Your archive is yours. By default, only yours.

01Data controller and scope

Wardory is developed and operated by Durdu Mehmet Keskin ("Wardory", "we"), the data controller for the personal data in this policy.

Wardory can be used from anywhere in the world. This policy applies when you use the Wardory app and this website, wherever you live. Your rights under Turkey's Personal Data Protection Law No. 6698 ("KVKK"), the General Data Protection Regulation ("GDPR") in the European Economic Area, the UK GDPR in the United Kingdom, and US state privacy laws such as California's (CCPA/CPRA) are in the Your rights section.

• Email: [email protected]

02What data we process

We process only what the app needs to work. We don't show ads, we don't sell your data, and we don't use third-party analytics or advertising tools.

We don't store your IP address in our records; we use it only momentarily, to rate-limit requests.

03Legal bases

We process your data only on one of the following legal bases (KVKK Art. 5; GDPR Art. 6):

• Entering into and performing the contract: your account, your archive, labeling your looks with AI, search, similar looks, share images and notifications. We cannot provide the service without them (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
• Legitimate interest: keeping the service secure and working (error reports, rate limiting, preventing abuse) and measuring, in our own system, whether the app is useful. We make sure this interest is balanced against your rights and freedoms; you can object (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
• Explicit consent: leaving your email on the early-access list for the iOS version. You can withdraw your consent at any time; withdrawing does not make earlier processing unlawful (KVKK Art. 5(1); GDPR Art. 6(1)(a)).
• Legal obligation: records and notifications the law requires of us (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).

We don't aim to collect special categories of personal data (for example health or biometric data). We don't use your photos for face recognition or identification; the AI is asked only to label the clothes and takes nothing about your face or body.

04Your photos

• Before it is uploaded, the photo is saved again on your phone: location and device data (EXIF) are removed and never leave your phone. Our server encodes the photo once more from scratch; anything still hidden in it is dropped too.
• For each photo we keep the version you uploaded, a display copy and a small preview.
• Our server cuts each look photo into an image of the look without its background and images of each garment; your color palette is measured on the clothes only, without the background or skin tones. This is done with open-source models running on our own servers: your photo is not sent out for it and is not used to recognize anyone. You keep seeing the photo itself; these images are kept in the background and deleted together with the photo.
• Photos are kept in storage that is not public. The app shows them only through signed links that are private to you and valid for one hour; they have no public address.

05AI

Labeling your looks

For every look you save or add from your gallery, we send our AI provider (below) the following so it can read what is in the photo (colors, garments, occasion and style):

• a reduced copy of the look's photo (without location or device data),
• the date you wore the look,
• a text summary of up to 10 of your previous looks: date, colors, style and garments.

Your name, your email and your notes are not sent. The model returns only short labels (e.g. "beige trench coat", "work"); it does not write to you and takes nothing about your face, body, age or surroundings. The labels are used in search, similar looks, color palettes and screen reader descriptions; they may be wrong. This is not an automated decision that has legal or similarly significant effects on you (GDPR Art. 22).

Our AI provider

We take the labels with an AI model. The model runs either at a provider that offers an AI model service and processes data on our behalf, or on servers we run or rent. We may change this from time to time to balance quality, speed or cost. Whichever we work with, these do not change:

• only the data listed above goes to the model, over an encrypted connection (HTTPS);
• a provider processes your data only on our behalf and only to take the labels; under its contract it does not use it to train its own models or for any other purpose. The same holds for a model on our own servers: your data is processed only to take the labels and is not used to train the model;
• if the model runs outside Turkey or the region you live in, we make the transfer with the safeguards in theinternational transfers section;
• when we change the provider, the name and the date of the switch below update by themselves; if any of these terms changes, we also update this section and the date at the top of the page.

Our current provider: Anthropic (Claude API) (since October 26, 2026). You can ask at any time who the current provider is and in which country the data is processed, at[email protected].

Search and similar looks (on our own servers)

A numeric visual summary used in search is derived from every look you save. This, and interpreting your searches, is done with open-source models running on our own servers; your photo or search text is not sent out for it. Searches run only within your own looks.

06Sharing

When you want to share, we prepare a collage from the looks you choose and open your phone's share sheet. Where you send the image is your choice; that app (for example Instagram) processes it under its own terms. Your archive, your account and your other looks are not shared. Prepared share images are deleted from our server automatically after 30 days. The suggestion on the home screen is only the count of looks you saved in the last seven days; no image is made until you make a collage, and nobody sees it unless you share it.

07Service providers and international transfers

We work with these service providers to run the service; each receives only the data it needs for its job:

• Hosting: our servers and your photos are in Türkiye.
• AI: the provider that runs the labeling model (currently Anthropic (Claude API)); for every look you save, underthe terms above.
• Sign-in: Google or Apple, to verify your account.
• E-mail sign-in: the e-mail service that sends sign-up and password codes; only your address and the text with the code.
• Notifications: Google Firebase Cloud Messaging; only the notification token and the notification's text.

Because Wardory is a global service, your data may be processed in countries other than the one you live in: where our servers are and on the infrastructure of the providers above. Those countries' data protection laws may differ from yours. We make these transfers with the safeguards the law provides for:

• for transfers out of Turkey, with the transfer tools in KVKK Art. 9 (e.g. standard contracts);
• for transfers from the European Economic Area or the United Kingdom to countries without an adequacy decision (including Turkey), with appropriate safeguards such as the European Commission's standard contractual clauses and the UK addendum (GDPR Art. 46).

We don't sell your data, don't use it for advertising and don't share it with anyone other than these providers; competent authorities are the exception where the law requires it. Our service providers process your data only on our behalf and on our instructions.

08What we can see

To provide support and prevent abuse, only authorized people can see, in the Wardory admin panel, account details (name, email, sign-in provider), the number and dates of your looks and the derived attributes, your recent searches, error reports, server records (when requests under your account number were made, their kind, outcome and duration) and AI records.They cannot see your photos or notes. Every admin action, such as adding daily allowance, suspending or deleting an account, and every look at an account's server records is recorded with who did it and when.

09Deletion and retention

Deleting a look

A deleted look stays in Settings › Recently deleted for 30 days and can be restored. After 30 days it is deleted permanently, together with its photos and derived details.

Deleting your account

You can delete your account at any time with Settings › Delete account:

• all your sessions end immediately, and your sign-in details and email are deleted immediately;
• your photos, share images and all your records are permanently deleted within minutes.

If you can’t use the app (for example, you’ve uninstalled it), you can also ask us to delete your account by emailing[email protected] from the email address on your account. Once it is verified, your account is deleted as described above, within 30 days at the latest.

After deletion only these remain: error reports unlinked from you (deleted after 90 days at the latest), your account number in server records (deleted after 14 days at the latest) and the record of admin actions (the account number, without your name or email).

10Security

• All connections are encrypted (HTTPS).
• You sign in with Google, Apple, or e-mail and password. We never keep your password itself, only its Argon2id digest. Session tokens and mailed codes are stored only in hashed form too; codes work for 10 minutes.
• On your phone, your session is kept in the device's secure storage.
• Photos are accessed only through short-lived signed links; storage is closed to the public.

No system is flawless; if there is a security breach, we will inform you and the relevant authorities within the legal deadlines.

11Your rights

Wherever you live, we help you exercise these rights:

• Access: to learn what data we process about you and to get a copy,
• Rectification: to have wrong or incomplete data corrected (you can also change your name yourself in the app),
• Erasure: to have your data deleted (you can also delete your account yourself in the app),
• Portability: to get a copy of the data and photos that belong to you in a commonly used, machine-readable format. You can do this yourself in the app with Settings › Download my data: your data (JSON) and your photos are prepared as a single ZIP file, downloadable for 7 days,
• Objection and restriction: to object to processing based on legitimate interest or ask for processing to be restricted,
• Withdrawing consent: for processing based on consent (the early-access list), at any time.

Turkey (KVKK)

Under KVKK Art. 11 you also have the right to learn the purpose of processing and whether data is used in line with it, and the third parties it is transferred to; to ask that corrections and deletions be notified to them; to object to an outcome against you that results from analysis exclusively by automated systems; and to claim compensation for damage caused by unlawful processing. If you find our answer insufficient, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

European Economic Area and United Kingdom (GDPR)

The rights above are your rights under GDPR Art. 15–21. You also have the right to complain to the data protection authority of the country where you live or work (in the United Kingdom, the Information Commissioner's Office).

United States (California and other states)

We don't sell your personal information or share it for cross-context behavioral advertising (there is no "sale" or "sharing" in the CCPA/CPRA sense). You have the right to learn what information we collect and to ask for it to be corrected and deleted; we won't treat you differently for using these rights. We don't use sensitive personal information for purposes other than those the law permits.

How to make a request

You can make your request in one of these ways:

• by writing from the email address on your account to [email protected],
• in writing: just email us to get the postal address.

To verify your identity, we may ask you to make your request from the email address on your account or to show its link to your account. We answer your request free of charge and within 30 days at the latest; if a complex request means we need to extend this as far as the GDPR allows, we tell you why.

12Children

Wardory is not for children under 13; we don't knowingly collect data from them. If you live in the European Economic Area or the United Kingdom and are under your country's age of digital consent (between 13 and 16), you may use Wardory only with your parent's permission. If we find out that a child under 13 has opened an account, we delete the account and its data. If you know of such a case, write to [email protected].

13This website

This site uses no cookies and has no visitor tracking or advertising tools; its fonts are served from our own server too. When you join the early-access list for the iOS version, we keep only your email address and which form on the page you used; we use this address only to tell you when Wardory reaches the App Store. To leave the list, just write to [email protected].

14Changes

We update this policy as the app changes; the date at the top shows the latest update. If there is a significant change, we will let you know in the app or by email.