Security & Data Tenancy

Last updated: August 2026

1. Isolation

Member records, wardrobe archives, measurements and generated specifications are scoped to your account and access-checked on every request. Cross-account access is prevented in code.

2. Authentication

We issue signed, short-lived JWT credentials with server-side revocation. You can invalidate active sessions across all devices from your account.

3. Encryption

Traffic is served over TLS. Passwords are salted and hashed with bcrypt. Card data is handled by Stripe and never touches our servers.

4. Your data, in your hands

You can export a structured copy of your data, or delete your account and personal data — including stored photos and connected calendar details — directly from your Account settings.