Privacy Policy

WashGuard is built to be helpful and private: your photos are processed solely to generate a care recommendation. We never sell data; analytics and advertising services run only with your consent. This page explains what we process and why.

1. Controller

Milena Marketing ltd., Alabin Street 33, 1000 Sofia, Bulgaria (VAT ID BG208676776), represented by managing director Milena Barton. For any privacy question, reach us via our contact form.

2. Data we process

On this website:

• Server logs — our hosting provider (Hetzner Online GmbH, Germany; servers in the EU) processes technically necessary data such as IP address, browser type and time of access to deliver and secure the site.
• Contact form — if you write to us via the contact form, we process your name, e-mail address and the content of your message in order to answer your enquiry. Delivery is handled by the form service FormSubmit; the message is delivered to our e-mail inbox.
• Analytics and advertising services — only with your consent, see section 4.

In the WashGuard app:

• Account — your e-mail address and sign-in details (also when you sign in with Apple or Google), an optional display name (which may also be taken from Sign in with Apple or Google) and an optional profile photo, which is stored in Firebase Storage. All of this is deleted together with your account.
• Photos & scans — when you start an analysis, your photo of a garment, care label, detergent or appliance is sent to our backend (Google Firebase) and from there to Anthropic PBC (Claude API, USA), which carries out the AI image recognition on our behalf as our processor. The photo is deleted from our backend as soon as the analysis job has been picked up; only the result is stored in your history.
• History — the care recommendations you save and the appliances and detergents you register. When you switch the app language, saved recommendations are translated for you — this too is done by Anthropic PBC (Claude API, USA) on our behalf.
• Subscription — WashGuard Plus is purchased via the Apple App Store (iOS) or Google Play (Android, Google Play Billing). Payment is processed by Apple or Google; we never see your payment details. Your subscription status is managed by RevenueCat, Inc. (USA) as our processor, which processes a pseudonymous account ID, your purchase and subscription status and transaction data.
• Crash reports & diagnostics — Firebase Crashlytics (Google) collects crash reports and diagnostic data (e.g. device model, operating system and app version, crash traces, an installation ID) so that we can fix errors and keep the app stable. These reports are not linked to your account.
• App integrity — Firebase App Check (Google) uses Apple App Attest (iOS) or Google Play Integrity (Android) to check that requests to our backend come from the genuine WashGuard app on a genuine device. This protects the service against abuse.
• Contact form — if you write to us via the contact form in the app, your name, e-mail address and message are sent via the form service FormSubmit to our e-mail inbox, just like the contact form on this website.
• Usage analytics — only with your consent, see section 4.

3. Purposes and legal bases

We process data to provide the service — analysing photos (including their transmission to Anthropic), generating care recommendations, syncing your history, managing your account and subscription and answering enquiries (Art. 6(1)(b) GDPR). Based on our legitimate interest in a safe, stable, working product (Art. 6(1)(f) GDPR), we analyse crash reports and diagnostic data and check that requests come from the genuine app. For analytics and advertising we use data only with your consent (Art. 6(1)(a) GDPR, see section 4); we never sell it.

4. Cookies, analytics & advertising

We use analytics and marketing services to improve our website and measure the performance of our advertising:

• Google Analytics 4 and Google Ads (Google Ireland Ltd., Ireland)
• Meta Ads / Meta Pixel (Meta Platforms Ireland Ltd., Ireland)
• TikTok Pixel / TikTok Ads (TikTok Technology Ltd., Ireland)

These services use cookies and similar technologies and process pseudonymised usage data (e.g. pages visited, device and browser information, advertising IDs, approximate location) to measure reach, build audiences and attribute conversions. Data may be transferred to the parent companies in the USA; such transfers are based on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

All of these services run only if you consent via the cookie banner (Art. 6(1)(a) GDPR, ePrivacy rules). Without consent they remain fully disabled. You can withdraw or adjust your consent at any time with effect for the future via the website's cookie settings.

In the app, we use Firebase Analytics (Google) only in the version published in the App Store and on Google Play, and only if you consent in the app. It processes pseudonymised usage data (e.g. screens viewed and features used) linked to a pseudonymous app instance ID. Without consent, no usage data is collected; you can withdraw your consent at any time in the app's settings. The app shows no ads, uses no advertising identifier (neither Apple's IDFA nor the Google Advertising ID) and does not track you across other companies' apps or websites.

5. Affiliate links

Product suggestions in the app may contain affiliate links (e.g. to Amazon). Only when you click such a link does the respective provider process data under its own privacy policy; we may earn a commission — at no extra cost to you.

6. Recipients and international transfers

We share data only with service providers that help us operate the service (website hosting by Hetzner Online GmbH, Germany; app backend, crash reports, app integrity checks and — with consent — app analytics by Google Firebase; AI image and text analysis by Anthropic PBC, USA; subscription management by RevenueCat, Inc., USA; form delivery by FormSubmit; and — with consent — the analytics and advertising partners listed in section 4) and that are contractually bound to confidentiality. Apple and Google process subscription payments under their own privacy policies. Where data is transferred to countries outside the EU/EEA (e.g. the USA), this happens on the basis of appropriate safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

7. Retention

We keep personal data only as long as necessary for the purposes described. Photos are deleted from our backend as soon as the analysis job has been picked up. Account data (including display name and profile photo), history and the subscription status stored with us are deleted when you delete your account — in the app under More → Delete account, or without the app as described on our Delete your account page. Crash reports and analytics data are not linked to your account and are deleted automatically after the retention periods of Google Firebase. Contact-form enquiries are deleted once they have been fully answered and no statutory retention obligations apply.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw any consent at any time with effect for the future. You can also lodge a complaint with a data protection authority — in Bulgaria, the Commission for Personal Data Protection (CPDP, cpdp.bg).

Just use our contact form.