EFFECTIVE DATE: 1 SEPTEMBER 2026 · PRIVACY CONTACT: privacy@ukti.io

Privacy Policy

This policy covers both ukti.io and the Ukti app. The two surfaces behave very differently, and that distinction matters throughout this policy.

ukti.io is a static editorial surface — it stores no email, no account, no cookie beyond what is strictly necessary for the page to render. When you tap the App Store or Google Play link, you leave ukti.io and the destination store's own privacy terms govern from that point.

If you arrived here from one of our ads, the campaign tags on that link travel with you to the store, so we can tell which ad brought you. They say which ad and which campaign, plus the click identifier the ad platform attached. They do not carry your name, your email, or anything you have typed.

Ukti is a product of Slickalgo Analytics LLP, an Indian limited liability partnership ("Ukti" or the "Company"). This policy describes how Ukti handles personal data across its services, including the Ukti app. You may request Ukti's registered office address by email to privacy@ukti.io. By using the services, you agree to this policy. If you do not agree, do not use the services.

Important: This policy is not legal advice. If you need guidance for your situation, consult a qualified professional.

1. Information Ukti collects

On ukti.io, Ukti collects nothing beyond the operational telemetry described in Section 8. The categories below apply when you create an account in the Ukti app.

Account and contact data

• Registration and login. Ukti collects your email address and the session tokens that keep you signed in. Sign-in is by a one-time code sent to your email, or through Sign in with Apple or Sign in with Google — the app has no password sign-in, so there is no Ukti password for you to set or for Ukti to store. If you use Sign in with Apple or Sign in with Google, Ukti collects the identifiers the provider shares.
• Profile and preferences. Ukti collects the name, date of birth, measurements, style preferences, and other fields you enter during onboarding or settings.

Photos, wardrobe, and user content

• Face and skin selfies. Ukti stores selfies you capture or upload for the daily styling report and for the skin tab, along with derived thumbnails and metadata (for example, MIME type and file size). These images, and the analysis Ukti runs on them, are described further in Section 12.
• Full-length body photos. Ukti stores full-length photographs of your body that you choose to capture or upload so the styling report can account for your proportions and fit. This is a distinct, more sensitive category than wardrobe or selfie images; it is optional, and you can delete these photos as described in Section 7.
• Clothing and other images. Ukti stores photos of your clothing, tags, and related media you submit through the camera or gallery flows, along with derived thumbnails and metadata (for example, MIME type and file size).
• Wardrobe and catalog data. Ukti stores item labels, categories, colors, ratings, and feedback you submit.

Voice and audio

• Stylist conversations. When you start a spoken session, your microphone audio streams from your device directly to Microsoft Azure OpenAI over an encrypted connection. The audio does not pass through Ukti's servers and Ukti does not store it. What Ukti keeps from the session is the written styling brief the conversation produced, the session identifier, and session details such as length and how the session ended. This is described further in Section 13.
• Voice test recordings. The voice test in the Look tab records three short takes from a recording screen you start yourself. The recordings are sent to Ukti, measured in the same request, and discarded. Only the resulting numbers are kept. This is described further in Section 13.

Usage, device, and diagnostic data

• Product telemetry. Ukti logs events such as sign-in, feature usage, API requests, error codes, and performance timings. On mobile, Ukti collects operating system version, app version, device model, locale, and crash reports.
• Push notification tokens. If you allow notifications, Ukti stores the push token your device is issued by Apple or Google, together with your notification preferences and delivery time, so the daily reading can reach you. The token identifies the app install on your device, not you by name. Turning notifications off in your device settings stops delivery; deleting your account deletes the token.
• Support communications. When you contact Ukti, the message, attachments, and notes required to respond are retained.

Technical data

• Server logs. Ukti's systems record IP addresses, request paths, user agents, timestamps, and security signals needed to operate and protect the services.
• Approximate location. Ukti derives your country and currency from your IP address to show market and pricing information for your region. Ukti does not access device location services.
• Cookies and local storage. Ukti uses cookies, device storage, and similar technologies only as described in Section 8.

Advertising measurement — only if you agree

Ukti runs ads to find readers. To learn which of those ads actually work, the app can send a small number of signals to the two networks Ukti advertises on: Meta Platforms (Facebook and Instagram) and Google. This is off unless you turn it on. Nothing in this subsection is collected or sent until you tap to agree, and on iOS, additionally, until you allow tracking in Apple's own prompt.

• Measurement identifiers. Meta's anonymous app-device identifier and Google's Firebase app-instance identifier — per-install identifiers the networks use to match a conversion back to the ad that caused it. On iOS, Apple's Advertising Identifier (IDFA) is read only if you allow tracking in Apple's prompt; if you decline, it is not read and measurement continues in Apple's aggregated, privacy-preserving form instead. On Android, the Android advertising ID is used on the same consent terms.
• Conversion moments. Six moments in the app — you started onboarding, finished it, saw your first verdict, opened the subscription page, started a subscription, and completed one — plus the app-install and first-open signal the networks' own kits log. Each carries at most the subscription product identifier, where in the app you were, and the price and currency of a purchase.
• Never sent. Your name, your email, your Ukti account identifier, any photo or image identifier, and any text you have typed. This is enforced in the app's code and held by an automated test, not only by this policy.

You can turn ad measurement off at any time in Profile → Ad measurement inside the app. Turning it off stops the app sending and stops Ukti's servers sending, and Ukti keeps a record of your choice so it is not asked again.

2. How Ukti uses information

• Provide the services. Authenticate you, store your wardrobe, run styling features, and deliver notifications you enable.
• Operate styling features. Send prompts, images, speech, and contextual data to model providers to generate Ukti's daily call for you.
• Measure a voice test. When you take the voice test, measure the recordings on Ukti's own servers to produce the voice numbers in your reading. The recordings are discarded once measured.
• Improve and secure the services. Debug issues, monitor reliability, prevent abuse, and develop new features. Ukti does not use your photos or content to train third-party foundation models except where a separate feature clearly states otherwise in writing and you opt in.
• Communicate with you. Send transactional messages (verification, password reset, security alerts) and, where permitted, product updates according to your preferences.
• Measure advertising, if you agree to it. Work out which ads bring readers who stay, so Ukti spends its advertising budget on those and not the rest. This is the only purpose the data in Section 1 "Advertising measurement" is used for, and it happens only after you agree.
• Comply with law. Meet legal, regulatory, and tax obligations and respond to lawful requests.

3. Legal bases (EEA, UK, and Switzerland)

Where GDPR or equivalent law applies, Ukti relies on:

• Contract — processing necessary to provide the services you request.
• Legitimate interests — securing the services, understanding aggregate usage, and internal reporting.
• Consent — optional cookies, advertising measurement, and any other processing presented as consent-based. Advertising measurement runs on consent alone, never on legitimate interests, and you can withdraw it at any time.
• Legal obligation — retention and disclosure where the law requires it.

4. How Ukti shares information

Ukti discloses information to the following categories of recipients:

• Cloud and authentication providers. Ukti uses infrastructure providers for authentication, databases, file storage, and hosting in the regions configured for production.
• AI model providers. Ukti sends prompts, images, speech, and related context to model providers to generate styling outputs. Those providers process data under their terms and Ukti's instructions as processors where applicable.
• Operational telemetry. On ukti.io, Ukti loads two first-party Vercel measurements: Speed Insights for page performance (LCP, CLS, TTFB), and Analytics for page views and visitor counts. Both report in aggregate, and neither follows you to other sites. Speed Insights sets one strictly-necessary identifier; Analytics sets none — see section 8. No advertising pixel, no session recorder, and no third-party advertising script runs on this site.
• Advertising and measurement partners. If — and only if — you agree to ad measurement, Ukti sends the identifiers and conversion moments described in Section 1 to Meta Platforms and Google, so each can match a conversion to the ad that caused it. Both use that data to measure and optimise Ukti's own campaigns under their advertising terms. Ukti does not send them your name, your email, your account identifier, your photos, or anything you have typed. Withdraw in Profile → Ad measurement and both the app and Ukti's servers stop sending.
• Push notification delivery. Notifications are delivered through Apple Push Notification service on iOS and Firebase Cloud Messaging (Google) on Android, which receive the device push token and the message.
• Payment processors. Ukti offers paid subscriptions. Your payment details are collected and processed by the platform processor (Apple App Store or Google Play in-app purchases) under that platform's own terms; Ukti does not receive or store your full payment-card details. Ukti receives limited billing and subscription-status metadata (for example, the subscription tier, renewal state, and a transaction identifier) needed to grant and manage access.
• Professional advisers and corporate transactions. Lawyers, auditors, insurers, and successors in a merger or acquisition, subject to confidentiality and legal requirements.
• Authorities. When Ukti believes in good faith that disclosure is required by law or necessary to protect rights, safety, or security.

As of the effective date above, the named recipients in these categories are:

• Supabase — database, authentication, file storage.
• OpenAI and Microsoft Azure OpenAI — vision, language, and speech models. Azure OpenAI processes the audio of stylist conversations.
• Microsoft Azure — hosting for Ukti's backend.
• Vercel — hosting for ukti.io, plus the site performance and page-view measurement described above and in Section 8.
• PostHog — product analytics: which screens and features are used, under an identifier Ukti mints. It is not linked to any advertising identifier and is not used for advertising.
• Sentry — error and crash monitoring; personally identifiable information is scrubbed before transmission.
• Apple and Google — in-app subscription verification, and push notification delivery (APNs and Firebase Cloud Messaging).
• Meta Platforms and Google — advertising measurement, only with your consent, as described in Section 1 and Section 8. Meta receives app events through its App Events kit; Google receives them through Google Analytics for Firebase and, for verified purchases, from Ukti's servers.
• Amazon SES — transactional email delivery.
• Cloudflare — DNS for ukti.io.

The processors above are bound by a Data Processing Addendum that restricts use to Ukti's instructions. Meta Platforms and Google are not processors when they measure advertising — each acts on its own account under its advertising terms, which is why that transfer is separately consented and separately withdrawable. Ukti does not use your photos or content to train third-party foundation models.

Ukti does not sell your personal information as defined under U.S. state privacy laws. Ukti does not share personal information for cross-context behavioral advertising unless you have turned on ad measurement. If you have, the identifiers and conversion moments in Section 1 — and nothing else — are shared with Meta Platforms and Google for that purpose, and you can stop it at any time in Profile → Ad measurement. Ukti never shares your photos, your account identifier, your email, or anything you have typed for advertising, whatever you choose.

5. Data retention

• Account and profile data are kept while your account is active and for up to eight years after closure where Indian tax, fraud, or legal hold requirements apply (Income Tax Act §44AA).
• Photos, wardrobe items, and styling content are retained until you delete them or delete your account, after which they are removed from active systems; backup copies typically expire within thirty days.
• Logs and telemetry are retained for up to twelve months, except longer retention for security investigations or legal obligations.
• Advertising measurement records — your consent choice, the per-install measurement identifiers, and the record of which conversions were sent — are kept while your account is active and are deleted when you delete your account. Turning ad measurement off stops any further sending immediately. What Meta Platforms and Google have already received is held under their own retention terms, not Ukti's.
• Audio is not retained by Ukti. Stylist-conversation audio is never stored; voice-test recordings are discarded once measured. The styling brief a conversation produces and the numbers a voice test produces are kept with your styling content and follow the retention above.

6. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict, or object to certain processing, to withdraw consent, to data portability, and to lodge a complaint with a supervisory authority. To exercise rights, email privacy@ukti.io. Ukti verifies requests by confirming control of your account email where appropriate.

If you are in India, the Digital Personal Data Protection Act, 2023 ("DPDP Act") grants you the following rights as a Data Principal, which Ukti honours as a Data Fiduciary:

• Right to access information (DPDP Act §11). A summary of the personal data Ukti processes about you, the processing activities undertaken, and the identities of other Data Fiduciaries and processors with whom personal data has been shared.
• Right to correction and erasure (DPDP Act §12). Correction of inaccurate or misleading personal data, completion of incomplete personal data, updating of personal data, and erasure of personal data that is no longer necessary for the purpose for which it was processed, subject to legal retention obligations.
• Right of grievance redressal (DPDP Act §13). Use the grievance channel at privacy@ukti.io with "Grievance" in the subject line. Ukti will respond within the period prescribed by the DPDP Act and its rules.
• Right to nominate (DPDP Act §14). Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

You may also withdraw consent at any time for any processing that is consent-based, with the effect described in the DPDP Act. Ad measurement is withdrawn in the app itself, in Profile → Ad measurement, and takes effect immediately on your device and on Ukti's servers; no email is needed.

7. Account and data deletion

You can delete individual photos or wardrobe entries inside the app where those controls exist. To delete your entire account, use the Delete Account option in your profile settings within the Ukti app. Ukti completes deletion of data not subject to a legal retention exception within thirty days of your in-app request. If you cannot access your account, email privacy@ukti.io from your registered address with "Account Deletion" in the subject line.

8. Cookies and tracking

On ukti.io

On ukti.io, Ukti uses at most one functional cookie: the Vercel Speed Insights identifier (strictly-necessary, 15-minute TTL, GDPR Article 5(3) Recital 66 exempt). Vercel Analytics sets no cookie at all. No marketing cookies, no behavioral tracking, no session recorders. You can control cookies through your browser settings; blocking strictly necessary cookies may break parts of the Ukti app, which uses them for sign-in.

Campaign tags are not cookies. When you arrive from an ad, those tags ride in the link's address and are handed straight to the App Store or Google Play. Ukti does not write them to your device and does not keep a copy.

In the app

The app does not use cookies for tracking and shows no advertising. Two measurement kits are built into it — Meta's App Events and Google Analytics for Firebase — and both ship switched off. They do nothing on first launch, nothing during onboarding, and nothing at all unless you tap to agree on the ad-measurement card, which appears only after your first verdict. On iOS, agreeing there is followed by Apple's own tracking prompt; declining that prompt means the advertising identifier is never read, and measurement falls back to Apple's aggregated SKAdNetwork and AdAttributionKit reporting. Declining either ask changes nothing else about the app. What is sent when you do agree is listed in full in Section 1, and you can turn it back off in Profile → Ad measurement.

Separately from advertising, the app records product analytics through PostHog and crash and performance diagnostics through Sentry, as described in Section 4. Neither follows you to other apps or sites, and neither is joined to an advertising identifier.

9. Security

Ukti uses encryption in transit (TLS), encryption at rest where supported by providers, access controls, and monitoring designed to protect personal data. No system is perfectly secure; protect your device and the email account your sign-in codes are sent to.

10. International transfers

Ukti operates from India and uses service providers in India, the United States, the European Union, and other regions. When Ukti transfers personal data from the EEA, UK, or Switzerland, it uses appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms where required. UK transfers rely on the UK International Data Transfer Addendum (IDTA) or the UK Addendum to the EU SCCs. India-originated transfers are made subject to DPDP Act §16 and any restrictions notified by the Central Government.

11. Minimum age

The Ukti services are for adults. You must be at least 18 years old to create an account or use the services, and the services are not directed at anyone under 18. Ukti does not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided personal data, contact privacy@ukti.io and it will be deleted promptly.

12. Automated processing of your images

Ukti collects and analyzes images of you to operate its features. This includes your face and skin selfies (used for the daily styling report and the skin tab) and your full-length body photos (used to account for proportions and fit). When you submit these images, Ukti and its model providers process them automatically to generate styling outputs and skin observations. The daily call and skin outputs are generated automatically and may be inaccurate or unsuitable for a given context. You should not rely on automated outputs alone for decisions with legal, medical, financial, or safety implications. Ukti does not use your photos or content to train third-party foundation models except where a feature explicitly states otherwise and you opt in.

This is styling, not medicine. Skin outputs are editorial guidance, not medical diagnosis, not medical advice, and not a replacement for a qualified dermatologist or physician.

What Ukti does not do

Ukti does not sell your personal information. Ukti does not send your photos, your skin or body analysis, your wardrobe, or anything you have typed to an advertising network, and does not use any of it to profile you for advertising — that holds whether or not you have turned on the ad measurement described in Section 1, which never touches this material. Ukti does not use your photos or content to train third-party foundation models. Ukti does not build a downloadable "taste profile" you can share, export, or be evaluated against.

13. Voice and audio

Two Ukti features use your microphone. Both are described here in full. The microphone is not used outside them.

Stylist conversations

When you start a spoken session, your microphone audio streams from your device directly to Microsoft Azure OpenAI over an encrypted connection, authorized by a short-lived credential Ukti issues for your account. The audio does not pass through Ukti's servers. Ukti does not store the audio and does not use it to train models. Microsoft processes the audio to run the conversation, and may store and review a sample of processed content to detect misuse of the service, under its published Azure OpenAI terms.

What Ukti keeps from a session is the written styling brief the conversation produced, the session identifier, and session details such as length and how the session ended. The brief is stored with your account and is removed when you delete your account, as described in Section 7. If you switch between speaking and typing mid-session, the written thread passes through Ukti's servers so the conversation can continue; Ukti does not store it.

A spoken session runs only while the app is open. The microphone is active only for the length of the session, and the session ends when you leave the app.

Voice test

The voice test in the Look tab records three short takes — ten seconds each — from a recording screen you start yourself. The recordings are sent to Ukti, measured in the same request, and discarded. No recording is written to storage or to Ukti's database, and no recording is sent to a model provider. Only the resulting numbers are kept, with your reading.

What Ukti does not do with audio

Ukti does not record you outside these two features. Ukti does not keep audio after a session or a test. Ukti does not use your audio to train models. Ukti does not sell your audio and does not share it for advertising.

14. United States (California and other states)

California residents may request the rights described in Section 6 and may ask once per calendar year about certain disclosures for direct marketing purposes. Ukti does not discriminate for exercising privacy rights. Authorized agents may submit requests where state law allows.

Sale and sharing. Ukti does not sell personal information. Ukti does "share" personal information for cross-context behavioral advertising, as the CPRA uses that word, in one case only: when you have turned on ad measurement, the identifiers and conversion moments listed in Section 1 go to Meta Platforms and Google. Nothing else is shared for that purpose, and no sensitive personal information is — not your photos, not your skin or body analysis, not your voice. Because this is off until you switch it on, no separate opt-out request is needed: the control is Profile → Ad measurement in the app, and it works in both directions at any time. You may also email privacy@ukti.io with "Do Not Share" in the subject line and Ukti will apply it for you.

15. Changes to this Policy

Ukti updates this Policy when its practices change. The new version is posted on this page and the effective date is updated. For material changes, Ukti provides notice by email or in-app message where the law requires.

16. Contact

Questions about this Policy: privacy@ukti.io
Security issues: privacy@ukti.io (subject: "Security")
General help: help@ukti.io
India DPDP Act §13 grievance redressal: privacy@ukti.io (subject: "Grievance")

© UKTI 2026. ALL RIGHTS RESERVED.