Privacy policy

This policy covers Kostuma, the website at kostuma.vercel.app (“Kostuma”, “we”, “us”). It explains what we collect when you browse, create an account, use My Pumpkin Basket and the Fitting Room, join Kostuma Pro’s waitlist, or send us a message, and what we do with it.

Kostuma is made and run by its developers, a small independent team (not a registered company). We are responsible for the information this policy describes. For questions or requests about yours, email vlad.atwok@gmail.com.

Kostuma is not affiliated with Perfect Corp. (YouCam), which provides its AI image service.

You can browse Kostuma without telling us who you are. To show you the site:

• Our host, Vercel, receives every request your browser makes, with its IP address and browser details, to deliver the pages and protect the site. It may keep them in short-lived technical logs.
• My Pumpkin Basket, without an account, is kept only in your browser, on your device. We never receive it.
• Your language. If you pick a language other than your browser’s, a cookie remembers it until you close the browser.

We use no analytics, advertising or tracking tools. Kostuma serves its own fonts and costume photos, so looking at the costumes tells no other company what you look at.

When you create an account, we keep:

• your name and email address (and whether it has been verified), and your Google profile picture if you sign in with Google;
• your password, which Firebase Authentication (Google) stores for us scrambled (hashed), so no one can read it, not even us;
• how you signed up (email or Google), the site’s language at the time, and when you agreed to the Terms of service and this policy;
• when the account was made, when you last signed in, and how many times you have;
• roughly where you signed up from (country, region, city and time zone), worked out by our host from your IP address, which we don’t keep;
• the kind of device, operating system and browser you signed up on.

We use them to run your account and keep it secure, and the last two to understand where our visitors come from and which devices to support. Signed in, My Pumpkin Basket is kept with your account too, so it’s the same on every device.

When you use the Fitting Room, we keep:

• the photos you choose: your face and, for most costumes, you from head to toe. Before keeping them, we shrink them, turn them upright and save them as new pictures, which drops the hidden details a photo file can carry, such as where it was taken;
• the color of your skin, measured from your face photo, so the makeup starts from your own shade;
• each try-on: the costume, the pictures made from your photos, and when;
• whether your account has used its free costume, on which costume, and how many of its try-ons failed because of your photos after pictures were made, which limits trying again. This stays with your account when your photos are deleted.

To make the pictures, we send your photos, with no name, email or account details, to YouCam, a service of Perfect Corp. As soon as each picture comes back, we ask YouCam to delete the job and its files; YouCam deletes them within 30 days in any case.

Your photos and pictures are private: stored closed to the public, and shown only to you, signed in.

To keep the Fitting Room fair, we count the try-ons each account starts over an hour, with a scrambled code made from your account. We use it only for that hour, then delete it.

Your face photo shows your face and skin tone, and your head-to-toe photo your body. To make your pictures, YouCam’s software finds your face and its features, to put the makeup on them, and your body, to put the costume on it. Kostuma itself only measures the color of your skin, so the makeup starts from your own shade. This is done only to make your pictures.

We don’t use your photos to identify you or to recognize you again, and we don’t make or keep a faceprint (a template of your face’s geometry). We never sell your photos, your pictures or what is measured from them, never share them for advertising, and never use them to train AI. YouCam handles them for us only to make your pictures.

We keep your photos and the pictures made from them for up to 12 months after you add them, or until you delete them on your account page. YouCam deletes its copies within 30 days.

Before every try-on, we ask for your consent to this on the screen where you confirm your photos, and we keep when you gave it and to which words. You can withdraw it at any time by deleting your photos on your account page: nothing more is made from them.

When you press “Get Kostuma Pro”, we put your account on the waitlist and keep: the email to write to (your account’s, unless you give us another), whether it is your account’s verified email, your account’s email, the site’s language, where you pressed it, and when you joined and last changed the email.

We use them only to tell you about Kostuma Pro.

When you use the feedback form, we keep what you wrote and what it’s about, your email if you give one (only to reply), your account if you’re signed in, the site’s language, the kind of device, operating system and browser, and when you sent it.

To stop the form from being flooded, we count the messages from each account, or each connection, over an hour. For that, we keep a scrambled code made from your account or your IP address, never the address itself. We use it only for that hour, then delete it.

The forms to create an account and to send feedback use Google reCAPTCHA to tell people from bots. It collects information about your device and how you use the page, and sends it to Google. Google’s Privacy Policy (opens in a new tab) and Terms of Service (opens in a new tab) apply to it.

If you choose “Continue with Google”, Google gives us your name, email address and profile picture, under Google’s Privacy Policy.

• session: keeps you signed in, for up to 14 days or until you sign out.
• NEXT_LOCALE: the language you picked, until you close the browser.
• Browser storage: My Pumpkin Basket (kostuma.basket) and, signed in, a copy of your account’s basket (kostuma.basket.account), until you clear it or sign out.
• Google sets its own cookies when the robot check or Google sign-in loads.

All of them are needed for the site to work, so there is nothing to accept: we use no advertising or analytics cookies.

We don’t sell your personal information or share it for advertising. These companies process it for us, only to run Kostuma:

• Vercel hosts the site (Vercel’s privacy policy (opens in a new tab)).
• Google, through Firebase, runs accounts and sign-in, the database (your profile, basket, try-ons, waitlist entry and messages) and the file storage (your photos and pictures), and the robot check (Google’s Privacy Policy (opens in a new tab)).
• Perfect Corp., through YouCam, makes the Fitting Room’s pictures from your photos.

We may also disclose information when the law requires it, or to protect the rights and safety of Kostuma and others.

These companies operate in the United States, Taiwan and other countries, so your information may be processed outside your own country, where data protection laws can differ.

• Your account and basket: until you delete your account on your account page, or ask us to.
• Your photos, the pictures made from them and your try-ons: up to 12 months after you add them, or until you delete them, or your account, on your account page.
• Whether your account has used its free costume: as long as your account exists.
• Your place on Kostuma Pro’s waitlist: until you ask us to take you off it, or delete your account.
• Messages from the feedback form: as long as we need them to act on them, or until you ask us to delete them.
• The scrambled codes that limit messages and try-ons: used for an hour, then deleted.
• At YouCam: deleted as soon as each picture is made, and within 30 days at most.
• On your device: until the cookie ends or you clear your browser’s storage.

Wherever you live, you can ask us for a copy of your information, to correct it, or to delete it. You can delete your photos and pictures, or your whole account, yourself on your account page. For anything else, email vlad.atwok@gmail.com from the address on your account, so we know it’s you. We answer within 30 days.

If you’re in the European Economic Area, the United Kingdom or Switzerland, you can also object to or restrict how we use your information, take it elsewhere, and complain to your data protection authority. We use it to provide what you asked for (your account, basket, try-ons, the waitlist and replies), and for our legitimate interests in keeping Kostuma secure, stopping abuse and understanding our visitors (the sign-up place and device details).

If you’re in California: we don’t sell or share your personal information, and you won’t be treated differently for using your rights.

Kostuma is served only over encrypted connections (HTTPS). Your photos, pictures and account data are closed to the public and reached only through our server, for you. No system is perfectly secure; if a breach puts your information at risk, we’ll tell you without undue delay.

Kostuma isn’t for children, and accounts are for people 17 and older. We don’t knowingly collect information from children. If you think a child has given us theirs, email us and we’ll delete it.

When this policy changes, the date at the top changes too. If a change matters to you, we’ll say so on Kostuma before it applies.