1. In short
CEKU is an app for sharing what you wore. This document describes the data we process to make that possible.
- We process data to run your account, show your content and keep the account secure. Not for advertising.
- We do not sell personal data and do not share it with ad networks.
- All metadata on the photos you upload, including location, is removed at upload.
- The model that analyses your photos runs on our own servers. Your images are not sent to an AI provider.
- Your data is held in Germany.
This summary is for convenience; the full text below is what binds.
2. Who is responsible
CEKU is the controller of your data. For anything about privacy, write to [email protected]; for everything else, [email protected].
3. What we collect
What you give us when you sign up
| Data | Required |
|---|---|
| Email address | Required |
| First and last name | Required |
| Username | Required |
| Date of birth | Optional |
| Gender | Optional |
| Height and weight | Optional — for sizing suggestions |
| Profile photo | Optional |
What you create while using it
- The outfit photos and videos you upload
- Your comments, likes and ratings
- Product links and tags you add to outfits
- Who you follow and who you have blocked
What comes from your device and connection
- Device model, operating system and app version
- IP address, and the country derived from it — not a city or anything finer
- A push token, so notifications can reach you
- A record of your open sessions: device, platform, version, country, last activity. You can see these under Settings → Security → Active Sessions and end any of them.
Security records
When something security-relevant happens on your account we record it: sign-in, sign-out, password reset requested, email change, session revoked, deletion requested. Each carries the IP address, device and country. You can read them in the app under Security Activity — which is the point of keeping them: so that you can see something you did not do.
What we derive from your photos
To make search and recommendations work, uploaded images are analysed automatically. That produces a numeric representation of the image, a short textual description and the dominant colours.
This runs on a model on our own server. Your images are not sent to OpenAI, Google or any other AI provider.
4. What we do not collect
Worth stating as plainly as the rest:
- No precise location. We do not ask for GPS permission. The EXIF block on your photos — which on most phones carries the coordinates the picture was taken at — is removed when the image is re-encoded on upload. The file that reaches storage does not contain it.
- No contacts. We do not access your address book.
- No ad tracking. We do not read an advertising identifier and ship no third-party advertising or tracking SDK.
- No payment details. There are no in-app payments.
5. Why we process it
| Purpose | Legal basis |
|---|---|
| Creating and running your account | Performance of a contract |
| Showing your content; following, commenting and the rest | Performance of a contract |
| Personalising your feed and search | Legitimate interest |
| Detecting abuse, fraud and security incidents | Legitimate interest |
| Sending account and security email | Performance of a contract |
| Sending notifications | Consent — withdrawable in device settings |
| Meeting legal obligations | Legal obligation |
There is no advertising row, because we do not process data for advertising.
6. Who we share it with
We do not sell personal data. These providers process part of it so the service can run:
| Provider | For | What it sees |
|---|---|---|
| Google Firebase | Authentication, notifications, app integrity | Email, push token |
| Bunny.net | Media storage and delivery | The media you upload |
| Resend | Sending account email | Email address, your name |
| Apple / Google | “Sign in with” | Only if you use it |
| Cloudflare | Security layer in front of the API | IP address, request metadata |
The database, the search index and the image-analysis model run on our own servers; no third party receives data for those.
Other users see your profile, outfits and comments — that is what the app is. Profile and outfit visibility are yours to change in settings.
We may disclose data where the law requires it, on a valid legal request.
7. Where it is held
Our servers are in Germany. The database, the search index and the backups are there.
Media is delivered through Bunny.net and may be cached on servers near the viewer so it loads quickly. The storage region is Europe.
Firebase and Resend operate where their own infrastructure is; both transfer data under standard contractual clauses.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account and content | As long as the account is open |
| After a deletion request | 30 days — cancellable within them |
| Session records | Marked dead once expired, then cleared |
| Security activity | 90 days |
| Backups | Until the backup cycle rolls (at most 30 days) |
Once the 30 days pass, the data is permanently removed and cannot be restored.
9. Your rights
Under KVKK and the GDPR you can:
- Access your data and get a copy of it
- Have inaccurate data corrected
- Have your account and data deleted
- Export your data in a portable format
- Object to processing
- Withdraw consent you have given
- Complain to a supervisory authority
The first four you can do yourself: Settings → Account has data export and account deletion. For the rest write to [email protected]; we answer within 30 days.
10. Security
- All traffic is encrypted with TLS
- Local storage on your device is encrypted
- Sessions use expiring tokens; ending a device remotely invalidates its token immediately
- Media addresses are signed and expire, so guessing a URL does not reach somebody else's content
- Every uploaded image is re-encoded, which both strips its metadata and neutralises files that pass as an image while being something else
No system is absolutely secure. If you find a vulnerability, write to [email protected].
11. Children
CEKU is for adults. It is not designed for anyone under 18, and we do not knowingly collect data from them. If we learn that someone under 18 has given us data we close the account and delete it. If you believe a minor has an account, write to [email protected].
12. If this changes
We may update this policy. For a material change we will say so in the app and, where needed, ask you to accept it again. The date at the top is when it last changed.