Updated 2026-10-11
Privacy policy
Service owner and data controller: Grigory Voevodin
[email protected]
About the service
LookCraft provides virtual try-on, wardrobe tools and stylist advice. It is operated by the individual named above. Contact the email address shown for privacy requests.
Data we receive
Account ID; Telegram or Google identifiers and profile details, including verified Google email; uploaded photos, avatars, garments, looks, prompts and AI results. Optional profile information includes age, gender, height, weight and measurements. We also store language, preferences, subscription, credits, transaction identifiers and technical logs that may include IP address and device details. Location is used when you provide it.
Why we use data
To sign you in and link login methods to one account, save your wardrobe, generate try-ons and advice, search for items, manage subscription and credits, recover access, provide support and protect the service. Avoid including unnecessary personal details in prompts or photos.
Service providers
OpenAI receives photos, text and profile details needed for the generation you request. Telegram provides sign-in, bot messages, support and Stars payments. Google provides sign-in and, once sender access is configured, Gmail recovery messages. Shopping search providers, including Serper, may receive search queries and region details you supply. These services may process data in other countries under their own policies. Store links open third-party websites.
Google sign-in and passwords
Google sign-in requests only openid, email and profile: identifier, verified email, name and profile photo. We do not receive your Google password or request permission to read your mailbox. Google data is used for sign-in, account linking and recovery, not advertising. LookCraft passwords are stored as salted hashes; recovery links are single-use and expire after 15 minutes.
Storage and cache
Account data and images are stored in LookCraft infrastructure. Your device stores preferences, secure session cookies and cache for faster loading. Signing out clears the app's private-data cache, but files you downloaded yourself remain on your device. Saved materials are retained while needed for your account; technical and transaction records while needed for security, support and accounting. Backup copies may remain until their scheduled replacement.
Access, correction and deletion
You can edit your profile and delete individual garments, looks and avatars in the app. To request a data copy, correction, withdrawal of consent or full deletion of your account and photos, contact the email shown or Telegram support. Include your account ID and request; we verify account ownership. Never send passwords or login codes. Deleting a card may not immediately remove every technical copy. Records needed for payments, security or applicable requirements may be retained after full deletion.
Your control and policy changes
Upload only your own photos or images you have permission to process. Photos and results are not automatically published on social media. Camera and library access depend on device permissions, which you can revoke in phone settings. Changes to data processing will be reflected here with a new revision date.
Google data and recovery
Google sign-in uses your identifier, verified email, name and profile photo for authentication, linking to your LookCraft ID and recovery. These details are stored with your LookCraft account while needed to provide the service; deletion requests go to the service owner. You can revoke Google access in your Google account settings; revocation alone does not delete your LookCraft account. We do not sell Google data or use it for advertising, credit scoring or training general AI models. Google Workspace APIs are not used to develop, improve or train non-personalized AI/ML models. Gmail is connected separately only to the service owner's mailbox to send recovery links to a linked, verified email. We do not request access to users' mailboxes. The recipient, message and recovery link are sent to Google for delivery, not to advertising partners.
Data protection and responsible use
HTTPS protects data in transit between the app and server. Access to personal data in the app requires a valid session; administrative access is restricted. Passwords are stored as individually salted hashes and recovery tokens as hashes; the raw token is delivered only in the recovery link. OAuth secrets and mail tokens are kept in private server configuration, not browser code. No system can guarantee absolute security. Retention, exceptions and deletion are explained in the sections below.