1. INTRODUCTION
LaunchX GmbH ("we", "us", or "our") operates the Brutal Coach mobile application and the brutalcoach.app website. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
2. DATA CONTROLLER
The data controller responsible for your personal data is:
3. INFORMATION WE COLLECT
We collect information that you provide directly to us, as well as a limited amount of technical data:
Account Information
When you create an account we collect your email address, and — if you sign up via Apple or Google single sign-on — the identifier and basic profile data those providers return (typically name and email). Authentication is handled by our provider Clerk. We never see or store your password.
Outfit Images and Analyses
When you use the Service you upload photos of your outfits. Each photo and the resulting analysis (rating, written feedback, color palette, styling tips, occasion, mode) is saved to your private closet so you can revisit it. You can delete any individual analysis, or your entire account, from inside the app at any time.
Subscription State
If you subscribe to Pro, the actual payment is handled by Apple or Google. We receive only your subscription state (active / expired, plan, renewal date) via RevenueCat. We do not receive or store your payment details.
Usage Data
On both the brutalcoach.app website and the mobile app we use OpenPanel for privacy-friendly product analytics — screen / page views, button taps, outgoing link clicks, and basic device info (OS, app version, anonymised country). OpenPanel does not use cookies, does not use advertising IDs, and does not collect personal data that could identify you individually. The mobile app does not include any other third-party analytics or crash reporting.
Newsletter Consent
If you agree to receive our newsletter, we record that decision as an audit entry: the action (granted, declined or revoked), the exact wording you were shown, its version, the language, where you were asked (e.g. sign-up or settings), the app version and the timestamp. Article 7(1) GDPR requires us to be able to demonstrate your consent, which is why each change is stored as a new entry rather than overwriting the previous one. Your email address is shared with our newsletter provider Brevo only while your consent is active.
Guest Checks (no account)
You can run your first outfit checks without creating an account. So that the free allowance cannot simply be reset by reinstalling the app, your device sends a device identifier (on iOS the identifierForVendor, on Android the SSAID), which we store only as an irreversible cryptographic hash — never the raw value. It is used exclusively to count your remaining free checks. If you later create an account, your guest analyses are transferred to it.
4. HOW WE USE YOUR INFORMATION
We use the information we collect for the following purposes:
- To provide, maintain, and improve our Service
- To process your outfit images and generate AI-powered styling feedback
- To save your past analyses to your personal closet so you can revisit them
- To manage your account, subscription, and customer support requests
- To send you transactional emails strictly related to your account (e.g. email verification, password reset)
- To send you our newsletter (style tips, your score progress, motivation and product news) — only if you have actively consented, and only until you withdraw that consent
- To enforce the free check allowance for guests without an account, using a hashed device identifier
- To understand aggregate, anonymous usage of the website so we can improve it
- To comply with legal obligations and protect against fraud or abuse
5. LEGAL BASIS FOR PROCESSING (GDPR)
Under the GDPR, we process your personal data based on the following legal grounds:
- Contract Performance: processing necessary to provide the Service you signed up for
- Consent (Art. 6(1)(a) GDPR): where you have given explicit consent — e.g. by uploading an outfit photo for analysis, or by subscribing to our newsletter. You may withdraw consent at any time with effect for the future; the lawfulness of processing before withdrawal is unaffected
- Legitimate Interests: improving the Service, ensuring security, operating cookie-free website analytics, and preventing abuse of the free check allowance (hashed device identifier)
- Legal Obligation: when required to comply with applicable law
6. DATA SHARING AND THIRD-PARTY SERVICES
We share your information with the following providers. Each is bound by a Data Processing Agreement and processes data only on our behalf:
OpenAI (United States)
Your outfit images are transmitted to the OpenAI API for AI analysis. OpenAI does not use API content to train its models. Transfers are protected by EU Standard Contractual Clauses.
Amazon Web Services (EU — Frankfurt)
Outfit images and analysis records are stored on AWS S3 in the eu-central-1 region (Frankfurt, Germany), encrypted in transit and at rest. Your photos do not leave the EU.
Clerk (United States)
Handles authentication, sessions, and OAuth via Apple and Google. Clerk is GDPR-compliant; transfers are protected by EU Standard Contractual Clauses.
RevenueCat (United States)
Tracks your subscription entitlement so the app knows whether you're on the free or Pro tier. Does not receive your outfit photos. Transfers are protected by EU Standard Contractual Clauses.
OpenPanel
Cookie-free, anonymous product analytics for the website and the mobile app. Tracks screen / page views and basic interactions so we can improve the product. Does not receive your outfit photos.
Brevo (Sendinblue GmbH, Germany)
Sends our newsletter. Receives your email address and, if provided, your first and last name — but only once you have actively consented, and never your outfit photos. Servers are located in the EU. When you withdraw consent, your contact is removed from our mailing lists; when you delete your account, the contact is deleted at Brevo as well.
7. DATA RETENTION
We retain personal data only for as long as needed to provide the Service:
- Account data: kept until you delete your account
- Outfit photos and analyses: kept in your closet until you delete an individual analysis, or until you delete your account
- Newsletter data at Brevo: kept until you withdraw consent or delete your account
- Consent records (when, in what wording, from where): kept for 3 years after consent ends, as evidence under Art. 7(1) GDPR. These records contain no outfit photos
- Hashed device identifiers for guest checks: kept until the account is deleted; without an account, for a maximum of 12 months after the last check
- Website analytics: kept in aggregate / anonymised form only
- After account deletion, your data is permanently removed from our active systems within 30 days; encrypted backups roll off within a further 30 days
8. YOUR RIGHTS (GDPR)
Under the GDPR, you have the following rights regarding your personal data:
- Right of Access: request a copy of your personal data
- Right to Rectification: request correction of inaccurate data
- Right to Erasure: request deletion of your personal data — you can also do this yourself from the Me tab in the app
- Right to Restriction: request limitation of processing
- Right to Data Portability: receive your data in a portable format
- Right to Object: object to processing based on legitimate interests
- Right to Withdraw Consent: withdraw consent at any time. For the newsletter you can do this yourself — via the toggle under your profile in the app, or the unsubscribe link at the bottom of every newsletter. Withdrawal is effective immediately and does not affect the lawfulness of processing carried out beforehand
To exercise any of these rights, please contact us at info@launch-x.de. We respond within 30 days.
9. DATA SECURITY
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption of data in transit (TLS) and at rest (AWS S3 server-side encryption)
- Secure authentication and session handling through Clerk
- Outfit data stored in the EU (Frankfurt, eu-central-1)
- Access controls limiting who at LaunchX can read your data
- Regular dependency updates and security reviews
10. INTERNATIONAL DATA TRANSFERS
Your outfit photos are stored in the EU. However, some processing — specifically the AI analysis (OpenAI), authentication (Clerk), and subscription state (RevenueCat) — involves transferring limited data to providers based in the United States. These transfers are protected by EU Standard Contractual Clauses (SCCs) and the providers' own GDPR-compliant frameworks.
11. CHILDREN'S PRIVACY
Our Service is not intended for users under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately and we will delete it.
12. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.
13. SUPERVISORY AUTHORITY
If you are in the EU and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority. In Germany, this is the Bayerisches Landesamt für Datenschutzaufsicht.
14. CONTACT US
If you have any questions about this Privacy Policy or our data practices, please contact us: