Privacy policy
Last updated 28 September 2026
Ecru is a wardrobe app that runs on your iPhone. There are no accounts and no servers holding your things. Three things do leave the phone, and this page names all three.
What we collect
Nothing that identifies you. We do not collect, transmit, sell or share your name, your contacts, your photos, your wardrobe or your location. The app does send anonymous usage counts, with a few technical details about the device, which you can switch off — Usage statistics below says exactly what they are.
There is no sign-up and no login, so we have no way of knowing who you are. The usage counts carry only a random identifier created when the app is installed; it is not linked to a person or an account, and we have nothing to link it with.
What the app keeps on your device
Everything you put into Ecru stays in the app’s own storage on your iPhone:
- photos of your clothes, including the ones taken with the camera inside the app;
- your wardrobe: categories, colours, patterns and the outfits you build;
- a record of what you wore and when;
- your colour-type profile: the hair, eye and skin colours you pick — by hand or from a photo of yourself — your answers to the three questions, and the resulting type. The photo is used only while you pick colours from it; it is not saved to your wardrobe or your profile;
- the name you give the app, if you give one;
- your trips: the destination, the dates, the forecast for each day and the packing list with its ticks;
- your interface language.
None of this leaves your device. We cannot see it and we cannot recover it. Deleting the app deletes all of it for good: Ecru does not sync, does not back up, and does not export your wardrobe.
Permissions the app asks for
- Camera — to photograph your clothes and, if you choose, to take a selfie to find your colour type. Photos are processed on the device. Clothing photos are saved into the app’s own storage; the selfie is not.
- Photo library (read) — to add clothes, or a photo of yourself for the colour type, from photos you already have. Ecru reads only the photos you pick yourself.
- Photo library (add) — to save a photo of an item, or a picture of an outfit, to your library when you ask it to.
- Location (while using the app) — only if you turn on weather, and only to look up today’s forecast. You can name a city instead and never grant it.
Any of these can be revoked in iOS settings; the rest of the app keeps working.
Network connections
Ecru makes three kinds of network request, and no others. On launch it asks Expo’s update service (u.expo.dev) whether a newer version of the app’s JavaScript is available. That request carries the platform, the app’s runtime version and the update channel; as with any request over the internet, the service also sees your IP address. It carries nothing from your wardrobe: no photos, no items, no profile.
The service is run by Expo, Inc. under its own policy: expo.dev/privacy.
The other two are described below: anonymous usage statistics, and the weather. There is no advertising, no crash reporting and no third-party tracking SDK. The app never asks for permission to track you across other apps or websites, because it does not. When you share an outfit, the picture goes to the iOS share sheet and from there only where you send it; Ecru itself uploads nothing.
Usage statistics
Ecru counts how the app is used, through PostHog. The events are anonymous: when the app is opened and which screens are opened; when an item is added or removed, with its category only; whether the colour the app suggested had to be corrected by hand; whether the colour-type questions were finished; whether a suggested outfit was opened, saved, worn or shared; and how trips and the weather suggestions are used — for example, how many days a trip lasts or how many outfits were found. The events themselves are numbers and short labels.
Alongside each event, PostHog receives the standard technical details its library adds: that random install identifier and a session identifier, the device model, the iOS and app versions, the screen size, the language and region setting, and the time zone. Your connection’s IP address reaches PostHog as with any request over the internet; the project is set to discard it rather than store it.
What is never sent: your photos or their file paths, your notes, brands or item names, the colours of your clothes, your name, your location and where you travel. PostHog is also told not to work out a country or city from your connection. No profile is created for you, and screen recording is switched off. PostHog stores the events in the European Union and acts as a processor on our behalf; its own policy is at posthog.com/privacy.
Counting does not begin until you have been through the introduction and added your first item — with one exception. On the very first launch the app sends a single empty event that says only that it has been opened for the first time, so we can tell how many people leave before adding anything. It carries no properties and is sent once per install. You can switch counting off at any time in Profile → Anonymous usage statistics, and that choice survives a profile reset.
Weather
The wardrobe can show today’s weather and suggest what to wear for it. This is off until you turn it on, and the app works fully without it.
To look up the forecast it needs a place — either this device’s location, or a city you type in; the name you type is sent to Open-Meteo’s place search to find it. Coordinates are rounded to about 11 kilometres before they are sent, so a request says roughly which town you are in and nothing closer. Trips use the same service: to plan one, the app sends the destination’s rounded coordinates and the trip dates. All of this goes to Open-Meteo and nowhere else, carries nothing from your wardrobe, and is not stored by us. Turning weather off erases the saved place; resetting your profile erases it together with your trips.
Children
Ecru collects nothing that identifies anyone, children included.
This website
The page you are reading counts nothing. It has no analytics, sets no cookies and stores nothing in your browser: opening it leaves no record anywhere but in your own browser history. The same is true of the app.
Your rights
We hold nothing that identifies you. Your wardrobe is on your device and under your control: delete individual items inside the app, reset your profile, or delete the app to remove everything at once. The usage counts carry only a random identifier we cannot connect to you, so we cannot find yours to hand over or delete; switching statistics off in the profile stops them.
Changes
If this policy changes, the new version appears at this same address with a new date, and anything substantive is named in the app’s release notes.
Contact
Questions about this policy, or about the app: