Privacy Policy for Ensemble
Last updated: 28 September 2026
Summary
Ensemble has no account, no analytics, no advertising and no tracking, and never sells or shares your data. Your closet lives on your own devices and in your own private iCloud. The daily stylist runs entirely on your device.
A few things do leave your device, only to do the job you asked for: a photo of a garment is sent to be tagged, and some features send a text description of your clothes to be planned or summarised. These pass through the developer's server to Google's Gemini AI service. The server stores none of it; it answers and forgets. The app asks your permission before the first of these, and you can turn it off in Settings. Each case is listed below.
This policy covers the Ensemble apps for iPhone, iPad and Mac, including the share extension (“the app”), published by Michael Shear. It says what the app stores, what it sends, to whom, and why.
What stays on your device
- Your closet: garment photos, their tags, and anything you edit.
- Saved looks, what you wore and when, your reactions to looks, and your style profile.
- Trips, capsules, and the things on your Considering shelf.
- Your settings.
Choosing an outfit happens on your device. Asking the stylist for a look makes no network request at all.
iCloud
If iCloud is on, the app keeps a copy of all of the above in your private iCloud database (Apple's CloudKit), so your iPhone, iPad and Mac stay in step. It lives in your Apple Account and counts against your iCloud storage. The developer has no access to it and no way to read it. Apple's handling of it is covered by Apple's privacy policy.
You can turn iCloud sync off in the app's Settings, and remove everything the app has put in iCloud with Delete everything from iCloud.
What is sent, and why
These requests go to the developer's server, which runs on Cloudflare and passes them to Google's Gemini API. The app sends:
- Garment photos, to be tagged. When you add something to your closet or your Considering shelf, the photo is sent so the app can tell what it is: category, colour, fabric, formality and season. The tags come back and are stored with the garment on your device.
- Your style interview answers, if you take the interview, so they can be summarised into a style profile. Your name is not sent.
- Your reactions to looks (liked, disliked, would wear, wore), with text descriptions of those looks and what you asked for, so the app can update its sense of your taste. This happens from time to time once you have reacted to a few looks.
- Trip details, when you plan a trip: the destination, dates, kind of trip, the forecast there, and a text description of your clothes (no photos), so a packing list and a day-by-day plan can be made.
The server does not keep any of this. It stores no photos, no descriptions and no answers, and there is no database of users, because there are no users to keep: the app has no accounts. What the server does record:
- Cloudflare's request logs, kept for a few days: standard request details such as time, size, and the network address the request came from. Your IP address is also used, and not stored, to limit how often a single connection can call the server.
- Usage counts: how many tokens each request used and what it cost, so the server can cap its own daily spending. No content.
- If you subscribe to Ensemble Pro, the App Store's signed record of the subscription goes with each request. The server may log which plan it is and when it expires. It contains no name or email address.
Google Gemini processes what is sent, to produce the answer. The app uses Google's paid Gemini API, under Google's Gemini API terms, which say that paid-service prompts and responses are not used to improve Google's products. Google may keep them for a limited period to detect abuse.
Location and weather
Suggestions account for the weather. If you allow location access, the app reads your approximate location and rounds it to about a kilometre before it leaves the device. That goes to Apple WeatherKit, or to Open-Meteo if WeatherKit is unavailable, to get the local forecast. Apple's geocoder also turns it into a place name. For a trip, the destination you type is looked up the same way. Your location is not sent to the developer's server, and it is not stored. Only the resulting weather summary, such as “18°C, light cloud”, is included in a trip request.
Photos, camera and screen
The app sees only the photos you pick, take, share into it, or drop onto it. On the Mac, grabbing something from the screen needs macOS's Screen Recording permission. The app only uses it when you ask for a grab, and keeps only the area you select.
Purchases
Ensemble Pro is sold through the App Store. Apple handles payment, and the developer never sees your payment details, name or email address. Whether a subscription is active is read from the App Store on your device.
What the app never collects
- A name, email address, or login. There is no account.
- Advertising identifiers, or a device identifier of its own.
- Analytics, telemetry, or third-party crash reporting.
- Your contacts, calendars, messages, health data, or browsing history.
The app contains no third-party SDKs.
Tracking
The app does not track you across other companies' apps or websites, and does not share data with data brokers. Nothing is sold.
Your control over your data
- Delete a garment, look, trip or capsule in the app. It is removed from your device and, with sync on, from your iCloud.
- Delete everything from iCloud in Settings removes the app's iCloud copy and turns sync off.
- Deleting the app removes everything it stored on that device.
- Nothing needs deleting from the developer's server, because nothing is kept there.
Children's privacy
The app is not directed to children under 13 and does not knowingly collect personal information from them.
Changes to this policy
If the app's data handling changes, this page changes with it: the updated policy will be posted at this URL and the “last updated” date revised.
Contact
Questions about this policy, or about Ensemble: shearm@mac.com.