your collection (one ZIP file with your pieces, photos, outfits and trips) at any time, or delete your account to remove everything we store.
What we collect
| Data | When | Where it's stored |
|---|---|---|
| Items you save (name, brand, note, optional details) | When you save an item while signed in | Supabase (Postgres, Frankfurt EU) |
| Photos you attach to items | When you save a photo while signed in | Supabase Storage (private bucket, Frankfurt EU) |
| Trips you plan (name, destination, dates, packing list) | When you save a trip while signed in | Supabase (Postgres, Frankfurt EU) |
| Email address + display name | When you sign in via Apple or Google | Supabase Auth |
| Authentication identity | Persisted from Apple/Google sign-in | Supabase Auth |
| Subscription status | When you subscribe to Luqora Pro | RevenueCat + our database |
| Crash and error reports — only if you opt in | When the app crashes | Sentry (anonymous, no PII) |
| Usage statistics — only if you opt in | When you grant analytics consent | PostHog (usage events linked to your account ID if you're signed in — no names, notes, photos or search text) |
| Device biometric (Face ID / Touch ID) | If you enable App Lock in Settings | Stays on your device — Apple's Secure Enclave |
| Push notification token | If you enable any notification category | Supabase (Frankfurt EU) — revocable by disabling notifications anytime |
| Push notification preferences (opt-in flags, quiet hours, timezone) | When you change a notification setting | Supabase (Frankfurt EU) |
We don't collect:
- Your contacts or calendar
- Your browsing history or activity in other apps
- The text content of items, notes, or search queries (when sent to analytics)
- Your pieces, photos, or notes if you use the app without signing in — they stay on your device and are never uploaded
Signing in is not what turns telemetry on or off: if you opt in to crash and usage reports, they are sent whether or not you have an account. When you're signed in, usage events are linked to your account ID. They are app-level only (for example "item_added") and never include item names, notes, brands, photos or search text.
We don't store your device's location. For the home-screen weather, your device's approximate location is sent to our weather provider (Open-Meteo) to fetch a forecast, then discarded. When you plan a trip, the destination you type is also sent to Open-Meteo to look up its weather. The trip itself, including its destination and dates, is saved with your trips: on your device, and in your account when you're signed in. If you ask the AI to suggest a packing list, the trip details are also sent to Anthropic. See Third-party processors below.
How we use it
- To make the app work: render your collection, sync across devices, process subscriptions, deliver photo auto-tag suggestions.
- To improve the app: aggregated usage stats from PostHog (only if you opt in).
- To fix bugs: anonymized crash reports from Sentry.
We do not use your data for advertising, profiling for advertising, or training AI models.
Legal basis (EU and UK)
Under EU and UK data-protection law (GDPR), we rely on:
- Providing the service you asked for (contract): your account, sync, subscriptions, the AI features you use, Style Check, weather, and the notifications you turn on.
- Your consent: usage stats (PostHog) and crash reports (Sentry). You can withdraw it at any time in Settings → Privacy.
- Our legitimate interest in keeping Luqora safe: preventing abuse and keeping the service secure — for example Style Check reports, blocks and repeat-vote checks.
Third-party processors
These services receive specific data on our behalf to provide a feature you've asked for. They cannot use it for their own purposes.
| Processor | What we send | Why |
|---|---|---|
| Supabase (database, auth, storage) — Frankfurt, EU | Your account, items, photos, trips | Cross-device sync |
| Apple, Google — United States | Your sign-in token | OAuth sign-in only — we never receive your password |
| Anthropic (Claude API) — United States | Photos you tap "Auto-fill" on. When you ask the AI to compose or refine an outfit or suggest a packing list, photos and details of pieces from your collection. Details include name, brand, type, colour, season and occasion, whether it's a favourite, and how often and how recently you've worn it. For outfit suggestions and packing lists the app picks the pieces itself (up to 50 at a time), so this can include pieces you didn't choose. For packing lists, also the trip's destination, dates and type, and the names of your saved outfits. | AI-suggested item details, outfit recommendations and packing lists. Anthropic's API does not use this data to train their models; they retain it for up to 30 days for trust-and-safety review then delete it. |
| RevenueCat — United States | Your account ID + subscription state | Manages App Store subscriptions across devices |
| Sentry — Germany | Stack traces, device model, OS version, anonymous device ID | Crash diagnostics. No user content. Only sent when you've opted in. |
| PostHog — United States | Usage events (e.g. "item_added", "theme_changed") linked to your account ID — no names, notes, photos or search text. | Product analytics, only when you've opted in |
| Open-Meteo (weather) — Germany, EU | Your device's approximate coordinates, and the destination you type for a trip | Fetches a forecast to suggest weather-appropriate outfits and packing. No account ID or API key is sent, so the request isn't linked to your account. |
| Expo (push delivery) — United States | Your push notification token and the notification's title and text | Passes notifications on to Apple's push service. Only used if you turn notifications on. |
Style Check (sharing photos with someone you choose)
Style Check lets you share an outfit with someone (a friend, a partner) so they can vote on it, suggest changes, or pick a look for you. When you create a Style Check:
- The photos of the items you share are made accessible to anyone who has the link you send, through a temporary signed URL on our storage provider. The link does not require a login.
- You choose what's exposed. The default ("just this outfit") shares only the photos of the items in that one outfit. Broader modes ("Build" or "Remix") let recipients propose replacements from a wider set of your items — when you choose those modes, you're consciously sharing more of your collection. The app shows you exactly what will be visible before you confirm.
- Your email and other account details are never included. Anyone with the link sees your display name, the title, note, outfit name and occasion you add, and the photo, name, brand, category and colours of each item you've chosen to share.
- Recipients can rate, comment, or suggest outfits; their responses come back to you in-app. We never email them. If a recipient answers while signed in to Luqora, their response is linked to their account so they can find it in the app, and if they've turned on notifications they may get one when you save their suggestion. To stop repeat votes and to enforce blocks, we keep a random identifier for the device or browser they answered from. 30 days after a Style Check expires, we delete the photos it shared and remove these account links and device identifiers from its responses. Any name or comment a recipient types stays with your results until you delete the Style Check, and an identifier kept to enforce a block lasts as long as the block does.
- You can delete a Style Check at any time from inside the app, which revokes future link access immediately.
If you don't use Style Check, nothing about your items is shared with anyone.
How long we keep it
- Your account and everything in it (pieces, photos, outfits, trips, profile, subscription status, notification settings): until you delete it, or until you delete your account.
- Style Check: as described above — shared photos, account links and device identifiers are removed 30 days after the Style Check expires; names and comments stay until you delete the Style Check; an identifier kept to enforce a block lasts as long as the block.
- AI requests: Anthropic keeps them for up to 30 days, then deletes them.
- Usage stats and crash reports: kept only as long as needed to understand how the app is used and to fix crashes, under PostHog’s and Sentry’s standard retention settings. You can ask us to delete them at any time.
- Backups: we don't keep backups of deleted accounts.
Cookies and similar technologies
Our website, luqora.app, doesn't use cookies. We don't use advertising or tracking tools, and our hosting provider, Cloudflare, doesn't set cookies on our site.
Some features save small pieces of information on your phone or in your browser. We only do this when it's needed for something you've asked for:
- In the Luqora app — Your pieces, photos, outfits, trips and settings (such as your theme), so the app works offline. Your sign-in session, if you sign in, kept securely in the iOS Keychain. A subscription ID from RevenueCat, so the app knows whether you have Luqora Pro. Style Check links you've opened, and a random ID for this install, created only when you answer or report a Style Check; it stops repeat votes and makes blocks work. Your choice about anonymous usage stats.
- On the Style Check web page (luqora.app/check) — A random ID in your browser's local storage, saved only when you send a response or a report. It stops repeat votes and makes blocks work. It doesn't contain your name or anything about you, and we don't use it for anything else. You can remove it by clearing your browser's website data.
- Only if you turn on anonymous usage stats — PostHog and Sentry save a random ID on your phone to count usage and group crash reports. They stay off until you turn them on during onboarding or in Settings → Privacy, and you can turn them off at any time.
Everything else above is needed for the app or website to work, so we don't ask for permission for it and there's no cookie banner.
Your rights
- Export: Settings tab → Backup → Export full backup. Saves your pieces, photos, outfits and trips as one ZIP file.
- Delete: Settings tab → Danger zone → Delete account in the app (at the bottom, shown when you're signed in). Permanently erases your account, all items, and all photos within seconds. No email required, nothing recoverable. We do not retain backups of deleted accounts.
- Opt out of analytics + crash reporting: Settings → Privacy → toggle "Anonymous usage stats" off. This single toggle controls BOTH PostHog analytics AND Sentry crash reporting — both are off by default and only sent when you've explicitly opted in during onboarding or in Settings.
- Sign in anonymously: Just don't sign in. Anonymous mode keeps your pieces, photos and notes on your device.
EU/UK users have additional rights under GDPR: access, rectification, erasure, restriction, portability, and the right to object. The Export and Delete controls cover most access, portability and erasure requests. The export doesn't include everything we hold about you (for example, your account details), so for that, or for any other request, email support@luqora.app.
You also have the right to complain to a data-protection authority — usually the one in the country where you live. In the UAE, that's the UAE Data Office.
California users have additional rights under CCPA: to know, to delete, to opt-out. We do not sell personal information.
For users in the EU/UK: data sent to processors outside the EU (United States) is covered by Standard Contractual Clauses (SCCs) under each processor's data-processing agreement.
Children
Luqora is not directed at children. You must be at least 13 to use it, or older if the law where you live requires it (up to 16 in some EU countries). We do not knowingly collect data from children under that age. If you believe a child has provided us with information, contact support@luqora.app and we'll delete it.
Changes
If we change this policy, we'll update the "Last updated" date and, for any material change, prompt you in the app on next launch.
Contact
For any questions about this policy or general support: support@luqora.app
Luqora is built and maintained by SignArm Solutions (FZE).