Effective October 14, 2026 · v1.2
Privacy Policy
October 14, 2026: Closetbook is now called CLZT and lives at clzt.app (closetbook.app forwards there); our contact addresses moved to @clzt.app. Nothing else in this document changed.
In plain words: CLZT holds photos of your clothes, the trips you plan, what you wore and, if you tell us, your first name, age range, gender, home city and sizes. Photos are cut out and matched to products inside your browser; a photo leaves your device for our AI only when you tap "Suggest tags" or ask where to buy something, and the AI does not keep it or learn from it. Your closet is private unless you share a piece, a look, a trip or your whole account. Shop links on shared pages can set an affiliate cookie in the shopper's browser; we tell the network which page a click came from, never who you are. We build anonymous reports for brands from totals across at least 50 people, city level at most, never anyone under 18, and you can switch that off with one tap. We do not sell your photos or your personal information, run no ads and no ad trackers. You can download everything and delete your account any time.
Who is responsible for your data ("controller"): CAMMY LLC, a Florida limited liability company, 1738 SW 57th Ave, Unit # A505, Miami, FL 33155, USA. CLZT is a product of CAMMY LLC. Contact for all privacy matters: [email protected].
This policy covers clzt.app (and its www form and our preview address capsule-3rt.pages.dev), the public pages we serve for shared looks, trips, packing lists and creator profiles, any CLZT mobile app we later release, and related services (the "Service"). It is part of the Terms of Service.
1. What we collect, why, and on what legal basis
| What | Details | Why we use it | Legal basis (GDPR / UK) |
|---|---|---|---|
| Account | An email address and either a password or the six-digit codes we email you. There is no guest mode and no anonymous account. The version of the Terms you accepted and when. | Signing you in; keeping your closet across devices; proving you agreed | Contract; legal obligation (acceptance record) |
| Welcome details (all optional) | First name; age range (13–17, 18–24, 25–34, 35–44, 45–54, 55+); gender (a chip, or your own words); home city (typed, or found from your location once, see the location row); sizes for tops, bottoms and shoes. Shown to no one but you and, for city and sizes, used as described in this table. | Defaults in the app (what to suggest, what to call you); keeping people under 18 out of reports and the creator programme; matching sizes when you look for a product; shops near you | Contract; legitimate interests (age protections) |
| Your closet | Photos of your clothes (background cut out in your browser), the tags you or the AI give a piece (category, colour, material, warmth, formality, pattern, fit), what you paid, the size, how it came (bought, gift, second-hand), notes, a shop link, your affiliate link, and a visibility setting per piece (Only me, My circle, Everyone). Pieces you mark Only me are seen by no one but you. | Running the closet, outfit engine, packing lists, cost per wear; showing pieces to the people you choose | Contract |
| Photos of you and others | Posts can be photos or short videos of an outfit being worn. We do not run face recognition or any biometric analysis on any photo; the AI reads garments, not faces. Post only yourself or people who agreed (see the Community Guidelines). | Your posts and creator page | Contract |
| Trips | Stops, dates, what each day holds, laundry days, who is travelling, the pieces you packed, outfits by day, locks, "not this" choices, the packing list. A trip is private unless you share it. | Dressing and packing the trip | Contract |
| Wear log | For each day you log: the pieces, the outfit, the source (Today, a trip, a catch-up), the city and country, that day's high, low and rain chance, an occasion if you gave one. | Cost per wear, "back in rotation", better suggestions; anonymous reports (section 5) | Contract; legitimate interests (reports; you can opt out) |
| Inspiration shelf (planned) | Images, links and notes you save, and a style profile (a numeric summary of your saved images and loved looks computed in your browser, not a photo) stored on your closet. Private by default. | Ranking suggestions by your taste; "do I own one like it?"; where to buy | Contract |
| Circle and loans | Who you invited and who joined (an invite code, its expiry, how many used it); friends; loan requests and answers; the piece lent, the dates, a note, the trip it was for; hand-off and return photos; what your circle logged as worn (shown to the circle only, with the pieces they allowed). | Lending and borrowing between friends; reminders | Contract |
| Posts, follows, votes | Posts (photo, video or look, the pieces tagged, a caption, whether a poll is on), who follows whom, thumbs up or down on posts. Public accounts can be followed by anyone; private accounts reach their circle only. | The feed and creator pages | Contract |
| Creator profile | A handle, display name, bio, avatar, and social links you add; whether your account is public; which pieces are "Everyone". Public once you make the account public. | Your creator page at clzt.app/u/handle | Contract |
| Shared pages | When you share a look, a trip or a packing list we take a snapshot (the pieces, photos, names, shop links, and for a trip the stops, dates and weather) and publish it at an unguessable address. It is a public web page: anyone with the link can open it without signing in, and social networks and search engines may preview and index it. Views of the page and clicks on its links are counted (referrer of the page, the piece clicked, the kind of link; never the visitor's name). | The pages you publish; your view and click counts under Me | Contract |
| Shop clicks and attribution | When a visitor clicks a shop link on a shared page we log the page, the piece, the kind of link (yours, ours, direct) and the referring page, and set a first-party cookie cb_ref in the visitor's browser for 7 days holding the page and piece number. If that visitor adds a piece from the same shop within 7 days, the page gets the credit. Affiliate networks set their own cookies (section 4). | Counting clicks for creators; attributing sales; paying creator shares | Legitimate interests (measuring the pages people publish); consent where the law requires it for cookies |
| Placements and payments | If you buy a placement: your Stripe customer and subscription identifiers, the reach you chose and until when it is paid. Stripe handles the card on its own page; we never see the number. If you take part in the creator programme: your Stripe connected-account identifier and whether it is ready to be paid, your click and commission ledger, tax status flags. Stripe holds your identity, bank and tax details, not us. | Billing; paying you; tax and audit records | Contract; legal obligation (tax) |
| Location | We never ask for or store precise location. Home city: you type it, or tap "Use my location" once and your browser sends a point to our server, which asks OpenStreetMap for the nearest city name and keeps only the name. Weather: when you plan a trip or open Today, we send the city's coordinates and the dates to Open-Meteo, never anything about you. Shops near you: if you use it, your current point goes to our server and on to OpenStreetMap to list shops nearby; it is not stored. Our host, Cloudflare, sees your connection's country for security and for the EU/UK sign-up gate. | Weather-aware outfits; your city on wear logs; shops nearby | Consent (device location); contract (city you typed) |
| Usage events | A first-party event log for the A/B read-out and to see which features work: an event name, a few properties (for example which design, which button), the design you use, your user id or, for guests, a random anonymous id kept in your browser, and the time. No third-party analytics, no advertising identifiers, no cross-site tracking. | Understanding which of our designs and features people use | Legitimate interests (improving the Service); consent where the law requires it (see the Cookie Notice) |
| Preferences | Your chosen design and style (Galaxy, Lookbook, Utility), temperature unit, feed view, and a few "seen this" flags, kept in your browser and, for the design, on your account. | The look you chose on every device | Contract |
| Push tokens (planned) | If you turn notifications on, a browser push subscription. | The morning look, the "did you wear it?" question, loan and family reminders you asked for | Consent (withdrawable in your browser or under Me) |
| Moderation records | Reports you make or receive, hidden-content states, appeals, strikes, suspensions. | Keeping the Service safe; App Store obligations | Legitimate interests; legal obligation |
| Support | Emails you send us and our replies. | Answering you | Legitimate interests |
| Server and security logs | Our host's request logs (IP address, user agent, URL, time), used for security and debugging, not joined to your closet. Crash reports (device model, OS, app state) if we add a crash reporter; we will name it here first. | Security; fixing bugs | Legitimate interests |
What we deliberately do not do: no ads, no ad trackers, no third-party analytics, no data brokers; we do not sell your wardrobe photos, your closet, or your personal information; no precise location, ever; no contact-list access; no face recognition; no training of AI models on your content; no public profile unless you make your account public; nothing about anyone who gave the age range 13–17 in any report.
2. Where your photos live and who can open them
Closet photos and post media are stored in our database provider's storage, one folder per account, and served at permanent, unguessable web addresses that carry no name: random addresses that are not listed anywhere and cannot be guessed. Anyone who holds such an address can open that one image without signing in, which is what lets a shared page, a circle view or a link preview show it. An address stops working when you delete the piece or your account (caches may take a short time to clear). Nothing lets anyone list your folder or browse from one photo to your account. Pieces you keep as Only me are never placed on any page other than your own screens.
3. The AI, and what leaves your device
Most of the work happens in your browser: the background cut-out (an open-source model loaded from a public CDN), and the matching model that turns a photo into a numeric fingerprint to find look-alikes and duplicates (Marqo FashionSigLIP, downloaded once from Hugging Face and cached by your browser). For those steps the photo never leaves your device; the fingerprint, a list of numbers that cannot be turned back into the photo, is sent to our database to compare with the catalogue and is not stored.
A photo, or text about your closet, goes to a server only for these features, each one triggered by you:
| Feature | What is sent | To whom | Kept? |
|---|---|---|---|
| Suggest tags on a piece | The cut-out photo | Cloudflare Workers AI (vision models: Moondream, Llama 3.2 Vision), running on Cloudflare's network | Cloudflare does not retain inputs or use them to train models under its terms; we keep only the tags |
| Outfit ideas, "Ask Closet", Not this | The day's plan and weather, the pieces' tags (never prices or notes), your free-text feedback | Cloudflare Workers AI (Llama 3.3 text model) | Same; we keep the resulting rules on your account |
| Plan it for me | The trip description you typed | Cloudflare Workers AI (text model) | Same; we keep the trip you accept |
| Where to buy, for a piece on a receipt | The shop's name and the product's name, colour and style code as they appear on a receipt you forwarded (never the order number, your address or payment details) | SearchAPI.io, which runs a Google search restricted to the shop's own site | Used only when the receipt itself has no link to the product; the answer is the shop's page for that piece |
| Where to buy / look-alikes on the web | The public address of the cut-out photo (no account information) | SearchAPI.io, which runs a Google Lens product search | SearchAPI.io and Google process the image under their own terms; we cache the answer for a week. Used only if our own catalogue has no match, and only for pieces you are sharing or asked "where to buy" about |
| Shop link reading | The product URL you pasted | The shop's page, fetched by our server | Product facts (name, brand, price, stock, image) join the shared catalogue with no link to you |
| From your receipts | The text of an order email you forwarded to your private CLZT address (sender, subject, the product lines, prices, sizes and colours we found in it). Before that text leaves our server we remove email addresses, phone numbers, street addresses, postcodes, card numbers and the name in the greeting | TypeSafe AI (the Jev model), which answers which lines are pieces you bought and which size, colour and price go with each | TypeSafe does not use requests to train its models; we keep only the pieces found (name, shop, order number and date, size, colour, price, a copy of the product photo) and a line per email (shop, subject, kind, how many pieces). The email itself is not stored |
| Trends digest | Nothing of yours; we read public fashion feeds | Cloudflare Workers AI | The digest is stored per account |
The shared catalogue. Product facts read from shop pages (name, brand, category, colour, price history, stock, the shop's product image and a fingerprint of it) are pooled across all users so that "do I own one like it?" and "where to buy" work. The catalogue never records who owns what, who pasted which link, or any photo of yours.
Humans. Nobody at CAMMY LLC looks at your photos as a matter of course. A person may see a photo or post that has been reported, that our systems flag as breaking the rules, or that you send us when asking for help. We do not review or annotate your content to train models.
Outputs can be wrong. Tags, outfits, trip plans and product matches are produced automatically and can be inaccurate. You decide what to keep.
4. Sharing, public pages and shop links
Who sees what is set by you, per piece and per account (Terms of Service, section 5). Two things to know:
- People you share with can share onward. A friend in your circle, a follower, or anyone with a shared page's link can screenshot or forward what they see. Once something is outside CLZT we cannot recall it.
- Shared pages are indexed. Public pages are built to be previewed by messaging apps and social networks and may be indexed by search engines while they are live. Stop sharing to take a page down.
Affiliate cookies. Shop links on shared pages may be routed through an affiliate network (currently Skimlinks or Sovrn Commerce; we may add others such as Impact, Awin, CJ or Rakuten Advertising). When a visitor clicks, the network records the click and sets a cookie in that visitor's browser so the shop can credit a later purchase; the shop sees the network, not CLZT or the creator. We pass the network an identifier for the page and piece, never the visitor's or the creator's name or email. Amazon links go straight to Amazon. Visitors can decline cookies in their browser; the links still work. A creator's own affiliate link (LTK, ShopMy, Amazon Associates, a brand programme) is used exactly as given, and that programme's privacy policy governs its tracking.
Where a visitor is a CLZT user, our own cb_ref cookie (section 1) may credit the creator if the visitor adds a piece from the same shop within 7 days. That credit is a count on the creator's dashboard; it does not tell the creator who you are.
5. Anonymous reports for brands and retailers
CLZT may sell reports to brands and retailers built from anonymous totals across its users: for example how often a product is worn in its first 90 days, what it is worn with, in which cities and in which weather, or how long a category stays in rotation. The rules, which are product rules and not just policy:
- a total is only reported when it covers at least 50 people;
- nobody who gave the age range 13–17, and no child closet, is ever counted;
- nothing finer than a city; never an address, a route, or a date tied to a person;
- never names, emails, handles, individual closets, photos, prices you paid, notes, loans or trips;
- reports contain totals, not rows; no report can be joined back to a person;
- we publicly commit not to re-identify report data and not to try, and every recipient signs a contract that forbids re-identification and onward sharing of the tables.
Reports are on by default for adults and you can leave with one tap under Me › Your data; from then on nothing of yours is counted, and we record when you changed the setting. Leaving does not affect anything else in the Service.
We also compute totals for ourselves (how many pieces, trips, looks; which design people choose) under the same rules.
6. Who processes data for us (subprocessors)
| Provider | Role | Where |
|---|---|---|
| Supabase | Database, authentication and sign-in emails, photo and media storage | United States (us-east-1) |
| Cloudflare | Website hosting and edge functions, Workers AI (the AI features in section 3), email forwarding for [email protected] and receiving the receipts you forward to your CLZT address, country detection, bot protection | Global network; AI inference in Cloudflare data centres |
| Open-Meteo | Weather forecasts and past weather for the coordinates and dates of a trip or your city | EU (Germany) |
| OpenStreetMap (Nominatim and public Overpass mirrors) | City names from a point; shops nearby | EU and other volunteer-run servers |
| SearchAPI.io (and Google through it) | Web image search for look-alikes when our catalogue has no match, and a search on a shop's own site for a piece named on a receipt you forwarded (only when enabled) | US |
| TypeSafe AI | Reading receipts you forward to your CLZT address (section 3) | US |
| Stripe | Placements billing; creator payouts (Stripe Connect); identity, bank and tax details for creators | US |
| Skimlinks, Sovrn Commerce (and other affiliate networks we add) | Wrapping shop links on shared pages; click and commission tracking | US / UK |
| Hugging Face, jsDelivr | Serve the in-browser models and libraries to your browser (they see your IP address when the files load, nothing else) | US / global CDN |
| A push-notification service (planned) | Delivering notifications you turn on | to be named here before launch |
We have, or will sign before the first outside user (README), data-processing agreements with the providers that process personal data for us. We also disclose data if legally compelled (a court order or valid legal process), to protect someone's safety, to enforce our Terms, and in a merger, acquisition or sale of assets, in which case this policy continues to apply to the data transferred.
7. International transfers
CAMMY LLC is a US company and your data is stored in the United States. If you use the Service from the EEA, UK or Switzerland, your data is transferred to the US and to the providers above. Where a transfer mechanism is required we rely on the EU Standard Contractual Clauses, the UK Addendum, or the provider's certification under the EU–US Data Privacy Framework, per each provider's data-processing agreement. Because the controller itself is in the US, the transfer to us happens when you use the Service; the safeguards above cover onward transfers.
EU/UK representative: CAMMY LLC has not yet appointed representatives under GDPR Art. 27 or UK GDPR. Until counsel has cleared the EU side, sign-ups from the EEA, UK and Switzerland are gated (you can leave an email to be told when CLZT opens there).
8. How long we keep things (retention)
| Data | Kept for |
|---|---|
| Closet, trips, wear log, inspiration, posts, loans, profile | Until you delete the item or your account |
| Receipts you forward | The email is read when it arrives and not stored. Pieces found wait under Closet › From my receipts until you add or skip them, or delete your account; the list of emails received (shop, subject, kind, count) is kept for 13 months |
| Photos and media | Until you delete the piece, the post or your account; storage objects are removed within 24 hours and caches clear within 7 days |
| Guest accounts never claimed | Deleted after 90 days of inactivity |
| Shared-page snapshots | Until you stop sharing or delete your account; view and click counts stay as numbers with no page attached |
| Click log for shared pages | 13 months (the longest network attribution window plus dispute time), then reduced to totals |
cb_ref attribution cookie | 7 days in the visitor's browser |
| Usage events | 13 months, then only totals |
| Terms-acceptance record | Life of the account, then 1 year |
| Brand-report opt-out record | Life of the account |
| Creator commission ledger, payout and tax records | 7 years after the last payout (tax law), even after account deletion |
| Placement billing records | 7 years (tax law) |
| Moderation and fraud records | Up to 2 years, or as long as legally required |
| Support emails | 2 years |
| Server and security logs | Up to 30 days |
| Backups | Rolling backups of the database are kept up to 30 days; deleted data leaves them on rotation |
When you delete your account (Me › Delete account, or by email), your closet, photos, trips, wear log, posts, loans, circle links, profile, preferences and sign-in identity are deleted at once; the storage objects behind your photos are removed and caches purged as above. What survives is not about you as an individual: anonymous totals already computed, the shared catalogue's product facts, the commission and billing ledgers we must keep for tax, and your friends' copy of any loan record with your name replaced.
9. Your rights
Everyone: you can see, download, correct and delete your data in the Service (Me › Your data; Me › Delete account) or by emailing [email protected]. We answer within 30 days and never charge for a first request. We may need to confirm you control the account, by a confirmation from within the Service or a code sent to the email on the account; for guest accounts with no email, the only way to verify you is from the browser that holds the session.
EEA, UK and Switzerland: you additionally have the rights to restrict or object to processing (including to any processing based on legitimate interests, such as reports and usage events), to data portability, to withdraw consent without affecting earlier processing, and to complain to your data-protection authority (in the UK, the ICO).
California: we do not "sell" or "share" personal information as the CCPA/CPRA defines those terms: we pass no personal information to affiliate networks (the network sets its own cookie on its own domain when you click a shop link, and you can decline it in your browser), and brand reports are de-identified aggregate data that we commit not to re-identify. We do not use or disclose sensitive personal information for purposes that require a limitation right. You have the rights to know, delete, correct, and not to be discriminated against for exercising them. We honour Global Privacy Control signals where the law requires. Other US states (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and others): we apply the same rights nationwide, including the right to opt out of profiling and targeted advertising, neither of which we do.
Other countries (Canada, Brazil, Australia and others): we apply this policy globally: minimal collection, no selling, deletion on request.
10. Children and teenagers
CLZT is for people 13 and older (16 where local law sets the age of digital consent there; the EU gate applies for now). We do not knowingly collect data from anyone under 13; if we learn we have, we delete the account and its data. Tell us at [email protected].
For accounts that gave the age range 13–17: nothing is counted in any report; they cannot join the creator programme, connect Stripe or buy placements; and we recommend they keep their account private. A child closet is a parent's data about their own child, held under the parent's account, with no login, no page and no post for the child; it never appears in a circle feed or a report, and it is deleted with the parent's account. A family closet kept for another adult (a partner) is held the same way until that person takes it over: then its pieces, looks, plans and wear log move into their own account, and the family keeps only the rights that person sets (see the closet, pack for them on trips, edit pieces) and can end at any time.
11. Security
Your data is protected by access rules enforced at the database and storage layer (each row and each photo folder is readable and writable by its owner only, and cross-person reads go through functions that return only what is shareable), by encryption in transit, and by secrets kept outside the codebase. Public pages are snapshots that contain only what you chose to publish. No system is perfectly secure; if a breach affects you we will notify you and regulators as the law requires.
12. Changes
We post changes here with a new version and date, and announce material changes in the Service at least 14 days before they take effect. We never backdate an effective date. Prior versions are available on request.
Contact: CAMMY LLC · 1738 SW 57th Ave, Unit # A505, Miami, FL 33155, USA · [email protected]