Musette.

Musette is a personal styling app. It is built so that your closet stays on your phone. This policy explains the few cases where data leaves your device, what we do with it, and your choices.

What stays on your phone

Your closet (photos, items, colours, sizes, prices), outfits, feedback, plans, trips, profile, coloring and budgets are stored only on your device. Photos are analysed on the device; they are not uploaded to us.

What leaves your phone, and why

Weather. The coordinates of the place you choose (or your approximate current location, if you allow it) are sent to Open-Meteo to get a forecast. Location is also used on the device to guess whether you're travelling or at, for example, a gym; that guess is not sent anywhere.
Account & sync. An account is needed to use the app, so your closet is never stuck on one phone. Your email, and your closet encrypted on your phone with keys derived from your password, so we store it but cannot read it. Your password itself never leaves your phone. You can delete your account and synced data from Me → Account & sync.
Encrypted backup (optional). Your closet is encrypted on your phone with a recovery code only you have, then stored on our server. We cannot read it. You can delete it from the app at any time.
Closet photography bookings (NYC, optional). We store the date, time window, ZIP code, approximate closet size, the contact details and notes you enter, and the payment status. Payments are handled by Stripe; card details never reach us.
Receipt import (optional). If you connect Gmail, Musette reads order emails on your phone with read-only access that is revoked when the scan ends. If you turn on AI reading, the text of receipts that mention clothing is sent to our server and to Anthropic (our AI provider) to extract the items, and is not stored by us afterwards.
Feedback you send from the app, with your app version and device model, and a contact only if you add one.
Anonymous usage statistics and crash reports (only if you opt in). A random install identifier plus counts such as days active, closet size and outfits worn, and technical crash reports. They contain no photos, names or closet contents, and are used to improve the app. You can turn this off and delete what was sent from the app.

The social feed (public)

The feed is optional and works differently from your closet: anything you post to it is public. When you post a look, the outfit photo you add (or the styled card built from your outfit), the caption, the style tags and the pieces in the look are shown to other people and stored on our server unencrypted — we can see them, and so can anyone using the app. Your public profile (username, display name, bio and avatar), the accounts you follow, and the likes, saves, comments, reports and blocks you make are stored on our server as well. Don't post anything you wouldn't want to be public, and don't post other people's photos as your own.

"Shop this look" opens a web search in your browser; the words searched (a colour and a type of garment) go to that search engine under its own privacy policy — we don't send your identity. You must be 18 or older to post. You can delete any post, block or report other people, and delete your whole account (which removes your profile and posts) from the app.

Ads and tracking

Musette is supported by ads. The feed and some other places show clearly labelled "Sponsored" ads, and they are tailored to you. Targeting is built from your style profile, from signals derived on your device from your closet (the raw closet is never sent — it stays end-to-end encrypted — only general keywords such as categories and colours leave the phone), and from your activity on the public feed: the posts you view, like, comment on and save, and the accounts you follow. Tapping an ad opens the advertiser's site in your browser and is counted as a click — that is how advertisers pay us.

With your permission, we also personalise ads across other companies' apps and websites using Apple's advertising identifier. We ask for this with the system App Tracking Transparency prompt; if you decline, ads are tailored only from the on-device and on-feed signals above, never a cross-app identifier. You can change this anytime in Settings → Privacy & Security → Tracking. We don't sell your closet, and your closet contents are never used to target ads off your device.

Resale listings you create are posted by you on Depop, Poshmark or eBay, under their privacy policies.

Keeping and deleting data

Deleting a profile, or Me → Delete all my data, removes everything on the device. Me → Account & sync → Delete account removes your account and synced closet from our server. Backups can be deleted from Me → Encrypted backup, and usage statistics from Me → Everyday. Booking records are kept as long as needed for accounting (usually 7 years for payments); to ask for access to or deletion of anything we hold, use Me → Send feedback in the app.

Children

Musette isn't directed to children under 13 and we don't knowingly collect their information.

Changes

If this policy changes in a meaningful way we'll say so in the app before it takes effect.

Musette · questions: use Me → Send feedback in the app.