1. Who we are
CapsuleMind ("CapsuleMind", "we", "us", "our") is a mobile application that helps you build a capsule wardrobe: you record the clothes you already own, the app generates outfits from them and suggests specific items to buy in order to extend those outfits.
The data controller — the person who decides why and how your personal data is processed — is:
| Field | Value |
|---|---|
| Controller | Dina Miyerkhanova (Миерханова Дина Галымовна), a natural person operating CapsuleMind in the Republic of Kazakhstan |
| Address | Seifullin Avenue 416, block 4, apt. 48, Almaty, Republic of Kazakhstan |
| Privacy contact | info@capsulemind.app |
| Support | info@capsulemind.app |
| Website | https://capsulemind.app |
We have not appointed a Data Protection Officer, because we are not required to do so. Privacy questions go to the address above and are answered by the controller personally.
2. What this policy covers
This policy applies to the CapsuleMind mobile application for iOS and Android, to our website at https://capsulemind.app, and to any support correspondence with us. It does not apply to third-party services you reach from the app — for example an online store whose website you open after a purchase recommendation. Those services have their own privacy policies.
CapsuleMind is currently offered in the CIS countries and the United States. It is not offered in the European Economic Area or the United Kingdom; if that changes, this policy will be updated before distribution begins there. The rights described in Section 11 are honoured for every user regardless of country.
By creating an account you confirm that you have read this policy. Where we rely on your consent, we ask for it separately and explicitly; you can withdraw it at any time (Section 8).
3. Personal data we collect
We collect only what the app needs to function. We do not collect your precise location, contacts, calendar, microphone, camera roll, health data, biometric data, payment card data, or any special category data as defined in Article 9 GDPR.
3.1 Data you give us
| Data | Examples / values | Why we need it | Legal basis (GDPR) |
|---|---|---|---|
| Account identifiers | E-mail address; a unique user ID (UUID) generated by our authentication provider; password (stored only as a salted hash, never in plain text and never visible to us) | To create and secure your account, to sign you in, to let you reset your password | Performance of a contract (Art. 6(1)(b)) |
| Social sign-in identifiers | If you choose "Continue with Google" or "Continue with Apple": your e-mail address (or Apple's Private Relay address) and, where the provider supplies it, your display name | To create and sign you into your account without a separate password | Performance of a contract (Art. 6(1)(b)) |
| Display name | The name you type in your profile | To address you in the app | Performance of a contract (Art. 6(1)(b)) |
| Style questionnaire | Age band (18–24 / 25–44 / 45+); height band (under 160 / 160–170 / 170–180 / 180+ cm); lifestyle split across five activity types (formal office, smart casual, walking, events, sport — five numbers totalling 100); preferred clothing styles (minimalism, feminine, trendy, relaxed, classic & formal, sporty) | To generate outfit and purchase recommendations that fit your body, your life and your taste. Ranges are deliberately coarse: we never ask for your exact date of birth or your exact height | Consent (Art. 6(1)(a)) — the "Personalisation" switch |
| Your wardrobe | The catalogue items you mark as owned, with their colour, fabric and type; items you place in the shopping list / cart; outfits and capsules generated for you and any you save | This is the core function of the app | Performance of a contract (Art. 6(1)(b)) |
| Settings and consents | Push and e-mail notification switches; personalisation and analytics consent switches; the version of this policy you accepted and the timestamp | To respect your choices and to be able to prove that a consent was actually given, as the law requires | Legal obligation (Art. 6(1)(c)) and consent (Art. 6(1)(a)) |
| Support correspondence | Your e-mail address and whatever you write to us | To answer you | Legitimate interests (Art. 6(1)(f)) |
| Website enquiries | If you leave your e-mail address in a form on capsulemind.app, and the answers you give in the short optional survey that follows it | To reply, to tell you when the app launches if you asked for that, and to understand what future users need | Consent (Art. 6(1)(a)) |
3.2 Data collected automatically
| Data | Examples | Why | Legal basis |
|---|---|---|---|
| Technical and security data | IP address, device model, OS version, app version, language, time zone, authentication timestamps and session tokens | To deliver the app, keep the account secure, detect abuse and debug failures. IP addresses appear in backend access logs and are kept for a short period only | Legitimate interests (Art. 6(1)(f)) |
| Product analytics | Screens opened, features used, events such as "onboarding completed" or "item added to wardrobe", a pseudonymous installation identifier, coarse device and country information. Collected through Google Firebase Analytics | To understand which parts of the app are used and which are broken. Analytics are off by default and run only after you turn the "Analytics" switch on | Consent (Art. 6(1)(a)) |
| Push notification token | The device token issued by Apple Push Notification service or Firebase Cloud Messaging | To deliver the notifications you enabled. No token is registered if you decline the system permission | Consent (Art. 6(1)(a)) |
3.3 Data we do not collect
We do not collect your precise or coarse GPS location, your contacts, your photos or camera roll, your microphone or camera input, your financial account or payment card details, your government identifiers, your health or fitness data, your biometrics, your browsing history outside the app, or your advertising identifier (IDFA / GAID).
We do not track you across other companies' apps or websites. We therefore do not present the App Tracking Transparency prompt, and there is nothing for us to declare as "Tracking" in Apple's privacy labels.
4. What we do not do with your data
- We do not sell your personal data, and we have not sold or shared it in the preceding twelve months. This includes the broad definitions of "sell" and "share" used in the CCPA as amended by the CPRA.
- We do not use your data for third-party advertising, and we do not embed advertising SDKs.
- We do not build profiles about you for anyone other than you. The recommendations are computed for your account and shown only to you.
- We do not make decisions with legal or similarly significant effects about you by automated means within the meaning of Article 22 GDPR. The app's recommendations are clothing suggestions; they do not affect your rights, your access to services, your credit or your employment. You can change or ignore any recommendation, and you can edit or delete the questionnaire answers that drive it at any time in your profile.
5. How the recommendations work
The app compares the items in your wardrobe against a catalogue of clothing variants using rule tables — which colours go together, which styles and seasons combine, which garment layers can be worn at once. Your age band, height band, lifestyle split and chosen styles are used to filter and rank the results: for example, lifestyle percentages decide which kind of outfit is shown first. No third party takes part in this computation, and the rules are the same for every user in the same situation.
If you turn the "Personalisation" switch off, we stop using your questionnaire answers to rank recommendations. The app still works, but the suggestions become generic.
6. Who we share data with
We do not sell or rent your data. We share it only with the service providers listed below, who process it on our documented instructions under a written data processing agreement, and only to the extent needed to run the app.
| Provider | Role | What it processes | Where | Safeguards |
|---|---|---|---|---|
| Supabase, Inc. (US), running on AWS | Database, authentication and file storage | All account, questionnaire, wardrobe and consent data | Database instance hosted in the AWS ap-south-1 region (Mumbai, India). Supabase is a US company and may access data from the United States for support purposes | DPA with EU Standard Contractual Clauses; encryption in transit (TLS) and at rest |
| Google LLC / Google Ireland Limited | "Sign in with Google"; Firebase Cloud Messaging for Android push; Firebase Analytics (only with consent); Google Fonts on our website | E-mail address, Google account ID, device push token, pseudonymous analytics events, and the IP address of your browser when a font file is requested | United States, EU and other Google regions | Google's standard controller/processor terms and SCCs |
| Apple Inc. | "Sign in with Apple"; Apple Push Notification service | E-mail or Apple Private Relay address, Apple user identifier, device push token | United States | Apple's developer and data protection terms |
| FlutterFlow, Inc. | The platform the app is built with, and hosting of any web version | Technical request data for the web build; no direct access to account content in published mobile apps | United States | Provider's terms and DPA |
| Netlify, Inc. (US) | Hosting of the capsulemind.app website | Website request data, including IP address and user agent, in server logs | United States | Provider's terms and DPA |
| Cloudflare, Inc. (US) | DNS for the capsulemind.app domain | Domain name queries; no page content | United States | Provider's terms and DPA |
We will also disclose personal data if we are legally required to do so, or where disclosure is necessary to establish, exercise or defend legal claims. If CapsuleMind is ever sold or merged, your data may transfer to the acquirer; you will be told before that happens.
7. International transfers
CapsuleMind is operated from the Republic of Kazakhstan. Our database is physically located in India, and some of our providers are established in the United States and the European Union. Using the app therefore involves a cross-border transfer of your personal data.
- For users in Kazakhstan. Cross-border transfer to states that do not provide equivalent protection is carried out on the basis of your consent, collected when you create your account, in accordance with the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" No. 94-V of 21 May 2013.
- For users elsewhere. Transfers are made under the European Commission's Standard Contractual Clauses where our providers offer them, combined with encryption in transit and at rest and contractual access limits. You may request a copy of the relevant clauses from us.
8. Consent and how to withdraw it
Consent in CapsuleMind is always opt-in: nothing is pre-ticked for you at the point where the law requires consent.
| Consent | Default | Where to change it |
|---|---|---|
| This Privacy Policy and the Terms of Use | Accepted at sign-up | Withdrawal means deleting your account (Section 10) |
| Personalised recommendations | You choose at sign-up | Profile → Settings → Personalisation |
| Analytics | Off | Profile → Settings → Analytics |
| Push notifications | Off until you allow them in the system dialog | Profile → Settings → Push, or device settings |
| E-mail notifications | Off | Profile → Settings → E-mail |
Every change is written to an append-only consent log together with the policy version and a timestamp. Withdrawing a consent does not make earlier processing unlawful, and it does not stop processing that rests on a different legal basis.
9. How long we keep your data
| Data | Retention |
|---|---|
| Account, profile, questionnaire, wardrobe and outfit data | For as long as your account exists |
| Data after you request deletion | Marked for deletion immediately and hidden from the app; permanently and irreversibly erased within 30 days, including the consent log |
| Backend access logs (including IP addresses) | Up to 30 days |
| Analytics events | Up to 14 months, pseudonymous |
| Support correspondence | Up to 2 years after the case is closed |
| Website enquiries | Until you ask us to delete them, and no longer than 2 years after your last contact |
When a retention period ends, data is deleted or irreversibly anonymised.
10. Deleting your account and your data
You can delete your account from inside the app: Profile → Delete account → confirm.
Your account is immediately deactivated, you are signed out, and the app stops showing your data. A scheduled job then runs every day and permanently erases everything within 30 days — your profile, your questionnaire answers, your wardrobe, your outfits, your consent records and your login credentials. During those 30 days you can cancel the deletion by signing in again and confirming that you want to keep the account; after the 30 days the erasure is irreversible.
The only thing that outlives the erasure is anonymised, aggregated statistics that cannot be linked back to you.
You can also request deletion without installing the app, at https://capsulemind.app/delete-account or by e-mailing info@capsulemind.app from the address on your account. We answer within 30 days.
11. Your rights
11.1 Everyone
Whatever country you are in, you can ask us to: give you a copy of the data we hold about you; correct it; delete it; or stop using it for personalisation or analytics. Most of this you can do yourself in the app.
To exercise a right, write to info@capsulemind.app from the e-mail address on your account. We reply within 30 days and free of charge. If a request is manifestly unfounded or repetitive we may charge a reasonable fee or decline it, and we will explain why. We may ask you to confirm control of your account e-mail before we act.
11.2 Kazakhstan
Under the Law "On Personal Data and Their Protection", you may require us to change, supplement, block or destroy your personal data if it is incomplete, inaccurate, obtained unlawfully or no longer necessary for the stated purpose; you may withdraw your consent; and you may obtain information about the third parties to whom your data has been transferred. Complaints may be addressed to the authorised body for personal data protection of the Republic of Kazakhstan (the Ministry of Digital Development, Innovation and Aerospace Industry).
11.3 California (CCPA / CPRA)
In the last twelve months we collected the categories of personal information described in Section 3 — identifiers, internet or network activity, and inferences drawn about clothing preferences — for the business purposes in Sections 3 and 5, and disclosed them only to the service providers in Section 6.
- We do not sell and do not share your personal information for cross-context behavioural advertising, and have not done so in the preceding twelve months. We do not sell or share the personal information of consumers under 16.
- You have the right to know, access, delete, correct, and limit the use of sensitive personal information. We do not collect sensitive personal information as the CPRA defines it.
- We will not discriminate against you for exercising any of these rights. We offer no financial incentives for personal information.
- You may use an authorised agent; we will ask for written proof of authorisation.
Other US state privacy laws — Virginia, Colorado, Connecticut, Utah, Texas and others — give substantially similar rights, honoured through the same process.
11.4 EEA, UK and Switzerland (GDPR / UK GDPR)
CapsuleMind is not currently offered in these territories. If you are nevertheless covered by the GDPR or the UK GDPR, you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent at any time (Art. 7(3)), and we honour them through the contact address above. You also have the right to lodge a complaint with your national supervisory authority.
11.5 Appeals
If we refuse a request, our answer will say why and how to appeal. You may appeal by replying with the word "appeal"; we respond to appeals within 45 days.
12. Age requirement and children
CapsuleMind is for adults. You must be at least 18 years old to create an account. The app is not directed to children, we do not knowingly collect personal data from anyone under 18, and the questionnaire has no age band below 18 — the database itself rejects one.
We do not use personal data of minors for analytics or for any form of advertising, and we do not knowingly collect personal information from children under 13 within the meaning of the US Children's Online Privacy Protection Act. If you believe a person under 18 has created an account, write to info@capsulemind.app and we will delete the account and the data promptly.
13. Security
We protect your data with: TLS encryption for all traffic between the app and our servers; encryption at rest in the database; row-level security policies, so that a query can only ever return the rows belonging to the authenticated user; column-level permissions that prevent the app from writing server-controlled fields such as the subscription tier; password hashing handled by our authentication provider; and access to production data restricted to the controller.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent authority where the law requires it, and notify you directly without undue delay where the risk to you is high.
14. Cookies and similar technologies
The CapsuleMind mobile app does not use advertising cookies or third-party trackers. It stores a session token and your local preferences on your device so that you stay signed in.
Our website capsulemind.app sets no advertising or analytics cookies. It stores your language choice in your browser's local storage so the page opens in the same language next time, it loads a web font from Google Fonts, and it sends the e-mail address and survey answers you choose to submit to our database. You can clear that local storage in your browser settings; the site will still work.
15. Store-specific disclosures
- Apple App Store. The privacy information on our App Store product page ("Nutrition Labels") mirrors this policy: contact information (e-mail), user content (wardrobe selections), identifiers (user ID) and usage data (analytics, only with consent), all linked to your identity, and no data used to track you.
- Google Play. Our Data safety form mirrors this policy: same categories, data encrypted in transit, deletion available both in the app and through our web form, and no data shared with third parties for advertising.
If you find a discrepancy between a store label and this policy, this policy is the accurate description and we want to hear about it at info@capsulemind.app.
16. Changes to this policy
We may update this policy as the app changes. The version number and date at the top always tell you which text is current. If a change materially affects you — a new purpose, a new category of data, a new recipient — we will notify you in the app before it takes effect and, where the law requires it, ask for your consent again. Previous versions are available on request.
17. Contact
| Purpose | Contact |
|---|---|
| Privacy requests and complaints | info@capsulemind.app |
| General support | info@capsulemind.app |
| Postal | Dina Miyerkhanova, Seifullin Avenue 416, block 4, apt. 48, Almaty, Republic of Kazakhstan |
| Response time | Within 30 days |