Privacy Policy
Effective 26 October 2026
This policy explains what information Drape Inc. ("Drape", "we", "us") collects when you use the Drape mobile app and this website, how we use it, and the choices you have. Drape Inc. is the controller of your personal information. Questions: hello@drape.life.
What we collect
| Information | Where it comes from | Why we need it |
|---|---|---|
| Email address | You, or Google / Apple when you sign in with them | To identify your account and contact you about it |
| Waitlist email and preferred platform | You, when you join the iOS or Android app waitlist | To manage the waitlist and tell you when the app is ready |
| Name | You (optional), or Google / Apple if you share it | To greet you in the app |
| Basket selections and cart association | Items and quantities you add, and a cart identifier issued by Shopify | To maintain your basket, show current prices and availability, and open Shopify checkout |
| Profile photo (optional) | A photo you select or a selfie you choose to capture on this website | To save and display your private profile photo. We resize it and remove photo metadata before storing it |
| Google or Apple account identifier | Google / Apple, when you sign in with them | To recognise you the next time you sign in |
| Password | You, if you create an account with email | To let you sign in. We store only a salted, one-way hash, never the password itself |
| Sign-in sessions | Created when you sign in | To keep you signed in. Session tokens are stored on our servers only as hashes, in secure storage on the mobile app, and in browser session storage on the website until the tab session ends or you log out |
| Account dates | Recorded automatically | When your account was created and when you last signed in |
| IP address and request details | Your device, when it talks to our servers or this website | To run and secure the service, for example to limit repeated sign-in attempts |
The Drape app does not currently use advertising, analytics or tracking tools, and it does not access your location, contacts, photos or camera. If that changes, we will update this policy before the change takes effect. On this website, you can optionally select a photo or grant camera access to take a selfie for your profile.
Sign in with Google and Sign in with Apple
If you choose Google, Google shares your name, email address and Google account identifier with us. We do not use your profile picture or any other Google data, and we do not request access to your Google services such as Gmail, Drive or Contacts.
The website login page and the homepage sign-in dialog load Google's Identity Services library to display its sign-in button. Google receives connection information such as your IP address and browser details when that library loads. Choosing Google sign-in opens Google's account chooser and consent flow. Email sign-in remains available. Matching Google and email sign-ins use the same Drape account. When Google verifies an email/password account that was not yet verified, we remove its old password and revoke its prior sessions to protect the verified email owner.
Drape's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
If you choose Apple, Apple shares an Apple account identifier and an email address. If you choose Hide My Email, that is a private relay address that forwards to you, and we never see your real address. Apple shares your name only the first time you sign in, and only if you allow it.
How we use your information
- To create and run your account and keep you signed in.
- To manage the app waitlist and send launch updates to people who join it.
- To keep the service secure and to prevent abuse and fraud.
- To answer you when you contact us.
- To meet our legal obligations.
We do not sell your personal information, share it for cross-context behavioural advertising, or use it to make decisions about you that have legal or similarly significant effects.
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performing our contract with you (running your account), our legitimate interests (keeping the service secure), and legal obligation where it applies.
Who we share it with
We share personal information only with service providers that help us run Drape, under contracts that limit their use of it to providing their service to us:
- DigitalOcean hosts our servers and database, in its Bangalore, India data centre.
- Google and Apple provide sign-in, if you use them.
- Google Fonts serves the typefaces used on the website and receives connection details such as your IP address and browser information when the fonts load.
- Vercel hosts this website and keeps standard request logs.
- Shopify maintains shopping carts and provides checkout, payments and order confirmation. Basket selections, quantities and connection information are shared to provide these features.
We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger or acquisition, in which case this policy continues to apply to your information.
International transfers
Drape Inc. is based in the United States, and our servers and database are in India. Your information is therefore transferred to and processed in India and the United States, which may not have the same data protection laws as where you live. Where the law requires it, we use appropriate safeguards for those transfers, such as the European Commission's Standard Contractual Clauses.
How long we keep it
- Account information, including your profile photo, is kept until you delete your account. Replacing your photo removes the previous photo from the active database.
- Waitlist details are kept until you ask us to remove them or the waitlist is no longer needed.
- A sign-in session ends when you log out, or after 60 days without use.
- The link between your Drape account and your Shopify cart is kept until account deletion, or replaced when the cart expires or is no longer available. Shopify retains its cart and order records under its applicable privacy policy and legal obligations.
- Records used to limit sign-in attempts are kept for a few minutes. Server and website logs are kept only as long as our hosting providers retain them for operating and securing the service.
When you delete your account, we delete your account information and all of your sessions from our database. Backups are overwritten on a rolling basis.
Your choices and rights
You can ask us to remove your waitlist email by writing to hello@drape.life.
You can delete your account at any time. See how to delete your account. Depending on where you live, you may also have the right to:
- access the personal information we hold about you and get a copy of it;
- correct information that is wrong;
- have your information deleted;
- object to or restrict some processing; and
- complain to your local data protection authority.
To use any of these rights, email hello@drape.life from the address on your account. We will reply within 30 days, and we will not treat you differently for using them.
Website accounts and store
You can register or log in on this website using the same email account as the Drape app. Essential browser session storage keeps you signed in within your tab session. We do not use it for advertising or tracking. Logging out revokes that session and clears the stored tokens.
Our backend copies public product information from Shopify to provide the store feed. Drape does not send your account details to Shopify to load this feed. Product images are served by Shopify or the image host, which receives your IP address and request details when images load. If you follow a product link, you leave Drape for the shop, where its own privacy and cookie policies apply.
When you add items to your basket, our backend sends the selected product options and quantities to Shopify and stores a private cart identifier against your Drape account. Shopify provides current cart totals and availability. Your Drape password and profile photo are not shared. We do not automatically sign you into a Shopify customer account or send your Drape email address to prefill checkout.
When you choose Continue to secure payment, you leave this website for Shopify checkout. You provide contact, shipping and payment information directly there. Shopify and its payment providers process the payment and provide order confirmation. Drape's backend does not receive or store card details, shipping addresses, payment status or order history in this integration. Deleting your Drape account does not automatically erase Shopify's order records; contact hello@drape.life for help with order-related requests.
Your profile photo and camera
After login, we invite you to add a photo if you have not saved one. You can choose Not now, or upload a replacement later in Settings. Camera access starts only when you choose Take a selfie and grant your browser permission. Audio is not requested. Only the still photo you capture and then choose to save is uploaded; we do not record or upload video.
Profile photos are stored privately in Drape's database on DigitalOcean in Bangalore, India. They are available only through your authenticated account, not public photo URLs, and are not sent to Shopify. We do not use them for face recognition, biometric identification or AI training. Selected photos are resized, and embedded metadata such as GPS is removed. Photos selected but not saved are not uploaded. Browser permission can be withdrawn in your browser settings.
Automatic AI try-on previews
When you have a saved profile photo, the store automatically sends that photo and product reference images through OpenRouter to Google's image generation service. These services process the images and editing instructions to create previews of you wearing the products. Processing may take place outside your country. Their privacy policies and service retention rules apply: OpenRouter and Google. We do not send your email, account credentials, basket or payment details with generation requests.
Previews are AI approximations and do not guarantee appearance, sizing or fit. Your saved original photo and generated previews remain private to your Drape account. Generated images are saved in our private database and reused for the same user and item on future visits, without repeated generation. Changed photos or product references require new previews. Re-saving the same photo keeps existing previews. Account deletion removes saved previews. We also keep daily generation counts for usage limits until account deletion. Adding a profile photo is optional; users without one can browse product images. Requests already sent may finish at the provider. We do not use these photos for biometric identification or train models ourselves.
Security
All traffic between the app and our servers is encrypted with HTTPS. Passwords and session tokens are stored only as one-way hashes, and sign-in attempts are rate-limited. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your information, we will tell you as the law requires.
Children
Drape is not directed to children under 13 (or under 16 in the EEA and UK), and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.
Changes to this policy
We will post any changes on this page and update the date at the top. If a change is significant, we will also tell you in the app or by email before it takes effect.
Contact
Drape Inc. · hello@drape.life