Privacy & your wardrobe

Last updated: 22 October 2026

1. Who is responsible

MorningPick is operated by MorningPick AB, a Swedish limited company registered under organisation number 559594-1864. MorningPick AB is the data controller for the processing described in this notice.

Postal address: c/o Börjesson, Gamla Flackarpsvägen 2, 245 61 Staffanstorp, Sweden. For privacy requests or to exercise your data protection rights, contact privacy@morningpick.eu.

2. Information we process

Account data includes your email, name, date of birth supplied at signup, authentication identifiers, account creation date, approval status and optional profile photo. The date of birth supports the signup age check and is not displayed to other users or sent to the outfit AI. Supabase handles password authentication. Google or Facebook sign-in can provide identifiers, your name, email and profile information according to the permissions shown by that provider.

Your wardrobe includes uploaded photos, clothing descriptions, purchase information, saved outfits, wear history, check-ins and estimated impact figures. Sharing records include owner and viewer identifiers, names, viewer email, invite tokens and connection dates. Hosting, authentication and API services also process technical information such as IP addresses, request times, errors and security logs; these are not assumed to be anonymous.

3. Purposes and legal bases

Acknowledging this notice is not blanket consent. No marketing mailing list or advertising tracker is implemented in the reviewed application.

4. What the AI sees and does

MorningPick uses Groq for garment image analysis, outfit recommendations and resale drafts. When you enable photo analysis, a resized image is sent through our server to Groq. For outfits, inputs include garment identifiers and attributes, wear information, your occasion prompt and optional weather conditions. Resale drafts use the selected garment’s details. The application does not intentionally send your account email, password or profile photo to the outfit AI.

Recommendations use automated analysis of clothing and preferences and may constitute profiling under GDPR. They suggest combinations; they do not make decisions with legal or similarly significant effects about you. You can ignore suggestions, correct results, add clothes manually and choose your own outfits. Prices and environmental figures are estimates, not verified valuations or environmental certifications.

Photograph clothes without faces or sensitive information. Do not put names, health data, addresses or payment details in prompts, receipts or images. MorningPick is not designed for biometric identification or inferring sensitive characteristics.

Groq documents that inference inputs and outputs are generally not retained, but reliability or abuse investigations may retain them for up to 30 days, or longer when legally required. Its Zero Data Retention setting can change this behaviour. We have not verified that setting for this project and do not promise zero retention. Groq retains usage metadata separately. See Groq’s data controls. Project-specific contractual restrictions on training and secondary use have not yet been confirmed.

5. Providers, recipients and transfers

Transfers outside the EEA require an applicable adequacy decision or safeguards such as standard contractual clauses, with any additional measures needed. The project-specific processor agreements, subprocessors and transfer safeguards have not yet been confirmed. You can request information about international transfers and copies of applicable safeguards at privacy@morningpick.eu.

6. Photos and sharing visibility

Your new profile photo is stored in a private bucket accessible to your account. The existing wardrobe-image bucket is public: anyone who already has a garment image URL can retrieve that image. Database access controls and revoking a friend do not revoke public image URLs or copies already downloaded. Do not upload private documents or identifiable people.

Sharing is optional. An approved user who obtains an active invite link can connect to your wardrobe. Disable or replace the link to stop new connections and revoke existing friends separately in Sharing. Never share your account password.

7. Retention and deletion

Account and wardrobe records are held while your account provides the service, unless you remove them earlier. Successful self-service deletion removes stored objects owned by the account, then the authentication account and dependent database records, and revokes refresh sessions. If cleanup fails, it reports failure and can be retried; some files may already be removed. Deleting an item record alone does not necessarily erase an older stored image.

Backups, CDN caches, provider security logs and legally required records may outlast deletion from the active service. They must not be reused for ordinary service activity. Specific retention periods for backups, logs and legally required records have not yet been confirmed. For information about retention affecting your data, contact privacy@morningpick.eu. Copies that recipients independently saved cannot be recalled by revoking sharing.

8. Your rights

You may request access, correction, erasure, restriction, and portability where applicable; object to processing based on legitimate interests; and withdraw any consent without affecting past lawful processing. In Account, you can edit details, export a JSON copy of application records or initiate deletion. The export contains image references, not every image file or infrastructure log; contact us for a complete access request.

Send requests to privacy@morningpick.eu. We may request proportionate information to verify identity, never your password. We respond without undue delay and normally within one month. Complex or numerous requests may need up to two additional months; reasons and the extension must be communicated within the first month.

You can complain to the supervisory authority in your habitual residence, workplace or the place of the alleged infringement, including the Italian Garante. Contacting us first is not mandatory.

9. Browser storage and cookies

The app uses localStorage for the Supabase session, a cached display name and wardrobe preferences. In-app reminder preferences and read status are also stored locally, separately for each account, and are not synced between devices. You can pause reminders in the notification panel. These are browser-storage entries, not cookies. Authentication services may also use strictly necessary mechanisms for sign-in. No non-essential analytics or advertising SDK was found in the application source reviewed for this notice. This review does not establish the full behaviour of external providers. If non-essential tracking is added, it must be controlled before activation through an appropriate choice mechanism.

10. Age and updates

This service is intended for people aged 16 and above. If you believe a younger person has supplied personal data, contact us. Material changes to purposes, recipients or legal bases require appropriate notice and, when required, a new choice; continuing to use the service does not by itself give consent to new processing.