Privacy Policy

Last updated October 28, 2026

Version: 1.0
Effective: October 28, 2026
Who is responsible: Jonas Avellana, sole proprietor, Vancouver, British Columbia, Canada
Contact: support@shelley.app

Shelley is an iPhone app that helps you decide what to wear. You add photos of your clothes, ask Shelley what to wear, and it suggests outfits from your own closet. To do that, Shelley handles your photos, your messages and a small amount of information about you. This policy explains what we collect, who receives it, how long we keep it and what you can do about it.

In this policy, “Shelley”, “we” and “us” mean Jonas Avellana, the sole proprietor who makes Shelley and is responsible for your personal information.

If you do not agree with this policy, please do not use Shelley. You can delete your account and its data at any time (see Deleting your account).

The short version

Your chats and clothing photos are sent to AI providers (OpenAI, Anthropic and Google, through OpenRouter) so Shelley can answer you. You agree to this before any AI feature runs, and you can withdraw that consent.
We do not sell your data. We do not use it for advertising. We do not track you across other apps or websites.
Product analytics is off unless you turn it on.
Shelley stores one saved location, which you choose. It does not track where you go.
You can delete your account, and everything we hold about you, from inside the app.

What we collect

Account information

How you sign in. You can sign in with Apple, with Google, or with a 6-digit code sent to your email. There is no password.
Email address. From the sign-in method you use. If you use Sign in with Apple and choose to hide your email, we receive an Apple relay address instead of your real one.
Name and username. Your name comes from you or from your Apple or Google account. You choose your username.
Age check result. See Age check.
Gender. Optional. The default is “prefer not to say”. If you set it, Shelley uses it to tailor suggestions.
Timezone. Read automatically from your phone so dates like “tomorrow” and the season are right.
Saved location (optional). A city you choose, stored with approximate coordinates. See Location and weather.
Your choices. Whether you agreed to AI processing and when, the policy version you agreed to, and whether product analytics is on.

Style information

The style cards you pick, any style preferences you write, the assistant persona you choose and your light or dark mode setting.
Outfits you save, outfits you turn down (so Shelley stops suggesting them) and your outfit rule preferences.

Wardrobe photos and what we learn from them

Photos of your clothes or outfits that you add.
When you add an item to your closet, we keep its original photo, the clean product-style image Shelley makes from it, and the details the AI finds: type, colour, pattern, material, seasons, tags and a short description.
Photos you add during setup or when you redo your style analysis are used to find clothing and your style, then discarded, unless you add the items they show to your closet.
Your wear log: the date you wore something, an optional occasion and note, and the saved outfit if you picked one.

Chats

Your messages to Shelley and any photos you attach.
Shelley’s replies, the outfits it suggests, and your chat history, which gives Shelley context for later questions.
Thumbs up or down ratings and any written feedback on a reply.
Reports you send about a reply or an outfit: the reason you picked and any note you add.

Technical information

Sign-in sessions. A session id, a refresh token and start and expiry times, so you stay signed in.
AI usage records. For each AI request: which model ran, how many tokens it used, how long it took and what it cost. These do not hold a second copy of your messages.
Server logs. Request details and errors, used to fix problems and prevent abuse. We do not use logs to build a profile of you.
Product analytics, only if you turn it on. See Product analytics.

What we do not collect

We do not collect your contacts, health data, financial data, browsing history or advertising identifier. We do not read your location in the background. Shelley does not send push notifications.

Why we use it

Account information to sign you in, keep your account secure and address you in the app.
Age check result to keep Shelley to people 13 and older.
Style information, wardrobe photos and wear log to build your closet and suggest outfits from clothes you own.
Chats to answer your questions, with your history as context.
Ratings, feedback and reports to improve suggestions and to find and deal with harmful replies.
Timezone and saved location for weather-appropriate suggestions and correct dates.
Sessions, usage records and logs to run the service, control costs, fix problems and prevent abuse.
Product analytics (only if on) to learn which features people come back to.

Where the law asks us to name a legal basis (for example under the GDPR): we rely on your consent for AI processing and for product analytics; on performing our contract with you for your account, closet and chats; and on our legitimate interests in keeping Shelley secure and working (sessions, logs, usage records, reports).

AI processing

Shelley’s suggestions come from AI models that we do not run ourselves. Before any AI feature works, the app asks you to agree to this processing. Here is what happens when you use it:

Your chat messages, any photos you attach, and recent messages from that chat are sent to an AI model to write a reply.
Your clothing photos are sent to an AI model that identifies each item (type, colour, pattern, material). During setup, the list of items it found (text only, no photo) goes to a second request that writes your style summary.
Your clothing photos are also sent to an image model that makes the clean product-style images and outfit pictures you see in the app.
Context sent with a request can include your style preferences, your persona, relevant items from your closet (including wear log entries and notes, when you ask about them) and a weather summary with a place name.
Safety check. The text of your chat messages, and some app data Shelley looks up to answer them, is checked by a separate AI model for misuse before Shelley acts on it.

We do not put your email address, name or account id in the prompts we send. Your location coordinates are never sent to an AI provider; it sees only a weather summary and a place name.

Which providers. All AI requests go through OpenRouter, a service that forwards each request to the model provider we choose. Today that is:

OpenAI (GPT-4o mini) for chat replies and for reading your clothing photos.
Anthropic (Claude Haiku 4.5) for the safety check on chat messages.
Google (Gemini 3.1 Flash Image) for making product-style images and outfit pictures from your photos.

We may change models as we tune quality and cost. If we add a new kind of data, a new AI provider or a new purpose, we will update this policy and ask you to agree again in the app.

What the providers do with it. We send your data to these providers through OpenRouter, and each one handles it under its own terms and privacy policy. They use it to return a response. Some providers keep inputs and outputs for a limited time under their own policies, for example to monitor for abuse. How long they keep data, and what else they may use it for, is set by their policies, not by us. You can read them here:

We do not use your photos or chats to train our own AI models.

Your photos and messages do leave our systems when you use AI features. If you are not comfortable with that, do not send content you consider sensitive.

Withdrawing consent. In the app, go to the Profile tab, tap Privacy & Data, then Withdraw AI consent. Shelley stops sending your data to AI providers. Shelley runs on AI, so after that you can agree again, log out or delete your account.

Age check

Shelley is for people 13 and older. Right after you sign in for the first time, Shelley checks your age:

On iOS 26 and later, Shelley asks Apple’s Declared Age Range feature whether you are 13 or older. If you agree to share it, Apple tells us only that you are 13 or older, or under 13.
If that is not available, or you choose not to share it, you tell us yourself whether you are 13 or older.

We store only the result (13 or older, or under 13), how it was checked (Apple or your own answer) and when. We never ask for or store your birthdate or exact age. If the result is under 13, the account cannot use Shelley, and you can delete it right away.

Location and weather

Shelley suggests outfits for the weather. To do that, it uses the first of these that is available:

A place you name in chat, like “what should I wear in Lisbon on Friday”. We look up the name in a list of cities stored on our own server.
Your saved location, if you set one.
Your timezone. We turn your timezone (for example America/Vancouver) into a rough point for that region, shared by everyone in that timezone.

Saved location. You can set one place in the app, under the Profile tab, then Location: type a city and pick it, or tap Use current location. During setup you can also allow location once. We store the city name (or “Current location” if no city matches) and coordinates rounded to about 1 km. Each new save replaces the last one, so we keep no history. It stays until you clear it or delete your account.

Device location. Shelley reads your phone’s location only when you tap Use current location, or allow it during setup when you have no saved location. It asks for approximate location “While Using the App” only, never “Always” and never precise. It takes one reading, rounds it to about 1 km on your phone and sends it to our server, which finds the nearest city and saves both as your saved location. That is the only copy. Shelley never reads your location in the background, never sends it with your chat messages, never writes it to our logs and never sends it to analytics. You can turn location access off at any time in your iPhone’s Settings app.

Place names. Finding the nearest city and matching city names happen on our own server, so your location and the places you type are never sent to a place-name service. Place names from GeoNames, CC BY 4.0.

Weather forecasts. To get a forecast, our server sends Apple WeatherKit the rounded coordinates (about 1 km), the date and the timezone. No name, email, account id or place name goes with it, so Apple cannot link the lookup to you. We keep forecasts briefly in memory and do not store them, apart from the short weather summary inside a chat reply or outfit suggestion.

Product analytics

Product analytics tells us which parts of Shelley people come back to. It is off unless you turn it on, and turning it off changes nothing else in the app.

Where to change it. On the About you screen during setup, or later in the Profile tab under Privacy & Data, Product analytics.
Who receives it. Google, through Google Analytics for Firebase. Google stores these events on its servers outside Canada.
What is sent. Screen and action names (like “closet” or “chat_message_send”), counts and rough ranges (like how many items are in your closet), a short list of fixed values (like your persona, iOS and the app build), error types from a fixed list, and events Google records automatically (first open, app update, session start, screen views, time in app).
The identifier. Google’s code creates a random id for your install of the app. We never send your account id to Google, and we never store that random id, so neither we nor Google can connect the events to your Shelley account. The id resets when you sign out, turn analytics off, or delete and reinstall the app. It is pseudonymous, not anonymous.
What is never sent. Nothing you type: not your email, name, username or gender, not your chats, not your closet searches, not item names or notes, not your photos and not your location. The app only allows a fixed list of analytics fields, and blocks anything that looks like an email address.
No advertising. Shelley does not read your advertising identifier, does not link the App Tracking Transparency framework and has Google Signals turned off. That is why Shelley never shows the “Allow app to track” prompt.
How long Google keeps it. 14 months, then Google deletes it.

What we cannot do. Because the events carry no account id, we cannot find the events that came from you, so we cannot delete them on request. Deleting your account does not remove them; they expire on Google’s 14-month schedule. To limit them: turn analytics off, sign out, or delete and reinstall the app. Each of these resets the id.

Who receives your data

We use a small number of service providers to run Shelley. Each receives only what it needs:

OpenRouter, which forwards AI requests to OpenAI, Anthropic and Google: chat messages, attached photos, clothing photos and the styling context described in AI processing.
Supabase: our database (your account and everything in your closet and chats) and our sign-in system (your email address, sign-in identities and sessions).
Render: hosts our server and this website. Your requests pass through it, and it holds our server logs.
Resend: sends the emails with your 6-digit sign-in code. It receives your email address and the email we send.
Apple, as a sign-in provider: if you use Sign in with Apple, Apple shares your name (first sign-in only) and your email or relay address. We also keep an encrypted Apple sign-in token so we can tell Apple to remove Shelley’s access when you delete your account.
Google, as a sign-in provider: if you use Google sign-in, Google shares your name, your email address and, if your Google profile has one, a link to your profile photo with our sign-in system (Supabase), which stores them with your sign-in identity. Shelley does not use the photo link.
Apple, for age checks: Apple’s Declared Age Range tells us only whether you are 13 or older.
Apple WeatherKit: rounded coordinates, a date and a timezone, with nothing that identifies you.
Google Analytics, only if you turn analytics on: see Product analytics.

We may also share data if the law requires it (for example a court order), or to protect the rights, safety or property of Shelley users or others. We will tell you unless the law forbids it.

If Shelley is ever sold or merged, your data may move with it. We will tell you first, and you can delete your account before it happens.

What we do not do

We do not sell your personal information.
We do not share it with advertisers or data brokers.
We do not use it for advertising, and Shelley has no ad, attribution or crash-reporting code.
We do not track you across other companies’ apps or websites.
We do not use your photos or chats to train our own AI models.

Where your data is stored

Your information is stored and processed in Canada and the United States. Our AI providers (OpenRouter, OpenAI, Anthropic and Google) process requests where their own terms say, mostly in the United States. If you turn analytics on, Google stores those events outside Canada.

This means your information may be processed outside your province, including outside Quebec, and outside Canada, where it may be accessible to courts and authorities under local law. When your information leaves Canada, or leaves the EU, EEA or UK, we rely on the safeguards our service providers offer for international transfers, such as standard contractual clauses where they offer them. Our database tables are not exposed on Supabase’s public data API; they are reachable only through our server, which checks who you are on every request.

How long we keep it

Account, closet, chats, outfits, wear log, feedback and reports: until you delete your account.
Saved location: until you clear it or delete your account.
Device location: not kept, apart from the saved location you set with it.
Chats you delete: hidden from you right away and fully removed when you delete your account. They are not used to answer later questions.
Sign-in sessions: expire after 30 days and are removed when you log out.
Server logs (from our server, hosting and database providers): up to 30 days.
Analytics events at Google: 14 months (see Product analytics).

Anything already sent to an AI provider follows that provider’s own retention policy. Deleting your account removes it from our systems, but cannot erase copies a provider keeps under its policy.

Deleting your account

You can delete your account inside the app. You do not need to email us.

Open the Profile tab.
Scroll to the bottom and tap Delete account.
Confirm with Delete permanently.

Deletion is permanent. There is no grace period and no way to undo it. It removes:

your account (email, name, username, gender, age check result, style preferences, timezone, saved location and your consent records);
every closet item with its photos and generated images;
every chat and message, including attached photos;
saved, suggested and turned-down outfits, and your outfit rules;
your wear log, ratings, feedback and reports;
your sign-in sessions and your sign-in identity in our sign-in system (Supabase);
your Apple sign-in token. If you used Sign in with Apple, we ask Apple to remove Shelley’s access to your Apple ID.

If you used Google sign-in, you can also remove Shelley from your Google account’s third-party connections. Deletion does not reach analytics events already sent to Google (see Product analytics).

Your rights

Wherever you live, you can:

See your data. Ask us for a copy of the personal information we hold about you.
Correct it. Edit your name, username, gender, style preferences and location in the app, or ask us to fix anything else.
Delete it. Delete your account in the app at any time.
Withdraw consent. For AI processing (Profile, Privacy & Data, Withdraw AI consent) or analytics (Profile, Privacy & Data, Product analytics).
Get a portable copy. Ask us for your data in a machine-readable format.
Object or ask us to limit processing. Shelley cannot work without AI processing, so objecting to it means you cannot use the AI features.

To make a request, email support@shelley.app. We may need to confirm it is you. We will reply within 30 days, and we will not charge you or treat you differently for using your rights.

Canada

Shelley is based in British Columbia. We handle personal information under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act (BC PIPA), whichever applies. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

The person responsible for protecting your personal information is Jonas Avellana, reachable at support@shelley.app. If you are in Quebec, you can also complain to the Commission d’accès à l’information du Québec.

European Union and United Kingdom

If you are in the EU, EEA or UK, the GDPR (or UK GDPR) gives you the right to access, rectify and erase your data, to data portability, to object to and restrict processing, and to withdraw consent at any time without affecting processing that happened before. You also have the right to complain to your local data protection authority. We transfer your data to Canada and the United States as described in Where your data is stored.

California

We do not sell or share personal information, as the California Consumer Privacy Act defines those terms, and have not done so in the past 12 months.

Security

Encryption in transit. All traffic between the app, our server and every provider above uses HTTPS.
Encryption at rest. Our database and hosting providers encrypt stored data. Apple sign-in tokens are encrypted again by us.
No passwords. You sign in with Apple, Google or a short-lived email code, with rate limits against guessing.
Secure storage on your phone. Sign-in tokens are kept in the app’s private storage, which other apps cannot read.
Access control. Every request is checked so you can only reach your own data.

No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities as the law requires.

Children

Shelley is not for children. You must be 13 or older to use it, or older where your local law sets a higher age for agreeing to data processing (16 in some EU countries). We do not knowingly collect personal information from children under that age. If you think a child has given us personal information, email support@shelley.app and we will delete the account.

This website

shelley.app has no analytics, no cookies and no third-party scripts. Render, which hosts it, keeps standard server logs (such as IP address and pages requested) for up to 30 days to run and protect the site.

Changes to this policy

We will update this policy when Shelley changes, and change the date at the top. The version number matches the AI consent you give in the app. If we change how AI processing works (new kinds of data sent, a new AI provider or a new purpose), we will raise the version and ask you to agree again in the app. Smaller clarifications only change the date.

Contact

Questions, requests or complaints about your privacy: support@shelley.app.

Jonas Avellana, sole proprietor
Vancouver, British Columbia, Canada