Privacy policy

Last updated: 26 April 2026 · effective immediately

1. 1. Who we are
2. 2. What we collect
3. 3. Why we collect it
4. 4. Who we share it with
5. 5. AI training
6. 6. How to opt out of AI training
7. 7. Advertising
8. 8. How long we keep data
9. 9. Deleting your account & photos
10. 10. Security
11. 11. Children
12. 12. Your rights (GDPR / CCPA)
13. 13. Changes to this policy
14. 14. Contact us

1. Who we are

Triyon ("we", "us") provides an AI virtual try-on service through the Triyon mobile app and the website at triyon.app. The data controller is the operator of triyon.app. You can reach us at privacy@triyon.app.

2. What we collect

Information you give us

• Photos. The photos you upload of yourself ("body shots", "face references"), garments you photograph or import, and the AI-generated try-on results made from them.
• Account info. Your email address and password hash. If you sign in with Google, we receive your Google account's email and a federated identifier — never your Google password.
• Profile info. Optional display name, height, weight, and body description text. Used only inside try-on prompts to improve realism.
• Wardrobe metadata. Garment names, categories, colors, descriptions, and your manually-edited captions.

Information we collect automatically

• Device + technical data. Device model, OS version, app version, IP address, language, time zone, and crash reports — used to triage bugs and prevent abuse.
• Usage data. Which screens you open, how often you generate try-ons, what features you use. We log API requests against your account for billing reconciliation, abuse investigation, and refund handling.
• Advertising identifiers. Google Advertising ID (Android) for ad personalization through AdMob — see section 7.
• Purchase + redemption history. Subscription status, in-app purchases, redeem-code uses.

Information we do not collect

• We do not access your camera roll without your explicit selection of a photo.
• We do not collect contacts, calendar, microphone, location, or background sensor data.
• We do not sell your personal data. Ever.

3. Why we collect it

• To run the service. Generate try-on images you request, store your wardrobe, deduct credits, prevent abuse.
• To bill correctly. Track succeeded generations against credit balances and subscription status.
• To improve the product. Diagnose bugs, measure feature adoption, A/B test improvements (always against anonymized aggregates).
• To improve our AI models. See section 5.
• To comply with the law. Tax records, fraud investigations, lawful requests from courts/regulators.

4. Who we share it with

We share data only with the parties below, and only the minimum needed for them to do their job for us. They are not allowed to use your data for their own purposes.

AI generation providers

To generate a try-on, we send the relevant body photo, garment photo(s), and prompt text to one of our AI providers, which currently include or may at any time include:

• Google (Gemini, Imagen)
• OpenAI (GPT image models, DALL·E, gpt-image-2 and successors)
• NVIDIA (NIM, Picasso, and similar generative-image services)
• Stability AI, Black Forest Labs, Runway, Replicate, fal.ai
• Anthropic, Mistral, Meta, Microsoft Azure OpenAI
• Other industry-standard generative-image and vision providers we may onboard in the future

This list is intentionally open — we will rotate providers as model quality, pricing, and availability change. Each provider operates under their own privacy policy and data-handling commitments, which we review before onboarding.

Infrastructure providers

• Cloud hosting and storage (server hosts, S3-compatible object storage) — for storing and serving your photos.
• Database — managed PostgreSQL.
• Email delivery (transactional verification, password reset, support replies).
• Crash + error monitoring tools (e.g. Sentry-style services).

Advertising and analytics

• Google AdMob for ad serving, mediation, and attribution.
• Google Play Services for app updates, integrity attestation, and in-app purchases.
• Apple App Store services (when iOS launches) for the same.

Legal and safety

We may disclose information if required by valid legal process, to enforce our Terms, to investigate fraud, or to protect the safety of users.

5. AI training

We may use the photos you upload to Triyon — your body shots, garment photos, face references, and the AI-generated try-on results — to improve our own AI models and the AI models of our generation partners. This makes the service better at producing accurate, flattering results for everyone.

We will never use your photos for training without:

• stripping direct identifiers (your email, account ID),
• respecting any opt-out you have set,
• limiting access to authorized personnel and contracted ML engineers under NDA.

6. How to opt out of AI training

You have three ways to opt out, and you can do it any time without giving a reason or losing access to the app:

1. In the app: Settings → Privacy → toggle "Use my photos to improve AI" off.
2. On the web: visit triyon.app/legal/delete-account.html#opt-out and submit the AI-training opt-out form. We confirm by email within 7 days.
3. By email: send a request from your account email to privacy@triyon.app with the subject line "AI training opt-out".

Opting out does not stop us from sending your photos to AI providers when you request a try-on — that is what generates your result. It only stops us from using your photos to train AI models.

7. Advertising

Triyon is supported in part by ads served through Google AdMob. AdMob may collect and process limited information from your device to:

• serve ads, including personalized ads where available,
• measure ad performance (impressions, clicks, completion),
• prevent ad fraud.

You can reset your Google Advertising ID or opt out of personalized ads from your device settings (Settings → Google → Ads on Android). On Triyon, you can also remove ads permanently by purchasing the No-Ads Lifetime upgrade or by redeeming a no-ads code.

For full details see Google's Ads policy and AdMob's data practices.

8. How long we keep data

• Account data (email, profile): until you delete your account, then up to 30 days for backup retention before purge.
• Photos: until you delete them, your account, or specifically request a photo purge.
• Logs: 90 days for operational logs; longer for billing-reconciliation logs as required by tax law.
• Backups: encrypted snapshots up to 30 days, then expired.

9. Deleting your account & photos

You can delete:

• An individual photo or try-on: in the app, long-press → Delete.
• All of your photos while keeping your account: in the app, Settings → Privacy → "Delete all my photos", or via web at triyon.app/legal/delete-account.html.
• Your entire account and all data: in the app, Settings → Account → Delete account, or via web at triyon.app/legal/delete-account.html.

Deletion is processed within 7 days. Backups containing your data are purged within 30 days. Some records (transaction logs required for tax/fraud purposes) may be retained for the period required by law, but they cannot identify you to anyone outside our finance/legal team.

10. Security

We protect your data with:

• HTTPS / TLS for everything in transit between the app and our servers.
• Encrypted databases and encrypted object storage at rest.
• Hashed passwords (PBKDF2-SHA256) — we cannot read your password.
• Per-user JWT access control. Server-side rate limits and abuse detection.
• Audit logs for every admin access and AI-call dispatch.

No system is perfectly secure; we encourage you to use a unique strong password and to enable Google sign-in if you prefer to outsource credential storage.

11. Children

Triyon is not directed at children under 13 (or under 16 in jurisdictions where that is the threshold). We do not knowingly collect data from children. If you believe a child has created an account, contact privacy@triyon.app and we will delete it.

12. Your rights

Depending on where you live, you have the right to:

• Access the data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to erasure" / "right to be forgotten").
• Restrict or object to certain processing.
• Port your data to another service.
• Withdraw consent for AI training or personalized ads at any time.
• Lodge a complaint with your data-protection authority.

To exercise any of these rights, email privacy@triyon.app from your account email. We respond within 30 days.

13. Changes to this policy

If we make material changes (new categories of data collected, new providers in a new country, etc.) we will notify you in-app and by email at least 14 days before the change takes effect.

14. Contact us

Questions, complaints, or requests:

• Email — privacy@triyon.app
• Postal — see footer of triyon.app