Privacy Policy

1. Who we are

MrDapper (“MrDapper”, “we”, “us”) is operated by [LEGAL ENTITY], whose registered address is [REGISTERED ADDRESS]. For the purposes of the UK/EU General Data Protection Regulation, [LEGAL ENTITY] is the data controller for the personal data described in this policy. You can reach our privacy contact at privacy@mrdapper.com.

MrDapper is a members’ club: a private feed, member profiles, a wardrobe (“closet”), a garage for vehicles, gatherings and invitations, a member-to-member marketplace, direct messages, and an editorial magazine. Membership is by application and approval. Until an application is approved, an account can sign in but sees only a pending screen.

2. What we collect

Account and identity

Authentication is handled by Firebase Authentication (Google LLC). Depending on how you sign in, we receive and store your email address, your display name, your chosen handle, and a Firebase user ID that identifies your account everywhere in the product.

• Email and password — the password itself is held by Firebase Authentication. We never see it and cannot retrieve it.
• Sign in with Google — Google returns your email address, name and profile photo URL.
• Sign in with Apple — Apple returns a stable user identifier and your email address. If you choose Apple’s Hide My Email relay, we only ever hold the relay address, and that is fine: everything in the app works with it.

If you apply through the website or an invite link before you have an account, we store the name and email you submit (and, on the full application form, your city, Instagram handle, style category and the short note you write) as a membership application, together with a reference code, so we can review it.

Member profile

Your profile holds what you choose to put in it: display name, handle, bio, profile photo, style preferences, sizes, your home country and state/region, and — if you set a home location — an approximate latitude and longitude for that area. Those coordinates are a rough home-area marker used to show you members and gatherings near you and to seed weather suggestions. They are not a live position and are not updated as you move. Your profile may also include a “profile anthem”: a Spotify or Apple Music track link you paste, from which we fetch public title, artist, artwork and preview data.

Photos and media you upload

MrDapper is a visual product, so images are the bulk of what you give us. We store the photos you upload to:

• your closet — individual pieces, outfits and multi-photo galleries;
• your garage — vehicle galleries and the frame sequences used for the 360° spin view;
• your posts in the member feed;
• your gatherings — cover art and event imagery;
• your marketplace listings;
• your avatar.

The iOS app asks for photo library access for exactly these uploads. Images you pick are uploaded to Firebase Cloud Storage. Any location metadata that iOS attaches to a photo travels inside the image file itself; we do not read it, index it or display it, but you should be aware it can be present in a file you publish. The camera is used for one thing only: scanning a guest’s QR pass at check-in for a gathering you host.

Things you write

Posts, captions, comments, closet and vehicle notes, listing descriptions, gathering details, RSVP notes and your application text. This content is stored so it can be shown to the members you shared it with.

Direct messages

Members can message each other one to one. Message content, the participants and timestamps are stored in our database so the conversation persists across your devices. Direct messages are not end-to-end encrypted. They are encrypted in transit and at rest, and they are not read routinely — but they are technically accessible to us, and we may access a specific conversation when we are responding to an abuse report about it or where the law requires it. Please do not use MrDapper messages for anything you would not want reviewed under those circumstances.

Contacts you select for invitations

MrDapper can invite people to a gathering, or to apply to the club, from your phone’s contacts. We do not upload your address book. When you tap people in the invite picker, only those entries — name, phone number and/or email address — leave your device. They are sent to Twilio to deliver the SMS and to SendGrid to deliver the email, for the sole purpose of delivering that invitation.

For a gathering invitation we also keep a guest record on the gathering (name, the contact detail we sent to, RSVP status, party size and any note they leave) so the host has a guest list and can check people in. For a club invitation we transmit the contact to the provider and do not store it. Only invite the people who would expect to hear from you; you are responsible for having a reason to share their details with us.

Location

The app requests “While Using the App” location only. It is used, when you open the relevant feature, to show live transit departures near you, nearby fuel stations, airport lounges and private clubs on Discover, and today’s weather for closet suggestions. Your precise coordinates are used to answer that request and are not written to your profile or kept as a location history. Weather lookups are answered by Apple WeatherKit. You can revoke location at any time in iOS Settings → Privacy & Security → Location Services; those features then fall back to your home region or stop working.

Usage, device and crash data

We record product analytics through Firebase Analytics and, in parallel, as event records in our own database. An event includes the action taken (for example a screen opened, a post liked, a listing viewed), a session identifier, the date, the platform, and your account ID — so this analytics data is linked to your identity rather than anonymous. Session start events also record your device model and iOS version. We record basic segmentation properties on your account: your member role, whether you are approved, and your profile style.

The app installs a lightweight crash handler. If the app terminates abnormally, the exception name and reason are written to the device and reported as an app_crashed event on the next launch, linked to your account.

Push notification tokens

If you allow notifications, Apple issues a device token which we register through Firebase Cloud Messaging so we can send you messages, RSVPs, gathering reminders and social alerts. Tokens are stored against your account and are deleted when they stop working or when you delete your account.

Calendar

If you grant it, MrDapper uses write-only calendar access to add a gathering you are attending to your calendar. We cannot read your calendar.

Payments

We do not collect payment card details. MrDapper takes no payment inside the app, and the marketplace processes no money — see the Terms of Use.

3. How we use it

• To create and run your account and decide on your membership application.
• To show your profile, posts, closet, garage and listings to the members you shared them with.
• To deliver direct messages, gathering invitations, RSVPs and check-in passes.
• To send push notifications and service email you have not turned off.
• To power features that need where you are: transit, fuel, lounges, private clubs, weather, and “members near me”.
• To provide AI-assisted features — see section 6.
• To keep the club safe: reviewing reports, enforcing the rules of conduct, removing content and ejecting members who break them, and detecting abuse, spam and fraud.
• To understand how the product is used so we can improve it, and to diagnose crashes.
• To comply with legal obligations and to establish or defend legal claims.

4. Legal bases (UK/EU)

Where the UK GDPR or EU GDPR applies, we rely on: performance of a contract (running your membership and the features you ask for); legitimate interests (keeping the club safe, preventing abuse and fraud, measuring and improving the product, and defending claims); consent (photo library, contacts, precise location, calendar and push notifications — each granted through an iOS permission prompt and revocable in iOS Settings); and legal obligation where we must retain or disclose something.

5. Service providers and sub-processors

We use the following processors. They act on our instructions and are not permitted to use your data for their own purposes.

• Google Firebase / Google Cloud Platform (Google LLC) — Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Firebase Analytics and Firebase Cloud Messaging. This is where your account, profile, content, photos, messages and analytics events live and are processed.
• Twilio (Twilio Inc.) — delivers invitation SMS. Receives the recipient’s phone number and the invitation text.
• SendGrid (Twilio Inc.) — delivers invitation, membership and service email. Receives the recipient’s email address and the message.
• Anthropic (Anthropic PBC) — the Claude models behind our AI-assisted features. Receives the photo and/or text you submit to such a feature.
• Google Cloud Vertex AI (Google LLC) — image generation for editorial and multimodal image embeddings used to match wardrobe pieces to our catalogue. Receives the image or prompt concerned.
• Apple WeatherKit (Apple Inc.) — returns the forecast for a location. Receives the coordinates of the weather lookup.

In addition: Apple and Google act as independent identity providers when you use Sign in with Apple or Google Sign-In; Apple operates the App Store and the Apple Push Notification service; and public track metadata is retrieved from Spotify and Apple Music when you paste a profile anthem link (no personal data is sent with those lookups).

6. AI-assisted features

Several features are AI-assisted: identifying a garment’s attributes from a photo, drafting item details for your closet, tidying text you have written, matching a piece to our catalogue, and generating editorial imagery.

When you use one of these, the photo and/or text you submit is transmitted to Anthropic and, for image generation and embeddings, to Google Cloud Vertex AI for analysis and is returned to you as a suggestion. We send only what the feature needs — the specific image or text — not your message history, your contacts or your location. Where the provider offers that commitment, content sent through their API is not used to train their models. We do not send your direct messages to any AI provider.

AI output is a suggestion and can be wrong. Review it before you publish it; what you publish is yours.

7. Sharing and disclosure

• With other members — whatever you post, publish or send is visible to the members it is addressed to. Your profile is visible to approved members.
• With people you invite — an invitation identifies you as the sender by name.
• With the processors listed above, for the purposes listed above.
• Where the law requires it — in response to a valid legal request, or where necessary to protect the rights, safety or property of a member, of the public, or of us.
• In a corporate transaction — if MrDapper is merged, acquired or sold, member data may transfer as part of it, subject to this policy.

8. What we never do

• We do not sell your personal information.
• We do not share it with data brokers.
• We do not serve third-party advertising in MrDapper.
• We do not track you across other companies’ apps or websites, and we do not use the iOS advertising identifier.
• We do not upload your address book.
• We do not sell or share personal information for cross-context behavioural advertising as those terms are used in the California Consumer Privacy Act.

9. How long we keep it

• Your account, profile and content — for as long as your account exists. You can delete individual posts, pieces, vehicles, listings and gatherings at any time; deleted items are removed from our live systems immediately.
• Direct messages — for the life of the conversation. Deleting your account deletes the whole thread, on both sides.
• Membership applications — while pending, and thereafter alongside your account, so that a stale approval cannot re-create an account you deleted.
• Gathering guest records — until the host deletes the gathering or their account.
• Invitation delivery — the contact details of someone you invite to the club are transmitted to Twilio/SendGrid and not retained by us; those providers retain delivery logs under their own retention schedules.
• Usage and crash events — up to 14 months, then aged out. Aggregate, non-identifying counts may be kept indefinitely.
• Moderation records — reports and enforcement decisions are kept for as long as needed to run the club safely and to defend the decision, even where the underlying content has been removed.
• Backups — deleted data can persist in encrypted backups for a short period before they roll over.

10. Deleting your account

You can delete your MrDapper account from inside the app, without emailing anyone:

1. Open Profile.
2. Tap Edit Profile.
3. Scroll to the bottom and tap Delete account, then confirm.

This is irreversible and performs a full server-side wipe. It deletes your authentication account, your member profile, your posts together with their likes and comments, the likes and comments you left on other members’ content, your follow relationships in both directions, your direct message threads (including the copy the other member sees), the gatherings you host together with their guest lists and check-in records, your marketplace listings, your closet and garage, your registered push devices, your entries in the shared piece catalogue, every image you uploaded, and any membership application tied to your user ID or email address.

What survives, deliberately: your RSVP as a guest on someone else’s gathering (you are a name on their list); anything another member has already saved or quoted; moderation records as described above; and aggregate analytics that no longer identify you. If you would rather we ran the deletion for you, write to privacy@mrdapper.com from your account email address.

11. Your rights

Depending on where you live, you have some or all of the following rights: to access the personal data we hold about you; to have it corrected; to have it deleted; to restrict or object to certain processing; to receive it in a portable format; and to withdraw consent you previously gave (photos, contacts, location, calendar, notifications — revocable in iOS Settings at any time). You will never be treated differently for exercising a right.

Most of these you can do yourself in the app: edit your profile, delete your content, or delete your account. For anything else, write to privacy@mrdapper.com. We will respond within 30 days. If you are in the UK or EU and you are not satisfied with our response, you may complain to your local supervisory authority.

12. Security

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Access to member data is restricted to the small number of people who need it to operate the club and respond to reports. Database and storage access is enforced by server-side security rules, so one member cannot read another member’s private data through the app. Passwords are held by Firebase Authentication and are never visible to us. No system is perfect; if we become aware of a breach affecting your personal data we will notify you and the relevant regulator as the law requires.

13. International transfers

MrDapper is operated using infrastructure located in the United States, and the providers listed in section 5 are established in the United States. If you use MrDapper from outside the United States, your personal data will be transferred to and processed there. Where we transfer personal data out of the UK or the European Economic Area we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) with the provider concerned, together with the technical measures described in section 12.

14. Children

MrDapper is an 18+ product. It is not directed to children, we do not knowingly collect personal data from anyone under 18, and accounts we identify as belonging to a minor are removed. If you believe a child has given us personal data, write to privacy@mrdapper.com and we will delete it.

15. Changes to this policy

We will update this page when what we do changes, and the “last updated” date at the top will change with it. If a change materially affects how we handle your personal data, we will tell you in the app or by email before it takes effect.

16. Contact

Privacy questions, requests and complaints: privacy@mrdapper.com.
Everything else: concierge@mrdapper.com, or see the Support page.
Postal: [LEGAL ENTITY], [REGISTERED ADDRESS].

See also our Terms of Use.