Security
How Clottr protects your photos and data
Your selfie and your wardrobe are personal, so we treat them that way: encrypted at every step, locked to your account and never used to train AI. Here is how it works.
Encryption and sign-in
Encrypted at every step
On your phone, on the way to our servers and in storage, your data is protected with standard, well-reviewed algorithms and ciphers, using the encryption built into iOS and Android. Connections are HTTPS only with TLS 1.2 or higher, clottr.ai enforces HTTPS with HSTS, and stored data is encrypted with AES-256.
Every request is verified
Clottr signs you in through Supabase Auth, which issues signed tokens (JWTs). Our servers check every token's signature against the provider's public keys and reject expired or tampered tokens before any data is touched.
Encrypted sessions
The app keeps your sign-in session encrypted on your device.
Your photos and data
Locked photos
Your photos are stored privately, in storage keyed to your account, and are never public. The app loads them only through short-lived signed links that expire on their own, and temporary photos are deleted automatically after 24 hours.
Metadata stripped
Photos you upload have their location and camera metadata (EXIF) stripped, so a picture never reveals where it was taken.
Your data is yours alone
Every account request is scoped to the signed-in user, so our servers only read or change data that belongs to you.
Identity kept apart
Personally identifiable data is stored physically separate from app data, in a different database schema, linked only by a random account ID.
Delete it all, any time
“Delete my data” in Profile settings removes your data from our active systems immediately, and encrypted backups are purged within 30 days.
Protection against abuse and AI misuse
Rate limits and quotas
Per-account rate limits and usage quotas apply to every AI feature, which stops abuse before it reaches our systems.
Shielded servers
Traffic reaches us through Cloudflare, which absorbs DDoS attacks. Our servers accept web traffic only from Cloudflare's network, and internal services are not reachable from the internet.
Prompt-injection review
AI prompts are screened automatically before they reach our AI, to catch hidden instructions that try to hijack it.
Content moderation
Images you upload and images we generate for you go through automated content moderation, which blocks prohibited content, especially nudity.
Safe link imports
When you import a product from a link, Clottr only fetches public web addresses. Private and internal network addresses are blocked, and every redirect is checked again.
No AI training on your data
Your photos, wardrobe and chats are never used to train AI, and our contracts forbid our AI providers from training on them too.
How we build and run Clottr
Audit logging
Activity on our systems is recorded in audit logs, with a request ID and the account behind it, so we can trace and investigate what happened.
Security scanning in CI
Our code and its dependencies are scanned automatically for known vulnerabilities as part of continuous integration.
Secrets stay secret
Keys and passwords are never stored in source code, and error messages never reveal internal details.
Payments without card details
Purchases go through the App Store or Google Play, so we never see your card details, and payment notifications to our servers are verified.
Breach response
If a breach ever affects your data, we notify the data protection authority within 72 hours and tell affected users without undue delay.
Report a security issue
Found a vulnerability or something that looks wrong? Email us with the steps to reproduce it and what an attacker could do with it. We check daily. Response within a week. Please don't access, change or delete other people's data, and give us reasonable time to fix the issue before you share it.
Security contact
support@clottr.aiThe same contact is listed in our security.txt.
Frequently Asked Questions
Is my data encrypted?
Yes, at every step: on your device, on the way to our servers (TLS 1.2 or higher) and in storage (AES-256), using standard algorithms and ciphers built into iOS and Android.
Who can see my photos?
You, in your account. Photos are stored privately and loaded only through short-lived signed links. Moderation is automated, and nobody on our team looks at an image unless it is reported, you send it to us, or the law requires it. Our AI providers process your photos to generate your try-ons but may not train on them.
How does Clottr stop prompt injection?
Every prompt is screened automatically before it reaches our AI, to catch hidden instructions and prohibited requests.
How do I report a security issue?
Email support@clottr.ai with the steps to reproduce the issue and what an attacker could do with it. We check daily. Response within a week.
Stop guessing. Start wearing.
Join early. Discounted for life.