1. Who we are
This Privacy Policy explains how Prime Root Labs (“Retroza,” “we,” “us,” or “our”) handles information when you use the Retroza mobile application, website, and related services (collectively, the “Services”).
2. Information we collect
Information you provide
- Photos and user content: clothing photos, scan results, collection items, folders, wishlist items, and notes you choose to create.
- Account information: Retroza begins with an anonymous account. If you choose Sign in with Apple, we may receive your Apple account identifier and, depending on your Apple choices, a name and email address or private relay email.
- Support communications: information you send when contacting us for help or feedback.
Information collected through use
- Account and installation identifiers used to operate accounts, synchronize data, prevent abuse, and enforce free-scan limits. We store a server-keyed fingerprint of the local installation identifier, not the raw value.
- Scan status, usage counts, timestamps, app configuration, error information, and service diagnostics.
- Subscription entitlement information, such as whether Retroza Pro is active and its expiration status. Apple and RevenueCat process purchase details.
Retroza does not use the Apple advertising identifier (IDFA) and does not collect data for cross-app tracking.
3. How we use information
We use information to:
- identify and analyze items submitted for scanning;
- save and synchronize your collection, wishlist, scan history, images, and account settings;
- estimate item characteristics and value ranges and find relevant marketplace comparisons;
- manage free-scan limits, subscriptions, restores, and Pro access;
- provide support, prevent fraud or misuse, secure the Services, and improve reliability;
- comply with legal obligations and protect the rights, safety, and integrity of users and the Services.
4. AI and third-party processing
To provide scans, Retroza sends the image you select and related request data through our secure backend to an AI service provider. OpenAI is the default provider; Google Gemini may be used when configured. These providers process the content to return an analysis.
Retroza may send derived search text—such as likely brand, category, or era, but not the scan image—to eBay to find similar listings. Supabase provides account, database, and private image storage services in an EU region. RevenueCat processes App Store subscription and entitlement information.
These providers handle information under their own agreements and privacy commitments. We share only what is reasonably necessary to provide the applicable feature.
5. Storage and security
Collection and scan data are stored in our hosted database. Images are kept in a private, owner-scoped storage area and are accessed through authenticated requests or short-lived signed links. We use administrative access controls, multi-factor authentication for administrative tools, and audit logging for administrative changes.
No security measure is perfect. We work to protect information using reasonable technical and organizational measures, but cannot guarantee absolute security.
6. Retention
Active account content is kept until you delete individual content or your account, unless a longer period is required for security, legal, or dispute purposes. Empty anonymous accounts that have been inactive for at least 30 days may be deleted.
When an account is deleted, we remove its collection, scan records, and stored images. A non-personal, server-keyed free-quota counter may be retained to prevent repeated reactivation of a one-time free allowance. Limited deletion and security audit records may also be retained.
7. Your choices and rights
- Camera and photo access: manage permissions in iOS Settings. Retroza accesses only the photos you choose for scanning.
- Account deletion: use Settings → Account → Delete Account in Retroza to permanently remove your account and saved content.
- Subscription management: deleting a Retroza account does not cancel Apple billing. Manage or cancel a subscription in Apple ID → Subscriptions.
- Access, correction, or deletion: contact us to request assistance with applicable privacy rights.
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal information, and to appeal a denied request. We may need to verify your identity before completing a request.
8. Website data and cookies
The Retroza marketing website does not currently use advertising trackers or non-essential analytics cookies. Our hosting provider may process standard request data, such as IP address, browser type, timestamps, and security logs, to deliver and protect the website.
9. Children
Retroza is not directed to children under 13, or the minimum age required in their country. We do not knowingly collect personal information from children below that age. Contact us if you believe a child has provided personal information.
10. International transfers
Our providers may process information in countries other than yours. Where required, we use appropriate safeguards for international data transfers.
11. Changes to this policy
We may update this Privacy Policy to reflect product, legal, or operational changes. We will update the date above and provide additional notice when required by law.
12. Contact us
Questions or privacy requests can be sent to contact@retroza.app.