Lookr Privacy Policy

Effective Date: July 10, 2026
Last Updated: July 21, 2026

This Privacy Policy describes how Smart Home Occupancy LLC d/b/a Lookr ("Lookr," "we," "us," or "our") collects, uses, and shares information about you when you use the Lookr mobile application (the "App") and our website at getlookr.app (collectively, the "Service"). This Privacy Policy is part of and incorporated into our Terms of Service.

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

1. Who we are and how to contact us

Controller: Smart Home Occupancy LLC d/b/a Lookr
Governing law: New Jersey, United States
Contact (all inquiries — privacy, support, legal, security): modelfitdev@gmail.com

We do not maintain a public physical mailing address. The monitored email address above is the single point of contact for all privacy questions, data-subject requests, support, legal notices, and security reports.

EU/UK representative: The Service is currently offered only in the United States and is not directed to or distributed in the European Economic Area or the United Kingdom. If and when we begin distributing the Service in the EEA or the UK, we will appoint a representative under Article 27 of the EU/UK GDPR and update this Privacy Policy with their contact details before such distribution begins.

2. Information we collect

We collect the following categories of information.

2.1 Information you provide to us

• Account information. When you create an account, we collect your email address and either a password (stored only as a one-way hash) or an OAuth identifier from Apple or Google. We never see your Apple or Google password.
• Profile information. Display name, optional bio, optional avatar image.
• Body measurements. Height is required at sign-up. Weight, chest, waist, hips, inseam, and shoulder circumferences are optional. We store measurements in centimeters and kilograms internally, regardless of the units you enter. You can view and change any measurement at any time in Settings → Edit measurements.
• User-Generated Content. Photos you upload, captions you write, comments you post, and any reports you submit.
• Post location (optional). A post may include a location only if you choose to add one. This comes from one of two sources you control: (a) location metadata already embedded in a photo you upload, which you may choose to include or strip before posting, or (b) text you type manually. We do not read your device's live GPS or precise location to set a post's location.
• Weather prefill location (optional). When you open the styling-context section of the post composer, you can allow a one-time device location request so we can prefill the current weather for your look. If you grant permission, your coordinates are rounded to roughly 1 kilometer on your device before they leave it, sent directly to the Open-Meteo weather service to fetch current conditions, and are never stored by us or associated with your account. If you decline, the feature is simply skipped and you can pick the weather manually. You can revoke the permission at any time in your device settings.
• AI critique input. When you tap "Get stylist feedback" on a photo, we send the photo(s) and a summary of your body measurements to our AI provider, and — if you have entered standing style-context text in your profile — that text, and — when you request feedback on a post — that post's caption and any private notes you have added to the look (see Section 5). We do not send your name, email, account identifier, or other contact information.
• Communications with us. Emails to modelfitdev@gmail.com, in-app reports, and any other correspondence.

2.2 Information we collect automatically

• Device information. Device model, operating system version, app version, language, and timezone.
• Usage data. Screens viewed, actions taken (post, like, save, follow, search), time spent in app. Collected via our analytics provider PostHog. You can opt out in Settings.
• Crash and performance data. Stack traces and device state at the time of a crash. Collected via Sentry.
• Approximate location. Derived from IP address only, used to determine country/region for legal compliance. Apart from the optional weather prefill described in Section 2.1 (coarsened on-device, never stored), we do not collect GPS or precise location.
• Authentication tokens. Securely stored on-device only (Apple Keychain / Android Keystore via expo-secure-store), never transmitted to analytics or third parties.

2.3 Information from third parties

• OAuth providers (Apple, Google). If you sign in with Apple or Google, we receive a unique identifier and, depending on your provider settings, your email address.

2.4 What we do NOT collect

• Biometric data. We do not perform facial recognition, body scanning, voice analysis, or any other biometric processing. Height, weight, and circumference measurements are not biometric data under Illinois BIPA (740 ILCS 14/10) or comparable state laws.
• Precise location. We never store or transmit precise coordinates. The optional weather prefill (Section 2.1) reads your device location only with your permission and rounds it to roughly 1 kilometer on your device before any network request; the coarsened coordinates go only to the Open-Meteo weather service and are never stored by us.
• Contacts, calendar, or other on-device data outside of photos you explicitly choose to upload.
• Health data from Apple Health or Google Fit.

3. How we use information

We use the information we collect for the following purposes:

We do not use your information for advertising, do not sell it, and do not share it with data brokers.

4. The matching feed is algorithmically personalized

Your discovery feed is filtered and ranked by a similarity score between your body measurements and those of post authors. This score is computed server-side; other users never see your raw measurements — only the resulting match percentage. You can adjust your measurement visibility in Settings (Public / Match-only / Private) and you can opt out of being included in matching at any time.

5. Third-party AI processing

When you tap "Get stylist feedback" on a photo, your photo(s) and a summary of your body measurements are sent to:

• OpenRouter, Inc. ("OpenRouter") — an API routing service that forwards the request to:
• Anthropic, PBC ("Anthropic") — the operator of the Claude Sonnet 4.6 large language model, which generates the feedback text.

Backup provider. If Anthropic's service fails repeatedly on a request, we may route that request (the same photo(s) and measurement summary, nothing more) through OpenRouter to OpenAI, Inc. ("OpenAI") as a disclosed backup so your critique still completes. The backup is used only on Anthropic failure, never by default, and the same no-logging configuration on our OpenRouter account applies. In-app, this backup applies only after you have accepted a consent notice that names OpenAI; users whose recorded consent predates that notice are never routed to the backup.

What is sent: the photo(s) you submit, a structured summary of the body measurements you have entered in your profile, — if you have entered standing style-context text in your profile (for example, an occasion or style goal) — that text, and — when you request feedback on a post — that post's caption and any private notes you have added to the look. Nothing else is sent.

What is NOT sent: your name, email address, account identifier, social graph, location, or any other personal information.

Retention: we have configured OpenRouter to disable request and response logging on our account. Anthropic's contractual terms with us provide that user content submitted via API is not used to train models and is not retained beyond the duration required to fulfill the request and address operational needs (see Anthropic's Commercial Terms). For full details see OpenRouter's and Anthropic's privacy policies.

Your control: AI critique is opt-in. We show a consent modal the first time you request feedback. You must explicitly accept before any data is transmitted. You can revoke consent at any time in Settings → AI Critique → My AI Consent. Revoking consent disables the feature for your account.

No automated decision-making with legal effect. AI critique is informational. It does not gate access to the Service, post visibility, or any other outcome.

5.1 Automatic style classification of posts

When you publish a post, its cover image is sent once to the same processors (OpenRouter, Inc. → Anthropic, PBC) to be automatically classified into general style descriptors (for example, an aesthetic such as "streetwear", a fit, an occasion, and a season). This runs automatically as part of publishing — it is not the opt-in stylist critique above — and the resulting descriptors are stored internally and used only to organize the feed and power personalized style recommendations. What is sent: only the post's cover image. What is NOT sent: your name, email, account identifier, body measurements, or any other personal information. The same no-logging / no-training retention terms described above apply. These descriptors are never shown to other users as a label on your post; they are an internal ranking signal. The lawful basis is our legitimate interest in organizing content and providing recommendations (Section 3).

6. How we share information

We share information only as described below. We do not sell personal information.

6.1 Other users

• Your public posts, profile, comments, and the public portions of your profile are visible to other users of the Service.
• Your match percentage relative to a viewer is computed and shown without revealing your raw measurements.
• Private posts are visible only to you.
• Posts where you have disabled comments display no comment thread to other users.

6.2 Service providers

We share information with providers who process data on our behalf, bound by data processing agreements:

A complete and updated list is available at getlookr.app/subprocessors.

6.3 Legal and safety

We may disclose information when we believe in good faith that disclosure is necessary to:

• Comply with a valid legal process (subpoena, court order, government request);
• Enforce our Terms of Service or Community Guidelines;
• Protect the rights, property, or safety of Lookr, our users, or the public;
• Investigate fraud, security, or technical issues.

6.4 Business transfers

If Smart Home Occupancy LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, information may be transferred to the resulting entity. We will notify you of any such change in this Privacy Policy and via email or in-app notice.

7. Data retention

We retain your information for as long as your account is active. When you delete your account:

• Within 30 days: all posts, comments, likes, saves, follows, body measurements, AI consent records, and AI feedback history are permanently deleted from our production systems.
• Within 90 days: all data is purged from encrypted backups.
• Retained on a defined schedule: moderation-action records are retained for 36 months for legal-obligation and community-safety purposes, with personal identifiers anonymized within 90 days of deletion; we also retain content if required to comply with a legal obligation (e.g., active subpoena, DMCA dispute) until the obligation ends, and a minimal record of the deletion event itself (account ID hash, deletion timestamp) indefinitely for audit purposes.

Specific retention:

8. Your rights and choices

8.1 In-app controls

• View and edit your profile in Settings → Account, and your body measurements at any time in Settings → Edit measurements.
• Change your measurement visibility (Public / Match-only / Private) in Settings → Privacy.
• Make a post private or delete it in the post's kebab menu.
• Block another user from any profile.
• Revoke AI consent in Settings → AI Critique → My AI Consent.
• Opt out of analytics in Settings → Privacy → Analytics.
• Disable push notifications in Settings → Notifications or your OS settings.
• Delete your account in Settings → Account → Delete Account.

8.2 GDPR / UK GDPR rights (EU and UK residents)

You have the right to:

• Access the personal data we hold about you (write to modelfitdev@gmail.com)
• Rectification of inaccurate data
• Erasure ("right to be forgotten") — accomplished via Delete Account or by writing to us
• Restriction of processing
• Portability — receive your data in a machine-readable format (JSON export available on request)
• Objection to processing based on legitimate interest
• Withdraw consent for any processing based on consent
• Lodge a complaint with your local supervisory authority

Lawful bases for processing are listed in Section 3.

8.3 California Consumer Privacy Act (CCPA) / CPRA rights

California residents have the right to:

• Know what categories of personal information we collect, the purposes, sources, and third parties we share with (this Privacy Policy provides this disclosure)
• Delete personal information (via Delete Account or by writing to us)
• Correct inaccurate personal information
• Opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising; nothing to opt out of
• Limit use of sensitive personal information — we do not use sensitive personal information beyond what is necessary to provide the Service
• Non-discrimination for exercising these rights

To exercise rights, contact modelfitdev@gmail.com. We will verify your identity by confirming you control the email address on the account. We will not charge a fee for valid requests and will respond within 45 days.

8.4 Other US state privacy rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states with active comprehensive privacy laws have similar rights to access, delete, correct, and obtain a portable copy of their personal data, and the right to appeal a refused request. To exercise these rights or to appeal, contact modelfitdev@gmail.com.

9. Children's privacy

The Service is intended for users aged 13 and older. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly.

Users aged 13 to 17 may use the Service only with the verifiable consent and supervision of a parent or legal guardian, who must review and agree to this Privacy Policy and our Terms of Service on the minor's behalf.

If you are a parent or guardian and believe a child under 13 has provided us with personal information, or you wish to review or remove information associated with a minor in your care, please contact modelfitdev@gmail.com.

10. International data transfers

Lookr is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States.

For transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-US Data Privacy Framework. Copies of the relevant clauses are available on request.

11. Data security

We protect your information with administrative, technical, and physical safeguards including:

• Encryption in transit using TLS 1.3 on all client-server connections.
• Encryption at rest for all data stored in Supabase and in backups.
• Row-Level Security in our Postgres database — every table enforces access at the database level, so a bug in application code cannot expose another user's data. Your body measurements specifically are readable only by you.
• Secrets isolation — third-party API keys (OpenRouter, Sightengine, etc.) are stored as server-side secrets and never embedded in the mobile app.
• Pre-publication image moderation to prevent abusive content from appearing in the feed.
• Independent monitoring via Sentry and Supabase audit logs.

No method of transmission or storage is 100% secure. If we become aware of a personal data breach affecting you, we will notify you and applicable regulators in accordance with applicable law.

12. Notifications and communications

• Transactional emails (account verification, password resets, security alerts, legal notices) — we send these regardless of marketing preferences.
• Push notifications — opt-in. Manage in Settings → Notifications.
• Marketing emails — we do not currently send marketing emails. If we begin to, you will be able to opt out and we will respect your choice.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top. For material changes, we will provide additional notice (such as an in-app alert or email) at least 30 days before the change takes effect.

Your continued use of the Service after the effective date constitutes acceptance of the updated Privacy Policy.

14. Contact us

For any question about this Privacy Policy or our data practices:

Email: modelfitdev@gmail.com

This single monitored address handles all privacy, support, legal, and security inquiries for Smart Home Occupancy LLC d/b/a Lookr. We do not maintain a public physical mailing address.

For DMCA / copyright issues, see our DMCA Policy.
For security issues, write to modelfitdev@gmail.com.

End of Privacy Policy.