Judger — Privacy Policy
Last updated: 20 October 2026
Version: 1.3
1. Who we are
Judger is operated by:
Orvex Labs s.r.o.
Kurzova 2222/16, 155 00 Prague 5, Czech Republic
Company ID (IČO): 29820260
Email: info@orvexlabs.cz
We are the data controller for the personal data described in this policy.
2. The short version
- No account. No name, no email address, no password, no social login.
- Your photos are not stored on our servers. A photo is held in server memory only for as long as it takes to analyse it, then discarded. It is never written to a disk or backup.
- Your photo is sent to two AI providers: to OpenAI (United States) to be checked for safety, and to Microsoft Azure OpenAI (European Union, Sweden) to be rated. The text that comes back is then checked by OpenAI as well. You are asked for explicit, separate consent inside the app before any of this happens for the first time.
- The same applies to a "duel", where you compare two outfits: both photos go through the same two steps.
- We keep the text of the result, not the picture. Score, style archetype and written feedback are stored against an anonymous device identifier.
- We do not sell or share your personal information for advertising or any other cross-context purpose.
3. What we do not collect
We do not collect your name, email address, phone number, postal address, date of birth, contacts, precise location, advertising identifiers, or biometric templates. We do not build a profile of you as a person, and we do not track you across other apps or websites.
Judger has no user accounts. You are identified only by a randomly generated device identifier (a UUID) created the first time you open the app.
4. Photos — exactly what happens
- You take or select a photo in the app.
- Your device resizes it, removes EXIF metadata (including any location data) and compresses it.
- The photo is uploaded over an encrypted HTTPS connection to our server in Germany.
- The photo is held in server memory only. It is never written to disk, never placed in object storage, never included in our logs and never included in our backups.
- The photo is transmitted to two providers, for two different purposes: to OpenAI (United States) for an automated safety check, and to Microsoft Azure OpenAI (European Union, Sweden region) for the outfit rating itself. Sent with it are the occasion you picked, the mode (honest or roast) and the style preferences you gave during onboarding — your style goals, the aesthetics you chose, the gender presentation you selected for styling vocabulary, and your self-rated confidence. No identifier is sent with the photo.
- The text the rating produced — not the photo — is sent to OpenAI (United States) for an automated check that it says nothing about your body, face or person. This step never receives the image.
- When the request finishes, the photo is discarded from memory.
- The copy of the photo you see in your in-app history is stored on your device only. It never leaves your phone a second time, including when you create a share card — that image is rendered locally on your device.
Duels work the same way. When you compare two outfits, both photos go through steps 1–7 above, together, in a single request. Neither is stored by us.
About our AI providers' retention. Neither provider uses your photo to train its models.
OpenAI — the automated safety check of the photo, and the automated check of the generated text — may retain API inputs and outputs for a limited period (up to 30 days at the time of writing) for abuse monitoring, after which they are deleted.
Microsoft Azure OpenAI — the rating — processes the photo under Microsoft's abuse-monitoring terms for the Azure OpenAI Service, which also retain inputs and outputs for up to 30 days for that purpose, after which they are deleted. This is a separate arrangement from OpenAI's, governed by the Microsoft Products and Services Data Protection Addendum.
Each provider's handling of that data is governed by its own terms and privacy commitments.
5. What we store on our servers
| Data | Example | Why |
|---|---|---|
| Anonymous device identifier | random UUID | to link your subscription and your free scan to your device |
| Platform and app version | ios, 1.0.3 | compatibility, troubleshooting |
| Rating record | score, style archetype, confidence, occasion, mode, the written feedback text, response time, our cost of the AI call | to show you your result and history, to monitor quality and cost |
| Subscription status | trial / active / expired, product, expiry date | to know whether you can scan |
| Duel record | which outfit won, the written comparison, technical metadata | to show you your result and history |
| Moderation record | the reason a photo was refused, and when | to prevent misuse of the service |
| Billing event archive | the subscription event we receive from RevenueCat, as sent, including your anonymous device identifier | to reconcile subscriptions and resolve billing disputes |
| Consent record | that you consented to AI processing, when, and which version of the notice | to demonstrate we obtained consent |
We never store the photo itself.
6. Why we process your data, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the rating service you asked for | Performance of a contract — Art. 6(1)(b) |
| Sending your photo to OpenAI for the automated safety check, and to Microsoft Azure OpenAI for the rating | Your consent — Art. 6(1)(a), collected on a separate screen in the app |
| Sending the generated rating text (never the photo) to OpenAI for an automated safety check of that text | Our legitimate interest in not showing you abusive output — Art. 6(1)(f) |
| Managing subscriptions and entitlements | Performance of a contract — Art. 6(1)(b) |
| Preventing abuse, fraud and misuse (rate limits, moderation records, temporary blocks) | Legitimate interests — Art. 6(1)(f): keeping the service safe and financially viable |
| Diagnosing crashes and errors | Legitimate interests — Art. 6(1)(f): keeping the app working and fixing faults we would otherwise not see |
| Understanding how the app is used, measured against your anonymous device identifier | Legitimate interests — Art. 6(1)(f): knowing which parts of the product work before we build more of them |
| Temporarily blocking a device after repeated refused photos | Legitimate interests — Art. 6(1)(f): stopping deliberate misuse of the service |
| Complying with tax and accounting obligations | Legal obligation — Art. 6(1)(c) |
You can object to processing based on legitimate interests at any time (see Section 12).
No automated decisions with legal effect. The score Judger gives you is an opinion about clothing, generated by an AI model. It has no legal or similarly significant effect on you within the meaning of Article 22 GDPR. One other step is automated: if several of your photos are refused by the safety check in quick succession, the app stops accepting scans from your device for a short period. That block is temporary, applies only to this app, and you can write to us if you think it is wrong.
Do you have to give us this data? There is no statutory obligation. The anonymous device identifier and the subscription record are necessary for the service to work at all — without them we cannot tell whether you may scan. Sending the photo is entirely your choice: if you do not consent, no photo is sent and the rating feature is unavailable, while the rest of the app keeps working.
Where data does not come from you. Your subscription status does not come from you directly. Apple reports your purchase to RevenueCat, which tells our server that a device identifier is entitled, with the product and the expiry date. We receive no name, email address or payment-card data from that path.
7. Your consent to AI processing
Before your first photo is ever sent for analysis, Judger shows you a dedicated screen explaining that the photo will be transmitted to OpenAI for a safety check and to Microsoft Azure OpenAI for the rating. Consent is given by an explicit tap on that screen; nothing is pre-selected and nothing is consented to by default. If you do not consent, no photo is sent and the rating feature is unavailable — the rest of the app remains usable.
You can withdraw your consent at any time in Settings → AI processing consent. Withdrawing consent stops any further photo from being sent. It does not affect the lawfulness of processing that already took place, and it does not automatically delete records already stored — to delete those, use the deletion option described in Section 12.
8. Who else processes your data
| Provider | Role | Where |
|---|---|---|
| OpenAI, L.L.C. | automated safety check of the photo, and automated safety check of the generated rating text | United States |
| Microsoft Ireland Operations Limited (Azure OpenAI Service) | outfit rating | European Union (Sweden Central) |
| RevenueCat, Inc. | subscription validation and management | United States |
| Functional Software, Inc. d/b/a Sentry | crash and error reporting from our servers and from the app, configured to strip personal data | European Union (Germany) |
| PostHog, Inc. | product analytics, tied to the anonymous device identifier only (see section 11) | European Union (Germany) |
| Hetzner Online GmbH | server hosting | Germany |
| 650 Industries, Inc. (Expo) | delivering over-the-air app updates; your device contacts the update service on launch, which sees its IP address and the app version | United States |
| Apple Inc. | payment processing and app distribution (Apple is the merchant of record for your purchase) | United States / Ireland |
Each of these providers acts on our instructions under a written data processing agreement, except Apple, which acts as an independent controller for payment data under its own privacy policy.
Judger is currently distributed on iOS only. If we release on Google Play, Google LLC will join this list in the same role as Apple and we will update this policy first.
9. International transfers
Our servers are in Germany, and your photo is rated inside the European Union (Microsoft Azure OpenAI, Sweden Central region). Your photo nevertheless leaves the European Economic Area for one step: the automated safety check, which OpenAI performs in the United States. The automated check of the generated text happens there too.
Where personal data goes outside the EEA, this is the safeguard each recipient relies on:
| Recipient | Safeguard for the transfer |
|---|---|
| OpenAI, L.L.C. | EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). OpenAI is not certified under the EU–U.S. Data Privacy Framework. |
| Microsoft Ireland Operations Limited | The rating itself stays in the EU. For any transfer that does occur (for example support or diagnostics), Microsoft's Data Protection Addendum makes the 2021 Standard Contractual Clauses the operative basis. Microsoft is additionally certified under the Data Privacy Framework. |
| RevenueCat, Inc. | EU Standard Contractual Clauses. RevenueCat is not certified under the Data Privacy Framework. |
| Functional Software, Inc. d/b/a Sentry | EU–U.S. Data Privacy Framework, with Standard Contractual Clauses as a fallback. |
| PostHog, Inc. | EU–U.S. Data Privacy Framework and, in addition, Standard Contractual Clauses. Our analytics data is in any case hosted in the EU. |
| 650 Industries, Inc. (Expo) | Standard Contractual Clauses. |
| Apple Inc. | Apple acts as an independent controller for payment data and transfers under its own published safeguards. Apple is not certified under the Data Privacy Framework. |
You can request a copy of the relevant safeguards by writing to info@orvexlabs.cz.
10. How long we keep data
| Data | Retention period |
|---|---|
| Photo | Held in memory only, for the duration of the request (seconds). Never persisted by us. |
| Rating and duel records (score, style archetype, feedback text, technical metadata) | 90 days — deleted by a nightly job, so in practice at most 91 days. Before deletion, the data is folded into daily statistics that contain no device identifier and cannot be linked back to you. |
| Anonymous daily statistics | Kept indefinitely. This data is no longer personal data. |
| Moderation records (refusals, temporary blocks) | 6 months |
| Subscription records | Kept for as long as your device record exists. They are needed to know whether you may scan, and to handle refunds, chargebacks and billing disputes. |
| Billing event archive (RevenueCat events) | Kept for as long as we need it to reconcile subscriptions. It is not removed by "Delete my data" — see Section 12. |
| Consent record | Kept for as long as your device record exists, as the demonstration that consent was given |
| Device record | Kept until you delete it with Settings → Delete my data. We do not currently expire inactive devices automatically. |
| Crash and error reports | Per Sentry's retention settings, currently 90 days |
| Server logs (including the IP address your device connects from) | Not kept for a fixed period. Log files rotate by size, so older entries are overwritten as new ones arrive — in normal operation this is a matter of days. We do not archive them. |
| Database backups | Encrypted nightly dumps of the database, kept 7 days and then deleted. A record you delete survives in these backups until the last dump containing it rotates away. |
| Short-lived response cache | Up to 10 minutes, so that a repeated request does not re-run a paid scan. It holds the result text against your device identifier and then expires on its own. |
| Your in-app history | Stored on your device for as long as you keep the app installed. Deleting the app deletes it. |
We delete data earlier if you ask us to (Section 12).
11. Analytics
We use PostHog (EU cloud, hosted in Germany) to understand how the app is used in aggregate — for example, how many people finish the onboarding questions, or how often a scan fails. Analytics events are tied to the anonymous device identifier only. We do not create user profiles, and we do not use analytics for advertising. The judger.app website uses the same PostHog EU analytics without cookies and without any identifier stored on your device, so a page view cannot be linked to you or to a later visit; your IP address reaches PostHog as part of the request and is used for security and coarse aggregation only, never for profiling.
12. Your rights
If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to:
- access the personal data we hold about you;
- correct data that is inaccurate;
- delete your data ("right to be forgotten");
- restrict or object to processing based on legitimate interests;
- portability — receive your data in a machine-readable format;
- withdraw consent at any time;
- complain to a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection — Úřad pro ochranu osobních údajů, Pplk. Sochora 727/27, 170 00 Prague 7, https://www.uoou.cz. You may also complain to the authority in the country where you live.
The easiest way to delete everything: Settings → Delete my data. This immediately and permanently removes the server-side records linked to your device — rating and duel history, subscription status, moderation records, the consent record and the device record itself. It also clears the history stored on your phone. It cannot be undone.
To exercise access or portability, write to info@orvexlabs.cz from the device concerned and we will send you what we hold in a machine-readable file. There is no self-service export in the app.
Three things to know before you delete:
- If you have an active paid subscription, deleting your data does not cancel it. Cancel through the App Store or Google Play. You can restore your entitlement afterwards using Restore purchases.
- Because we have no account system, we cannot verify identity by email. Deletion is therefore performed from within the app on the device concerned. If you no longer have the device, contact us at info@orvexlabs.cz — but be aware that we may be unable to locate your records, precisely because we hold nothing that identifies you.
- Two things survive the button, and we would rather say so than let you discover it: the billing event archive we receive from RevenueCat, which we keep to reconcile subscriptions and which we delete on request by e-mail; and encrypted database backups, from which a deleted record disappears when the last dump containing it rotates away, within 7 days.
For any other request, write to info@orvexlabs.cz. We respond within 30 days.
13. Additional rights for United States residents
California (CCPA/CPRA)
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act as amended by the CPRA. We have not done so in the preceding 12 months, and we have no plans to. Because we do not sell or share, there is no "Do Not Sell or Share My Personal Information" link to provide.
Categories of personal information collected in the preceding 12 months, using the CCPA's own categories:
| CCPA category | What it is here | Business purpose | Disclosed to |
|---|---|---|---|
| Identifiers | a randomly generated device identifier (UUID) | running the service, linking your subscription to your device | the processors in Section 8 |
| Commercial information | subscription status, product, expiry | knowing whether you may scan | RevenueCat, Apple |
| Internet or other electronic network activity | app version, platform, crash and error diagnostics, product-usage events | fixing faults, improving the product | Sentry, PostHog, Expo |
| Visual information | the photograph you submit | producing the rating. Processed transiently; we do not retain it | OpenAI, Microsoft Azure OpenAI |
| Inferences | the style archetype and score the model produces about the outfit | showing you the result and your history | stored by us |
We do not collect the categories the CCPA treats as sensitive personal information for the purpose of inferring characteristics, and we do not use or disclose sensitive personal information beyond what is needed to provide the service. We retain each category for the periods in Section 10.
Your California rights: to know what we collect and how we use it; to delete it; to correct it; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information (we do not use it in a way that triggers this); and not to be discriminated against for exercising any of them. We do not offer financial incentives.
How to exercise them: Settings → Delete my data in the app, or write to info@orvexlabs.cz. Because we hold no name or email, we verify a request by the device it comes from; an emailed request we cannot tie to a device may be one we are unable to action, and we will tell you if that happens. You may use an authorised agent; we will ask for written proof of their authority.
Other United States states
If you live in Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana or another state with a comprehensive privacy law, you have broadly the same rights — to access, correct, delete and obtain a copy of your personal data, and to opt out of targeted advertising, sale and profiling with legal effects, none of which we do — and you exercise them the same way: Settings → Delete my data, or info@orvexlabs.cz. Where your state gives you a right to appeal a refused request, write to the same address and we will respond with our reasons.
14. Children
Judger is not intended for anyone under 16, and the Terms of Service do not permit it. During onboarding we ask your age on a wheel that starts at 16, so a lower age cannot be entered; we do not otherwise verify age, and we do not pretend to. Our automated moderation separately refuses photos where the person appears to be a minor.
Judger is not directed to children, and we do not knowingly collect personal data from anyone under 16. Because the app is not directed to children under 13 and we do not knowingly collect their data, the U.S. Children's Online Privacy Protection Act (COPPA) does not apply to it.
If you believe someone under 16 has used the app, write to info@orvexlabs.cz. We will delete the associated records without asking you to prove anything.
15. Security
All traffic is encrypted in transit (HTTPS/TLS). Our AI provider keys are held only on our servers and are never present in the app. Access to production systems is limited to the company's founders and protected by two-factor authentication. Error reports are configured to strip personal data before they are sent: on our servers before they leave them, and in the app before a crash report leaves your device. Because we do not store photographs, a breach of our systems cannot expose your photographs.
No system is perfectly secure, and we cannot guarantee absolute security.
16. Changes to this policy
If we make a material change we will update the version number and date above and show a notice in the app before the change takes effect. If a change requires your consent, we will ask for it separately.
17. Contact
Orvex Labs s.r.o., Kurzova 2222/16, 155 00 Prague 5, Czech Republic
info@orvexlabs.cz