1. Hosting, authentication and storage — Google / Firebase
Google Cloud and Firebase provide Firebase Authentication, Cloud Firestore, Cloud Storage, Firebase Hosting and backend Functions. These services process account identifiers and sign-in details, synchronized wardrobe and profile information, garment photos, learning samples, purchase/usage records and ordinary technical request information as needed for the relevant service. Guest authentication also creates a persistent account identifier.
Backend Functions are currently configured in the United States (us-central1). That does not establish the region of every database, storage copy, authentication operation or log. Hosting uses distributed infrastructure. End-to-end locations, contracts, backups and retention need verification for the shipped project; we do not claim that all data remains in Canada.
2. Cloud AI — Google Vertex AI / Gemini
Google Vertex AI/Gemini processes cloud clothing recognition, outfit suggestions, chat, color analysis and virtual try-on requests routed through our backend. Depending on the feature, inputs include garment images, wardrobe attributes, messages and preferences, stylist notes, weather context, a selected selfie or person photo, garment reference images and an outfit description. Returned text, labels, analyses or generated images are used for the feature you requested. These are inference requests to Google's models, separate from the pipeline used to train LookHabit's own garment models.
The current AI client defaults to global routing. Provider processing and retention are not established solely by our backend region. Google's published Cloud service terms state that customer data is not used to train or fine-tune AI/ML models without the customer's prior permission or instruction. That restriction is not a promise of zero retention. Applicable terms, optional data-sharing settings and retention arrangements for LookHabit's project still require review before release. LookHabit's own automatic garment-learning collection is a separate purpose described in the Privacy Policy. Required in-app AI-sharing information and permission must be provided before sharing; listing this provider is not consent.
3. Usage analytics and crashes — Google Firebase
Firebase Analytics receives release-mode usage events, which can include outfit activity, counts and color-analysis season, source and confidence, plus SDK installation/device and automatic event information. Firebase Crashlytics receives crash errors and stack traces; diagnostic context can inadvertently contain personal information. These services help evaluate app use and diagnose failures.
The marketing website does not embed these app analytics or crash SDKs. The app's account-deletion implementation does not automatically erase every Analytics or Crashlytics record. Their exact configured storage locations, retention and rights-request handling require release review; they are not assumed to match the backend Functions region.
4. Sign-in and store payments — Apple and Google
When you choose their sign-in services, Apple or Google processes identity-provider information used to authenticate your account. App Store and Google Play process purchases and payment information under their store terms. LookHabit and its backend exchange account-linked purchase identifiers, verification information and product/subscription status to deliver access and prevent duplicate grants. LookHabit does not collect payment-card numbers in its app purchase flow.
These providers may act under their own account, payment and privacy responsibilities rather than solely as processors for LookHabit. Processing locations and retention depend on the provider and your account/store region; this list does not promise a single country. Native sign-in configuration and live billing verification remain separate release checks. Store subscription management and refunds remain with the relevant store.
5. City search and weather — Open-Meteo
Open-Meteo supplies geocoding through geocoding-api.open-meteo.com and forecasts through api.open-meteo.com. City searches send the text you type; weather requests send the selected city's coordinates. Direct connections also reveal ordinary transport information such as the IP address. The app does not request device GPS for this flow.
The current implementation uses those endpoints, but commercial service authorization and final operational arrangements are not yet confirmed for release. We have not verified an exclusive processing country or a provider-wide retention deadline. Weather context may also be included in a separate AI request as explained in the Privacy Policy.
6. Email, sharing and changes to this list
The public contact address is hello@lookhabit.com. Its receiving mailbox provider is not yet configured or verified, so no receiving provider is represented as operational here. We will identify that provider and verify delivery before public release. Email you send is also handled by your chosen email service. Files you explicitly share go to the app or recipient you choose, outside LookHabit's account-cleanup control.
We update this list when a provider is introduced, replaced or removed, recording the review date and the relevant roles, data and known processing locations. Provider changes require a review of contracts, security, retention, international transfers and any effect on your privacy choices. Routine roster updates do not authorize new processing purposes. Material changes require updated information and any notice or permission required before processing changes. The main Privacy Policy remains the source for LookHabit's purposes, rights and deletion limits.