Privacy policy
This policy explains what personal data the Lona app handles, why, where it goes, how long it's kept, and what your rights are. Lona is made by an individual developer in the Netherlands. "We" and "us" in this policy mean the developer of Lona; "you" means the person using Lona.
The short version
- Your closet, photos, outfits and settings are stored only on your iPhone. Lona has no user accounts and doesn't sync them to iCloud or anywhere else. We can't see them.
- Lona's AI features use Google's Gemini AI. Nothing is sent to it until you agree, and you can turn AI off at any time in Me → Privacy & AI. The rest of the app works without AI.
- AI requests pass through Lona's own server on Google Cloud in the Netherlands. It checks your AI allowance and passes your photos and text on to Google without storing them.
- The server keeps a small record of your AI allowance, filed under a coded (hashed) version of your Apple identifiers: no name, no email, no photos. It's deleted automatically 400 days after you last used AI.
- Google keeps AI requests for up to 55 days to detect abuse, and also stores requests that use Google Search for 30 days. It doesn't use what Lona sends to train its AI.
- Subscriptions are sold and paid through Apple. We never see your payment details. No ads, no analytics, no tracking.
1. Who is responsible
The controller of your personal data under the EU General Data Protection Regulation (GDPR) is:
The developer of Lona
The Netherlands
Email: support@trylona.com
We haven't appointed a data protection officer, as the law doesn't require one for us. For anything about privacy, email us at the address above.
2. What stays on your iPhone
Lona saves these things in its own storage on your iPhone:
- your clothes and wishlist pieces: their photos, names, brands, categories, sizes, prices, store links, tags, fit and notes;
- your outfits and outfit categories;
- your face photo, and your full-body photo if you add one;
- your try-on body: man or woman, body type and height;
- your colours: hair, skin and eye colour, undertone and palette;
- the AI pictures made for you: your full-body look and your try-ons;
- your settings and your AI choice.
Lona doesn't sync any of this to iCloud or to us. If you back up your iPhone (to iCloud or a computer), the backup includes Lona's data, as it does for other apps; Lona leaves some caches, such as its store of recent try-on pictures, out of backups.
Lona also keeps three small items in your iPhone's Keychain, marked "this device only", so they're never synced to other devices: a random install number made by the app, the reference to the App Attest key described in section 4, and the app's own count of your AI allowance. iOS doesn't remove Keychain items when you delete an app, so these can stay on your iPhone after you delete Lona. They contain no photos and nothing about your closet, and they're removed when the iPhone is erased.
When you use Share → Lona in another app, the link or photo is put in a folder that only Lona and its share extension can open on your iPhone. Lona takes it when it opens and empties the folder.
3. AI features and Google Gemini
Only with your consent
Before anything goes to the AI, Lona shows an AI & your photos screen explaining what's sent, to whom, why and for how long. If you choose Not now, AI stays off and the rest of Lona works without it. The app checks your choice right before every AI request leaves your iPhone. You can withdraw your consent at any time in Me → Privacy & AI: from then on nothing more is sent. Withdrawing doesn't undo what was sent before (see how long data is kept). If what Lona sends, to whom or why changes, the app asks you again.
What's sent, by feature
- Your full-body look: your face photo, your full-body photo if you added one, and your try-on body (man or woman, body type and height).
- Try-ons: your full-body look, and the photos, short names, kinds and fit of the clothes you're trying on. Lingerie, underwear and full swimwear are never sent for a try-on; Lona tells you they can't be tried on with AI. If Google refuses a try-on, Lona may send the identical, unchanged request up to three times in all, and then remembers the refusal on your iPhone for 7 days so it isn't sent again by itself.
- Adding clothes and clean product photos: the photos or order screenshots you add (an order screenshot can show your name or address, so crop it first), and photos from a store's product page, to find each piece, read its details and make a clean product photo. When a store photo shows a model, the model's face is removed on your iPhone first where possible.
- Tags and colour checks: photos of your clothes and their details. While AI is on, these run by themselves after you add clothes.
- "Goes with your closet": photos and details of a piece and of the clothes you own.
- Your colours: your face photo and a close-up of your eyes (cut out on your iPhone), and later the colouring you set.
- Shop a screenshot: the screenshot or photo you add, including anyone in it.
- Help me decide: what you type, descriptions and small photos of the clothes you have on and the clothes you own, and the AI picture of you in the outfit once it's made.
- Style me and "Where to buy": what you type (for example the occasion), and descriptions and small photos of your clothes or of the piece you're looking for. "Where to buy" also sends the country or region set on your iPhone, to suggest shops that deliver there. Only "Where to buy" uses Google Search through Gemini. It shows Google's search suggestions with its results, and tapping one opens Google Search in your browser.
- With Style me, Help me decide and "Goes with your closet" Lona also sends whether you chose woman or man for your try-on body and, once you have them, your colouring and palette, so the suggestions suit you.
Your face photo, and pictures made from it, are only used for your full-body look, try-ons, your colours and Help me decide, and only after you've ticked This is a photo of me. Please only add photos of yourself.
How a request travels
Each AI request goes from your iPhone, over an encrypted connection, to Lona's server on Google Cloud in the Netherlands (region europe-west4). The server checks the request and sends it on to Google's Gemini API, and the answer comes back the same way. Together with the photos and text, the app sends:
- Apple's signed record of this app on your Apple Account, or of your Lona Plus subscription, so the server knows which allowance to use (see section 4);
- a short-lived App Check token showing the request comes from the real Lona app (see section 4);
- the random install number from your iPhone's Keychain, the app's build number, and which feature the request is for.
The app also asks the server how much of your allowance is left, with the same records but no photos or text: when it opens, and when you look at your plan.
The server reads the request only to check that it has the expected form and to work out what it costs. It holds your photos, your text and the AI's answer in memory only while the request is running (at most about three minutes) and never writes them to a disk, a database or a log. It asks Google not to store the request as a conversation (store: false).
What Google does with it
Google uses what Lona sends only to produce the result you asked for. Under Google's terms for the paid Gemini API:
- Google keeps all requests and answers for up to 55 days to detect and prevent abuse of its policies. If something is flagged, authorised Google staff may review it.
- Requests that use Google Search ("Where to buy") are also stored for 30 days to provide the search results, and Google may use them to debug and test the systems behind its Search grounding.
- Apart from that, Google doesn't use what Lona sends to improve its products or train its AI.
Google handles this under the Gemini API Additional Terms of Service, Google's data processing terms and the Google Privacy Policy.
4. Lona's server: what it keeps
No account, no name
Lona has no sign-up. To know whose allowance to use, the server relies on records that Apple signs and that the app reads on your iPhone:
- the app transaction ID: one number per Apple Account for this app, which stays the same when you reinstall or move to a new iPhone;
- for a subscriber, the original transaction ID of the subscription.
The server checks Apple's signature, then turns each ID into a code with a keyed one-way hash (HMAC-SHA256) using a secret key that only the server holds. Only this code is stored or logged, never the ID itself. Apple's IDs don't tell us your name or email address, and the code can't be turned back into the ID.
Apple's signed records contain more than these IDs, for example the dates, price, currency and App Store country of a purchase. The server reads them to check them and keeps only what's listed below.
What's stored
In a Google Cloud Firestore database in the Netherlands (europe-west4), which no app or website can reach: only Lona's server, and we as its administrators (see section 16), can read or write it:
- Your allowance record, filed under the code of your app transaction ID: how many free try-ons you've used, whether you've had your free look, today's AI use (credits used, requests that were refused or failed and given back), how much background AI (tags, colours, recognising clothes) was used today and this month, and the date the record expires.
- Your plan record, if you subscribe, filed under the code of your subscription's original transaction ID: which plan, its allowance for the current period and how much of it is used, Apple's reference number for the current billing period, the purchase date, when the period ends, whether Apple reported a refund or revocation, today's AI use, and the date the record expires.
- Daily totals of AI spending for the whole app, which aren't about any one person.
Each record is deleted automatically 400 days after it was last used: using AI moves that date forward. A record is only made once you use AI, with one exception: if Apple reports a refund or revocation of a Lona Plus subscription, the server makes or updates that subscription's plan record even if you never turned AI on (see below).
Refunds reported by Apple
Apple tells Lona's server when a subscription is refunded or revoked, or when a refund is reversed. The server then marks the plan record (and makes one if there wasn't one yet), so a refunded plan stops giving AI. Nothing else from these notices is kept.
Server logs
For each request the server writes one log line with fixed fields only: what happened, which feature and AI model, the result code, how long it took, sizes in bytes, the AI's token counts and number of searches, the first 16 characters of the code described above, the kind of account (free or subscriber), whether it was a test purchase, error codes, the App Check result, and credits charged or given back. A log line never contains your photos, anything you typed, the AI's answer, or an Apple ID. These logs are kept in Google Cloud Logging for 30 days and then deleted.
Your iPhone's IP address is necessarily seen by Google Cloud when it connects, as with any internet connection. Lona's server doesn't store it: Google Cloud's automatic request logs, which would record it, are switched off for Lona's server.
Checking it's the real app: App Attest and App Check
To keep Lona's AI from being used by anything other than the real app on a real iPhone, Lona uses Apple's App Attest and Google's Firebase App Check. Your iPhone creates a key in its secure hardware, and Apple certifies that it belongs to a genuine copy of Lona. The app exchanges that certificate, and later signatures made with the key, with Firebase App Check for a token that's valid for about an hour and goes with each AI request. This involves the key's identifier and Apple's certificate, not your photos or your name, and isn't used to follow you across apps or websites. It only happens once AI is on.
The random install number
The install number the app sends is a random number with no link to you or your device. The server doesn't store it. It's only meant for a fallback for iPhones that can't supply Apple's record; that fallback is switched off. If we ever switch it on, the server would file an allowance record under a code of the install number, and we'll update this policy first.
5. Subscriptions and Apple
Lona Plus subscriptions are sold, billed and renewed by Apple through the App Store, under Apple's own terms and privacy policy. Apple handles your payment details, name and email address; we never receive them. The app asks Apple on your iPhone whether you have an active subscription, and sends Apple's signed record of it to Lona's server as described in section 4. Apple gives us sales and subscription reports that don't name you.
If you've chosen in your iPhone's settings to share analytics with app developers (Settings → Privacy & Security → Analytics & Improvements), Apple may send us anonymous crash reports and usage statistics. That's Apple's service, and your choice.
6. Store pages and the built-in browser
Lona has a built-in browser for shops. Store pages load directly from the store on your iPhone, like in Safari:
- when you open a store, a product link, or a store or Google Shopping search, in Shop or from "Where to buy";
- when you share a product page to Lona, or tap Try on me;
- when Lona gets the photos of a product's other colours;
- when Lona checks the price of a wishlist piece you turned on Watch price for (it's off until you do). This happens only while the app is open, for each piece at most every 12 hours (or when you pull down the wishlist), and not in Low Data Mode.
Product photos are downloaded straight from the store too. When you share a social media post to Lona, its preview picture is loaded on your iPhone from that site.
Like any website, a store or site you visit sees your IP address, can set cookies and can run its own analytics. The browser keeps cookies and website data on your iPhone, like a normal browser; deleting Lona removes them. Each site's own privacy policy applies to its pages, and those sites are responsible for what they do. We don't receive anything about what you do on them.
7. Camera, photos and notifications
- Camera: used only when you choose to take a photo. iOS asks for your permission first.
- Photo library: iOS's photo picker gives Lona only the photos you pick. Lona saves a picture to your library only when you choose to save one.
- Notifications: Lona only sends price-drop alerts. They're made on your iPhone, not sent from a server. iOS asks for permission the first time a price drops, and you can turn them off in Settings.
8. No ads, analytics or tracking
Lona has no ads, no analytics, no crash-reporting service and no tracking. The app contains no third-party code (it talks to Firebase App Check directly, without Google's SDK). Lona doesn't use the advertising identifier and doesn't ask to track you. We don't sell your data or share it for advertising.
9. Why we may use your data (legal bases)
| What | Legal basis |
|---|---|
| Sending your photos, body details, colouring and text through Lona's server to Google Gemini for the AI features | Your consent (GDPR Art. 6(1)(a)). Where a photo or your colouring could count as a special category of data, for example by revealing ethnic origin, your explicit consent (Art. 9(2)(a)). You can withdraw it at any time. |
| Checking Apple's records and keeping your allowance and plan records, including refunds Apple reports | Performing our agreement with you: giving you the free allowance and the subscription you bought (Art. 6(1)(b)); and our legitimate interest in stopping the free allowance from being claimed over and over (Art. 6(1)(f)). |
| App Attest and App Check, daily limits, app-wide spending limits and server logs | Our legitimate interests in keeping the service secure, preventing fraud and abuse, keeping AI costs under control and fixing faults (Art. 6(1)(f)). |
| Answering your emails, and handling reports about AI pictures | Our legitimate interest in helping you and keeping Lona safe (Art. 6(1)(f)), or performing our agreement with you (Art. 6(1)(b)). |
| Keeping what we must by law, or need for a legal claim | A legal obligation (Art. 6(1)(c)), or our legitimate interest in establishing or defending legal claims (Art. 6(1)(f)). |
Where we rely on legitimate interests, you can object (see your rights). You don't have to give Lona any personal data: without AI consent, the closet, outfits and Shop still work. AI does need Apple's record, so it isn't available if you're not signed in to the App Store.
10. Who receives data
- Google Cloud runs Lona's server, its database and its logs, as our processor under Google's data processing terms.
- Google Firebase App Check checks that requests come from the real app, as our processor under Google's data processing terms for Firebase.
- Google's Gemini API makes the AI pictures and answers, as our processor under Google's data processing terms, and keeps requests for the abuse monitoring described in section 3.
- Apple sells and bills subscriptions, provides App Attest and signs the records described above. Apple does this as an independent controller under its own privacy policy.
- Our email provider holds the emails you send us.
- Stores and other websites you open in the built-in browser are independent controllers of what they collect.
- Authorities, only if we're legally required to share something.
11. Transfers outside the EU
Lona's server and its database are in the Netherlands. Google's Gemini API and Firebase App Check may process data in any country where Google has facilities, including the United States, and server logs may be stored outside the EU. Apple may also process data outside the EU. Google LLC and Apple Inc. are certified under the EU-US Data Privacy Framework, which the European Commission has found to give adequate protection. Where that doesn't apply, transfers are covered by the European Commission's Standard Contractual Clauses in Google's and Apple's data processing terms. Email us for more information about these safeguards.
12. How long data is kept
| Data | Kept for |
|---|---|
| Your closet, photos, outfits and settings on your iPhone | Until you delete them or the app |
| Install number, App Attest key reference and allowance count in the Keychain | Until the iPhone is erased (iOS keeps them after the app is deleted) |
| Photos, text and AI answers passing through Lona's server | In memory only, while the request runs |
| Allowance and plan records on Lona's server | 400 days after last use, then deleted automatically |
| Server logs | 30 days |
| Requests and answers at Google Gemini | Up to 55 days for abuse monitoring (all requests); requests using Google Search are also stored for 30 days |
| App Check tokens | Valid for about an hour |
| Emails and image reports you send us | Up to 12 months after your question or report is closed, unless needed longer for a legal claim |
| Purchases at Apple | As set out in Apple's privacy policy |
13. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict its use, to object to uses based on our legitimate interests, to receive data you gave us in a portable format, and to withdraw your consent at any time (this doesn't affect what was done before).
- On your iPhone you control everything yourself: delete pieces, outfits, your face or body photo (in Me → Privacy & AI), or the whole app. The support page explains how.
- On Lona's server, records are filed under a code, so we can't look you up by name or email. To find your record, we'll ask for something that lets us work out the code. For a subscription, that's the Order ID in Apple's receipt email, which we can look up with Apple. For a free account we may not be able to find your record; if so, the law doesn't require us to collect extra data to identify you (GDPR Art. 11), and the record is still deleted automatically 400 days after its last use.
- At Google, requests already sent are kept for the times in section 12; we can't delete them.
To use your rights, email support@trylona.com. We answer within one month; if a request is complex, we may extend that by up to two months and will tell you why.
You can also complain to a data protection authority: in the Netherlands the Autoriteit Persoonsgegevens, or the authority where you live or work. We'd appreciate the chance to sort it out with you first.
14. Automated limits
Lona's server automatically applies your allowance and its daily limits (for example up to 80 try-ons a day), and pauses AI if Google is unavailable or app-wide limits are reached. Google's safety filters may refuse to make some pictures. None of this is a decision with legal or similarly significant effects on you.
15. Under 18
Lona is only for people aged 18 and over, and is rated 18+ in the App Store. Google's terms don't allow Gemini in apps for people under 18. If you think someone under 18 has used Lona, deleting the app removes their data from the iPhone; email us about any server record.
16. Security
All connections use HTTPS. The database can't be reached by apps or from the internet: only Lona's server, through its own service account with limited rights, and we, as the administrators of the Google Cloud project, can open it. Secret keys are kept in Google Cloud Secret Manager, not in the app. Apple's transaction IDs are only stored as keyed hashes (the plan record keeps Apple's reference number for the current billing period as Apple sends it), and the server never stores photos or text. No system is perfectly secure; if a breach puts your data at risk, we'll act on it and inform the Autoriteit Persoonsgegevens and, where we can reach you, you, as the law requires.
17. Changes to this policy
We'll update this page and its date when Lona changes how it handles data. If what the app sends to the AI, to whom or why changes, Lona asks for your consent again before sending anything.
18. Contact
Questions about privacy, or anything else: email support@trylona.com, or tap Contact support in Me → Privacy & AI.