OnU — Privacy Policy

Last updated: 17 October 2026
Provider: Nurlan Gasimov ("OnU", "we", "us"), United Arab Emirates
Contact: [email protected]

1. Summary

OnU is a virtual try-on app. You add two photos of yourself (front and side) and your height, and we estimate your measurements, suggest a size, and create images of you wearing the clothes you pick. We also learn your style from what you like, pass on and own, so we can suggest items and outfits.

We treat your body photos, and everything we work out from them, as sensitive data: they are stored privately, used only to measure you, dress you and suggest clothes, and you can delete everything from inside the app. We do not sell or share your data for advertising, and we do not track you across other apps. We do not use your photos to train our own models. OpenAI does not use our API inputs to train its models by default. Voyage's treatment of wardrobe and search inputs is described in section 5.

2. Data we collect

We do not request your precise device location, contacts, advertising identifiers or card numbers. Website providers may infer an approximate location from your IP address. We record the app steps listed above to understand where people leave the experience and improve it. The app has no third-party analytics or advertising SDK and does not track you across other apps. To show prices in your currency, the app sends your phone's currency and region settings (for example "AED" and "AE") with each request; we use them only to convert prices and do not store them.

Sensitive data. Your body photos, measurements, weight and colouring are sensitive. Skin tone in particular could be seen as revealing racial or ethnic origin. We use them only to provide the features you ask for (measuring, sizing, try-ons and colour and outfit suggestions). We never use them to infer your ethnicity, health or any other characteristic about you, for advertising, or to make decisions about you outside the app. Colour analysis is part of how OnU works and is covered by the consent you give before your first photo (section 3). OnU does not calculate a health score, diagnose a condition or use the photos or measurements to identify you biometrically.

3. How we use it, and on what legal basis

• Provide the Service you asked for: measure you, suggest sizes, create try-on images, keep your wardrobe, wishlist and history, and send the notifications you turned on.
• Personalise it: suggest items and outfits based on your style profile, wardrobe, measurements, colouring and searches. This is profiling, but it only changes what OnU shows you. We make no automated decisions that have legal or similarly significant effects on you.
• Improve the app: use the steps you reach and the purchase answers you choose to give us to see where people leave the experience and improve it.
• Keep it safe and affordable: authenticate requests, check photos, limit abuse, set fair-use limits and fix errors.
• Comply with the law and protect our rights.

Consent. Before you enter your height and weight or add a body photo, the app asks you to agree to our Terms of Use and to give your explicit consent to process your photos, height, weight, measurements and colouring as described here. We keep a record of which version you agreed to and when. You can withdraw your consent at any time by deleting your account; we then stop using and delete this data (section 8).

If you are in the EEA or UK, our legal bases are:

4. Who we share it with

We do not sell your personal information and do not share it for cross-context behavioural advertising. We disclose it only to:

• Service providers that process it for us (section 5). Voyage AI's possible use of wardrobe and search inputs to train or improve its models is explained below and may go beyond providing the Service to you;
• Stores whose sites you choose to open from OnU. Your device connects directly to that store, which receives your request and handles any checkout information you enter. The launch app opens the product URL supplied for that item; it does not add your OnU account ID or a per-user referral ID. Some product URLs may include retailer or referral parameters. We may earn an affiliate or referral commission when you click or buy through a link;
• Authorities or others where the law requires it, or to protect the rights, safety and property of you, us or others;
• A buyer or successor if we are involved in a merger, acquisition, financing or sale of assets, under the protections of this policy;
• Professional advisers (lawyers, accountants, insurers) under duties of confidentiality;
• Anyone else you ask us to.

No other OnU user can see your photos, measurements, wardrobe or try-ons.

5. Service providers

We also use AI services (OpenAI) to read public product pages and product photos, for example to find a size chart or tag a garment. Those requests contain no information about you.

OpenAI does not train its models on API data by default. Its abuse-monitoring logs may keep API inputs and outputs for up to 30 days, and longer in limited legal or safety cases; store=false on text requests does not disable those logs. We have not established that our account has zero-data-retention access. Voyage's published terms give it a perpetual licence to use the wardrobe item details and photos and search text we send to train or improve its models while our account is Opted In. Opting out later would apply only to content sent after the change. We cannot give a fixed deletion date for content previously sent to Voyage, and deleting your OnU account cannot undo any training already performed. Resend says it keeps email content and logs for 30 days on the Free plan. Purelymail keeps messages in the mailbox until we delete them, and its backups of deleted messages for up to one month.

6. Where it is stored, transfers, and who can access it

• Your data is stored with Supabase (US East, United States; us-east-2). Body photos, try-on images and wardrobe photos are kept in private storage that only our server can read. They are never public.
• We and our providers may process your data in the United States and other countries whose privacy laws differ from yours. Railway runs our server, and Purelymail hosts the support and privacy mailboxes. Their privacy policies and privacy information describe how they handle data on their services. Other providers and the data they receive are listed in section 5. Where transfer rules apply, we are responsible for putting the required safeguards in place; a provider's privacy policy alone is not a transfer agreement. Contact [email protected] if you want more information about a transfer affecting your data.
• On our side, access is limited to Nurlan Gasimov and any authorised personnel or contractors who need it to operate the Service or answer support requests, subject to appropriate access controls.

7. How long we keep it

• Body photos, measurements and colouring: for as long as you have an account, since every try-on and suggestion is made from them. They are deleted when you delete your account.
• Try-on images, wardrobe, style activity and profile, wishlist and history: until you delete them or your account. We do not place orders or process payments in the launch version; purchases happen on retailer sites.
• Waitlist email: until you ask us to delete it or the launch campaign closes. If you unsubscribe, we keep its opt-out marker only to prevent more launch emails; we will delete the entry when the campaign closes.
• Operational logs: Railway retains server logs for seven days on our current Hobby plan. Sentry error monitoring is not enabled in the production environment as of 17 October 2026. We do not intentionally log your photos.
• Usage records: kept as cost history. When you delete your account, your account id is removed from them, so they no longer relate to you.
• Product links you pasted: kept as anonymous store statistics once your account is deleted.
• Short-lived job status: expires within a day.
• Voyage inputs: Voyage may retain content previously sent to it, including wardrobe item details and searches, under its terms even after you delete your OnU account.

8. Your choices and rights

• Waitlist emails: use the unsubscribe link in a launch email to stop future launch updates, or email [email protected] to have your waitlist entry deleted.
• Delete your account and all your data: in the app, go to You → Photos and privacy → Delete account. This erases your body photos, measurements and colouring, try-on images, wardrobe items and their photos, style activity and profile, wishlist, history, saved outfits, address, suggestions and searches, device tokens, and your account itself. If you signed in with Apple, we also revoke OnU's access to your Apple ID. Deletion from the live account is immediate and cannot be undone. Supabase Pro keeps daily database backups for seven days; these include database records but not objects stored through its Storage API. A restored backup must have the deletion reapplied before it can be used to serve the app. Content already sent to Voyage is subject to the provider's retention and training terms; deleting your OnU account does not itself reverse model training.
• Notifications: turn them off in the app or in iOS Settings.
• Access, correction and a copy of your data: email [email protected] from the email address on your account. We will confirm the request comes from you before acting on it, and reply within the time the law requires (usually 30 or 45 days).

US state privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws), you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• correct inaccurate information;
• delete it;
• opt out of sale, sharing for targeted advertising, and profiling with significant effects. We do none of these, so there is nothing to opt out of;
• limit use of sensitive personal information. We use it only for the purposes the law allows without a request (providing the Service you asked for);
• appeal if we refuse your request: reply to our decision with "Appeal" in the subject. If you are unhappy with the outcome, you can contact your state's attorney general;
• not be discriminated against for using these rights.

You may use an authorised agent. We may ask the agent for signed proof that you authorised them, and ask you to confirm your identity with us.

California notice at collection. In the last 12 months we collected these categories (Cal. Civ. Code §1798.140): identifiers (name, email, account id, device token); customer records (saved delivery address); commercial information (wishlist); internet or other electronic activity (searches, style activity, logs); physical characteristics and sensitive personal information (body photos, height, weight, measurements, colouring); inferences (style profile, size suggestions). Sources, purposes, recipients and retention are in sections 2 to 7. We disclose them for business purposes only to the service providers in section 5. We have not sold or shared any personal information, and have no actual knowledge of selling or sharing information of anyone under 16.

European (EEA, UK and Swiss) rights

Nurlan Gasimov is the controller of your personal data. You have the right to access, correct, delete, restrict or object to our processing of your data, to receive it in a portable format, and to withdraw consent at any time (without affecting processing before you withdrew). Contact us at [email protected]. You can also complain to your local data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk).

DECIDE: if OnU is offered in the EEA or UK and the provider has no establishment there, appoint and name an EU representative (GDPR Art. 27) and a UK representative here. Or limit App Store availability to countries you are ready for.

9. Children and teens

OnU has no minimum age, but it is made for a general audience and is not directed to children under 13. If you are under 18 (or the age of majority where you live), a parent or guardian must agree to our Terms and give the consent in section 3 for you. In the EEA and UK, where you are below the age at which you can consent yourself (13 to 16, depending on the country), we rely on that parent or guardian's consent.

We do not knowingly collect personal data from children under 13 without verifiable parental consent. If we learn we have, we will delete it. If you believe a child under 13 has given us data, contact us.

10. Security

Everything travels over encrypted connections. Photos are kept in private storage that only our server can read, and every request must carry a valid sign-in token. No system is perfectly secure, but we work to protect your data, and we will notify you and the authorities of a breach where the law requires.

11. Changes

We may update this policy. Material changes will be reflected in the "Last updated" date and announced in the app before they take effect. If a change means using your sensitive data in a new way, we will ask for your consent again.

12. Contact

Questions or requests: [email protected], Nurlan Gasimov, Jumeirah Village Triangle, Dubai, United Arab Emirates.

_{Portions adapted from a template prepared and made publicly available by General Legal, PC under CC0 1.0. It is not legal advice and General Legal has not reviewed these adaptations.}