Privacy

The short version: we read your order emails to build your closet, keep what that takes, never sell or advertise with any of it, and delete all of it the moment you ask.

Questions, a copy of what we hold about you, or a deletion you'd rather ask for than click: write to privacy@thedamage.co.

How The Damage makes money

The Damage is free to use. When you buy something through one of our links, the store may pay us a commission: that's the whole business, and it never costs you more. We don't sell your data, we don't run ads, and scores aren't for sale: the part of the app that picks and ranks what you see doesn't know what we'd earn, so no store can pay its way up your Shop. 💋

What we read

Your Gmail, if you connect it

• We ask Google for read-only access (gmail.readonly) and your Google account's email address, so we know which inbox is yours. We can't send, delete, label or change anything in your mail.
• We open only messages from the stores you've switched on whose subject line mentions an order, a receipt, a confirmation, shipping, delivery or a return, from the last two years. Everything else in your inbox, we never open.
• To suggest stores you shop at, once a week we look at the sender and subject line (not the message itself) of up to 300 emails in Gmail's own "Purchases" category from the past year.
• When you add a store by name, we look at the sender address of up to 15 order emails that mention it, to find the address its receipts come from.

Mail you forward to your private address

• If you forward order emails to your own address at in.thedamage.co, we read those. Anything that doesn't look like an order email is dropped unread, and nothing of it is kept.

What you give us

• Photos you add, pieces you add by hand, tracking numbers or shipping messages you paste, what you ask the Shop to hunt for, and what you ask "what do I wear?".

Stores' public websites

• We read stores' public product pages, prices and photos to stock your Shop, check prices and find photos. We send them nothing about you. "Buy it" takes you to the store's own site.
• Links to retailers may include affiliate tracking so the store can attribute your purchase to us; the store may set cookies for this on their site.

What we keep

• From each email we read: the sender, subject, date and text (up to 20,000 characters, or 60,000 for mail you forward), and what we take from it: the store, order number, pieces, prices, sizes, colours, and shipping status and tracking number. One that looked like an order email but turns out not to be one is kept too, marked as not an order, so it isn't read twice.
• Your closet and taste: your pieces and their photos, what you've worn, your Damage Report, your swipes, saves, cart and hunts, the stores you've switched on, and what you've spent of your daily AI allowance.
• We notice which pieces you spend time on, to improve your picks — this stays in your account like everything else.
• Which screens you open: the page name and, for the Shop, which rack — so we can tell what's worth keeping and what to cut. Never the address you were on, never what you searched, never the piece on screen. It stays in your account and goes when you delete it.
• Your account: your email address, name, and password if you set one (stored only as a one-way hash).
• Your Gmail connection: Google's access token, encrypted, so we can read new order mail. Disconnect Gmail and it's revoked at Google and deleted here.
• Sign-in records: for security, each sign-in attempt's email address, IP address and browser, for 60 days. When you first sign in, and when you finish setting up, whoever runs The Damage gets a notification saying so, and nothing else about your account.
• Notifications, if you turn them on: your phone's push address and the keys to encrypt to it, until you turn them off or delete your account.

What we never do

• We never open mail outside the search above, and never keep forwarded mail that doesn't look like an order email.
• We never see or store payment card details: you check out on each store's own site.
• We never sell your data, never use it for advertising, and never share it with data brokers.
• We never run analytics or ad trackers on these pages.
• Match scores and recommendations are never influenced by commission rates — the algorithm doesn't know what we earn.
• No person reads your email unless you ask us to (say, to fix something), it's needed for security, or the law requires it.

Who else handles it

A few services help run The Damage. Each sees only what its job requires, and none of them train on or sell your data.

• Googlethe email access you authorize, image search, and our fonts
• Anthropicthe AI that reads receipt text and scores pieces; contractually, it doesn't train on it
• Resendsends and receives our emails
• Railwayhosting

Google user data

The Damage's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to build and update your closet and the features on these pages, never for advertising, and we don't let anyone else use it for their own purposes.

Deleting it

• Disconnect Gmail (Settings): we revoke our access at Google and delete the token. Your closet stays unless you delete it too. You can also remove our access from your Google Account, under Security, third-party connections.
• Delete account (Settings, at the bottom): your closet, photos, emails we kept, report, Shop, wishlist, cart, tracking, allowance and sign-in records are deleted from our database straight away, and Gmail is disconnected. It can't be undone, and we won't restore a deleted account from a backup.
• Or write to privacy@thedamage.co and we'll do it for you, or send you a copy of what we hold first.

Everything else

The Damage is invite-only and for adults. If this page changes, the date at the top changes with it, and a change in what we read or who handles it gets an email first.