Privacy, clearly explained.

What the current application uses

A guest shopping list uses a signed, secure browser cookie containing item numbers, selected sizes, quantities and a form-security token. It is not encrypted and is not synced. When a shopper is signed in, the account shopping list stores item numbers, selected sizes and quantities in the private application database so the list can support future approved channels. Cart audit records contain a pseudonymous subject and action only; they do not include contact details, prices, retailer sources or account session tokens.

The adult sample sizing tool processes the entered waist value against a fictional chart without saving it. A separate subscriber-sizing foundation is available only behind a verified account, active sizing entitlement, explicit adult-managed consent and a separately configured encryption key. It encrypts the measurement profile before storage, keeps values out of URLs/browser storage/audit records, and supports permanent profile deletion. No paid-plan enrollment or production entitlement issuer is connected.

When approved account delivery is configured, sign-in uses a contact address or number, a short-lived challenge, a code digest, a browser binding, session-token digests and abuse-control records. Staff access and account changes create audit records. Contact and database protection, retention, deletion, backups and operational log access require production review.

When private requests are configured, an authenticated adult-managed account can save an idea or help request with explicit consent. Messages are encrypted with a separate support key. The owner alone can review them after recent verification; managers and employees have no request access. Account receipts contain type/topic/item/channel/status, not the message body. Withdrawal removes the stored message but retains a minimal receipt, integrity digest and audit metadata to prevent duplicate resubmission. It is not deletion of every operational record or backup. No reply, callback or resolution time is promised; do not include passwords, codes, payment details or measurements.

Private by design, verified before launch

Trend-source configuration is not part of public catalog records. No advertising trackers or third-party image hosts are used in these shopping screens. Going to an original retailer site is a separate service with its own privacy practices.

Services that are not live

Subscriber image previews, paid-plan enrollment, phone shopping and picture replies are still planned. Personalized sizing must remain unavailable for real customers until approved entitlements, verified retailer charts, production key management, retention/deletion operations and independent review are complete.

Before real customer use

The owner must provide an actual support contact, define retention and deletion procedures, verify processor agreements and publish a legally reviewed privacy notice for the launch locations. This draft does not promise rights-request features that have not been implemented.