Privacy Policy

01Who we are

Filo ("Filo", "we", "us") is operated by Brooklyn Venier, a sole proprietor based in Vancouver, British Columbia, Canada. Filo consists of the Filo iOS app, the Filo browser extension, and this website.

This policy explains how we handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA), and describes the rights available to users elsewhere.

02Your account

Filo works fully without an account. If you choose to create one, you sign in with Sign in with Apple. Filo never sees or stores your Apple ID password.

When you sign in, we store the following on our server:

Activity kept with your account

If you are signed in, we also keep:

• Counts of what you do: how many scans you have made, how many pieces you have saved, and how many times you have added a price. These are numbers only. They never say what was scanned or saved.
• Shop links you tap: when you tap through to a shop from Filo, we record the piece (its name, store, price, picture and Filo score) and the link. This is how a visit from Filo is credited to Filo.
• An invite code, if a friend's invite brought you to Filo.

If you are not signed in, none of this is kept against a person.

We use this to run your account, to know how many people have signed up, to make the options we show fit who you're shopping for, and to contact you about your account if we need to. We do not sell it, and we do not use it for advertising.

Your account is kept separate from your scans. A scan does not carry your account identifier, so we cannot look up what a signed-in person has scanned. See section 8.

To delete your account, go to Account → Delete my profile and data. This deletes your account record from our server, ends Filo's sign-in link with Apple, and erases everything Filo has stored on your phone.

03What stays on your device

The following is stored only on your phone and is never transmitted to us:

• Your saved closet: the pieces you've hearted
• Your style tally: the running count behind "Learn my style" (see section 5)
• Your preferences: currency and notification setting
• Who you're shopping for and your age range, if you are not signed in
• Your recently used store names

We cannot see this information, cannot recover it if you delete the app, and cannot sync it to another device. Deleting the app, or tapping Delete my profile and data in the app's Account tab, erases it permanently.

04What a scan sends us

To produce a verdict, the app sends the following to our analysis server:

The camera reads text on the label on your device. Video is never recorded, streamed, or uploaded. Only the resulting text is sent.

A scan carries no name, no email address and no account identifier, whether or not you are signed in.

If you add a garment photo

The photo is downscaled on your phone before it is sent. That re-encoding strips the file's EXIF metadata, including any GPS coordinates the camera attached. We deliberately never receive the location a photo was taken. The image is used to describe the garment's shape so we can search for better-made pieces in the same cut, and Filo does not store it after your result is returned. Our AI provider may keep it for a limited time under its own policy before deleting it.

05Learn my style

Every scan, every heart and every tap through to a shop says a little about what you are drawn to. If "Learn my style" is on, Filo keeps a running tally of this on your phone. Newer activity counts for more than older activity.

The tally itself never leaves your phone. What a scan sends is a short summary made from it: a few style words from a fixed list, and a few brand names. Nothing is sent until there is enough activity to go on.

Our server uses the summary for one thing only: to put the better-made options closest to your taste first. It is used to answer that one request and is not saved, not attached to your account, and not written to the Quality Record.

It never changes a score, and it never lets a piece past Filo's quality rules.

This is on by default. To turn it off: Account → Settings → Learn my style. When it is off, nothing is tallied and no summary is sent. Delete my profile and data wipes the tally.

06The Quality Record

Filo keeps an anonymous record of what brands are actually making. It is what lets Filo tell you how a label's cloth compares, and it is a product we may report on commercially in aggregate form.

When it is switched on, one row is written per action. The complete list of what that row can contain:

A row never contains your account identifier, your name, your email address, your age range, or your style summary.

This is on by default and disclosed in the app on the same screen as the switch. To turn it off: Account → The Quality Record → Contribute my scans. When it is off, no request is made at all. Nothing is queued, held, or sent later.

07What we never collect

• No account identifier on your scans. Scans are never stamped with your account, signed in or not.
• No device identifier. No IDFA, no IDFV, no fingerprint. Filo never shows the App Tracking Transparency prompt, because Filo does not track.
• No IP addresses kept by Filo. We do not store an IP address with a scan or with an account. Like any website, our hosting provider's logs record IP addresses for a short time to keep the service running and secure.
• No precise location. Location services are not used by the app at all. The finest geography we hold is a country code.
• No contacts, calendar, microphone, or health data.
• No browsing history beyond the retail pages where you actively use the browser extension, and only on sites you have explicitly enabled.
• No sale of row-level data or account data, ever, under any contract.

08Why your scans can't be joined together

The app generates a random session ID that lives only in memory. It is never written to storage, the keychain, or a file. It is regenerated every time the app launches and after 30 minutes of inactivity, so a "session" is one shopping trip, and quitting the app destroys it irrecoverably. It has no connection to your account, and it is the same kind of value whether you are signed in or not.

Our server never stores even that. It stores a keyed hash of it, computed with a salt that changes every day. Because the salt rotates at midnight UTC, two scans made by the same person on two different days produce completely unrelated values.

The practical consequence: building a per-person shopping history from Filo's data is not something we decline to do. It is something we cannot do. Nor can a buyer of our reports, an acquirer of the business, or anyone presenting a court order. The data does not exist in a linkable form.

09Camera, photos and notifications

• Camera. Used to read care labels and, if you choose, to photograph a garment. Nothing is recorded. Text recognition happens on your device.
• Choosing an existing photo. Handled by Apple's system picker, which runs outside the app. Filo receives only the single image you pick and has no access to your library.
• Saving a share card. If you save a verdict card, iOS asks for permission to add to your photo library. This is add-only. Filo cannot read your photos.
• Notifications. If you allow them, Filo's reminders are scheduled on your phone. We do not collect a notification token or any record of which reminders you open.

10Who else touches your data

We use the following service providers to run Filo.

• Apple — provides Sign in with Apple. Apple tells us who signed in and shares the name and email address you allow. Apple's own privacy policy covers what it holds.
• Railway — hosts our server and database. Account records and scan records are stored here. Scan records carry no account identifier.
• Anthropic — reads your optional garment photo into a plain description of the shape, and places the piece in the fashion calendar. It never receives your name, email address or account. It may keep a photo for a limited time under its own policy.
• SerpAPI — finds the better-made alternatives we show you, using the fibre and shape of the piece you scanned and, if "Learn my style" is on, your style words and brand names. It never receives anything identifying you.

We do not sell, rent, or share account data or row-level data with anyone, under any contract.

11Affiliate links

Some links to recommended products carry an affiliate tag. If you buy through one, the retailer may pay us a small fee, and the affiliate network may record that a purchase originated from Filo, along with a code identifying which recommendation it came from. That code describes the item and its score, not you.

Affiliate arrangements never influence which items appear or how they are ranked. Ranking is decided on quality before any affiliate step runs.

12How long we keep things

• Your account record and account activity: kept until you delete your account. Deleted from our server when you tap Delete my profile and data.
• Individual scan records: deleted after 400 days.
• Aggregate summaries: kept indefinitely. They contain no session values and describe groups, never individuals.
• Your closet and style tally: kept on your device until you delete them.
• Style summaries and garment photos: not kept by Filo after your result is returned. Our AI provider may hold a photo for a limited time under its own policy.
• Hosting logs: kept by our hosting provider for a short time.

13How aggregate reports work

Reports we produce or license are summaries only. A single module is permitted to return scan data, and every query it answers enforces a minimum cohort size, currently 30 separate sessions. A group smaller than that is not rounded, not blurred, and not footnoted. It is simply not returned.

No report we produce contains a row, a session value, an identifier, account information, or a timestamp finer than one hour.

14Your choices and rights

Your controls

• Use Filo without an account: skip sign-in. Everything still works.
• Delete your account and everything on your device: Account → Delete my profile and data.
• Stop style learning: Account → Settings → Learn my style → switch off.
• Stop contributing scans: Account → The Quality Record → switch off.
• Skip the optional fields: brand, store, item type, colour, price, photo and age range are all optional, and a scan works without any of them.
• Hide your email: choose "Hide My Email" when you sign in with Apple.

Access, correction and deletion

Under PIPEDA and BC PIPA, and under the GDPR and CPRA where they apply to you, you may ask what personal information we hold about you, ask us to correct it, and ask us to delete it.

Your account record and account activity: we can show it to you, correct it, or delete it. Write to us from the email address on the account, or delete it yourself in the app.

Your scan records: we have to be straight with you about a limit here. Because scan records contain no identifier and cannot be linked across days or to an account, we have no way to find "your" rows in order to show or delete them. There is no lookup key, by design. We are not withholding them; the connection between you and them does not exist.

If you have contacted us by email, we can show and delete that correspondence.

If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or to the Office of the Information and Privacy Commissioner for British Columbia.

15Children

Filo is not directed at children. You must be at least 13 years old to use it. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, write to us and we will delete it.

16Where your data is processed

Filo is operated from Vancouver, Canada. Account records and scan records are stored on servers in the European Union (our hosting provider's EU West region). Two processors we rely on to produce a result, our AI provider and our product-search provider, operate from the United States, and a scan's fibre composition, optional garment photo and optional style summary pass through them at the moment you request a verdict.

That means information you send us may be processed in Canada, the European Union, and the United States, and may be accessible to authorities in those countries under their own laws.

17Changes to this policy

If we change what we collect, we will update this page and move the "last updated" date at the top. If a change materially expands what we collect or what we do with it, we will say so in the app before it takes effect.

18Contact

Questions, requests, or complaints about privacy:

Brooklyn Venier
Filo
Vancouver, British Columbia, Canada
brooklynv@filoquality.com

We aim to respond within 30 days, and usually the same week.