Every AI virtual try-on tool asks for the same thing before it can do anything useful: a photo of you. That's a reasonable ask technically, and a loaded one practically — you're handing an app a picture of your face or body, and most people have no real idea what happens to it next. Dozens of try-on apps and retailer AR widgets have shipped privacy policies in the last two years, and they disagree with each other wildly on the handful of things that actually matter: how long the photo sticks around, whether it trains someone else's model, and who besides the app itself gets to see it.
This guide skips the vague reassurance most marketing pages lead with and goes straight to what you should actually check before you upload anything — plus exactly what happens to a photo inside Spree, stated plainly rather than left to a linked legal document nobody reads.
What Actually Happens When You Upload a Try-On Photo
The mechanics are mostly the same across the category, even though the fine print isn't. You upload a photo, it travels to a server, and — because almost no company trains and hosts its own image-generation model from scratch — it typically gets forwarded again to a specialized AI inference provider that does the actual rendering. That second hop is the part most privacy pages gloss over.
1
Upload
Your photo leaves your device, ideally over an encrypted connection (TLS), and lands on the app's own servers.
2
Inference
The photo (and the garment image) is sent to an AI model — often a separate third-party provider — to generate the rendered try-on result.
3
Storage
The original photo, and usually the generated result, sit on a server somewhere for a period the privacy policy is supposed to state in plain terms. Many don't.
4
Retention or deletion
Eventually the photo is either deleted on a schedule, deleted only when you ask, or — in the vaguest policies — kept indefinitely with no stated end point.
Why Privacy Policies in This Category Vary So Much
A look across current try-on app and AR-widget privacy policies turns up the same handful of patterns, in wildly different proportions. Some commit to a short, specific retention window and name the AI provider that processes the image. Others keep unsaved session photos for up to a month and saved ones for years, or share try-on activity back to the retailer who embedded the tool. A few policies are little more than a single sentence promising the data is "processed securely," with no retention period, no named processor, and no description of what happens if you want it gone.
None of this is independently audited — every number above is a vendor's own claim about its own practices, not a third-party verification. That's exactly why the specific wording of a policy matters more than its tone: "processed securely" promises nothing; "deleted within 7 days of your request, and never used for model training without opt-in" promises something you can hold the company to.
The practical risk isn't usually that a try-on app is secretly malicious. It's that photo handling is treated as boilerplate legal text instead of a real product decision, so retention periods balloon, third-party processors go unnamed, and "delete my data" turns out to mean nothing happens for years. Uploading a photo that shows your face is a bigger ask than saving a product link — the policy covering it should read like the company knows that.
Five Questions a Trustworthy Policy Should Answer
01
How long is my photo kept?
A specific number of days, not "as needed" or no answer at all.
02
Does it train AI models?
Look for a direct yes/no on model training — "security" language is not an answer to this.
03
Who else sees it?
Third-party AI processors should be identified, not just implied, and bound by confidentiality.
04
Can I delete it myself?
A delete control inside the app, not a support email you have to hope gets answered.
A fifth, broader question is worth asking of the company as a whole: does it sell data to advertisers, or run third-party ad-tracking SDKs, regardless of the try-on feature specifically? A company that won't monetize your browsing habits elsewhere is a better bet to treat your face photo carefully too.
How Spree Handles Your Try-On Photos, Specifically
Rather than ask you to take this on faith, here's exactly what Spree's privacy policy commits to for photos uploaded to AI Virtual Try-On:
- Your photo is transmitted over an encrypted connection and processed solely to generate your try-on result.
- It is not used to train AI models without your explicit, separate opt-in — the default is no.
- It is shared only with the AI inference provider strictly necessary to render the result, under confidentiality obligations, and that provider does not retain images after processing.
- You can delete an uploaded photo at any time from within the app's settings — no support ticket required.
- A deleted photo is removed from Spree's servers within 7 days.
- Spree does not sell your data, does not run advertising or tracking SDKs, and earns revenue only from its optional Pro subscription.
| What to check |
Spree |
Typical AI try-on app / AR widget |
| Stated retention period | 7 days after deletion | Ranges from days to years; often unstated |
| Trains AI models on your photo | No, without opt-in | Varies; rarely addressed directly |
| Third-party AI processor named | Disclosed, confidentiality-bound | Sometimes named, sometimes not |
| Self-service deletion in-app | Yes | Varies by vendor |
| Sells data or runs ad SDKs | No | Varies; some run full ad-tech stacks |
"Typical" above reflects the spread seen across current try-on and AR-widget privacy policies as a category — not every competitor fails every column, and a handful of vendors match or beat parts of this table. The point isn't that every alternative is unsafe; it's that you have to actually check, because the category gives you no reliable default to assume.
If the preview itself — not the privacy around it — is what you're weighing, our guide to AI try-on accuracy covers what it gets right and wrong, and how Spree's AI Try-On works walks through the technical side. For the no-ads, no-tracking angle more broadly, see shopping apps with no ads on iPhone.
Frequently Asked Questions
Is it safe to upload my photo to an AI virtual try-on app?
+
It depends entirely on the app's privacy policy, which varies enormously across the category. Some apps delete your photo within days and never use it for training; others keep it for years or forward it to third-party AI processors with vague disclosure. Before uploading anywhere, check the policy for retention period, named third-party processors, and whether you can delete the photo yourself.
Do virtual try-on apps use my photo to train their AI models?
+
Some do, some don't, and many policies don't say either way. Look specifically for a sentence addressing model training, not just general security language. Spree does not use uploaded try-on photos to train AI models without separate, explicit opt-in consent.
How long do try-on apps keep my uploaded photo?
+
Retention periods across the industry range from a few days to several years, and some policies don't state a number at all. Spree removes an uploaded photo from its servers within 7 days of you deleting it in the app, and deletes or anonymizes the rest of your account data within 30 days of account deletion.
Who else sees the photo I upload for virtual try-on?
+
Almost every AI try-on tool, Spree included, has to send your photo to an AI inference provider to generate the result — that's how the technology works. The question that actually matters is whether that provider is named, bound by confidentiality, and barred from retaining or reusing the image. Spree's AI inference provider does not retain images after processing, and Spree does not sell or share photos with advertisers or marketers.
What should I check before trusting any try-on app with a photo?
+
Five things: a stated retention period, a direct answer on whether your photo trains AI models, a named third-party processor rather than a vague reference, a way to delete the photo yourself inside the app, and confirmation the company doesn't sell your data or run ad-tracking SDKs. If a policy is silent on any of these, treat that silence as the answer.
The Bottom Line
AI virtual try-on only works by sending a photo of you somewhere to be processed — there's no version of the technology that avoids that. What varies, a lot, is what happens after: how long the photo sits around, whether it quietly becomes training data, and whether you can actually make it go away. Read the policy for those four or five specific answers, not the tone of the page, before you upload anything.
Spree's answers are stated above and in its full privacy policy: short, self-service deletion, no training without opt-in, no data selling, no ad-tracking SDKs. Free to download, and the policy applies the moment you open the app, not just after you upgrade.