Privacy

Last updated 15 September 2026

exactli builds a 3D body from a shopper's own measurements and simulates a shop's real production patterns on it, size by size, inside the product page. To do that it needs measurements. This page says exactly what is kept, what is not, and how to have it removed.

If you save an avatar

Saving lets you return to any shop using exactli without building your body again. Two things are kept:

• A hash of your email address. Not the address — an HMAC of it. The same address always produces the same hash, which is how you are recognised, but the hash cannot be turned back into the address.
• The avatar itself — roughly 450 bytes: the body preset you chose, gender, body type, height, shape, the measurements you entered, and any garment you pinned to wear with others. Nothing in it identifies you by name.

Your measurements are what the simulation runs on. They are used to fit garments and for nothing else — not advertising, not profiling, and they are never sold or shared with another company.

While you are signing in

Confirming an email means actually sending one, so for those few minutes the address is held in plain text in a short-lived sign-in record. Once the link is used or expires the record is deleted; expired ones are swept automatically every hour.

On your device

A sign-in token is kept in the try-on panel's storage, separately for each shop, so returning to the same shop is silent. Your theme choice is kept the same way. Neither leaves your browser except as the token that identifies your session.

If you write to us

The contact form stores what you typed — your name, your email address, your store link if you gave one, and your message — because we cannot reply otherwise. That address is kept in full, unlike a saved avatar's. A hash of your IP address is kept alongside it, used only to stop the form being flooded.

Visiting this website

This site records how it is used, so we can tell which parts explain the product and which do not:

• A random id for the visit, kept in the tab and discarded when you close it. It identifies a visit, never a person, and cannot link today to tomorrow.
• Which pages and sections you reached, what you pressed, and how long you stayed.
• A hash of your IP address — again, only to bound abuse.

There are no cookies and no advertising trackers, which is why you are not being asked to accept any. Page-level statistics come from Cloudflare Web Analytics, which is also cookieless. If you would rather not be counted at all, open exactli.org/?noev=1 and this browser stops reporting entirely.

If you are a shop

To build a try-on we need the garment: production patterns, or a physical sample, plus the fabric. Pattern files are held in our own private storage and used to build and maintain your try-on. They are not shared with anyone, not used for another shop's garments, and not used to train anything sold to a third party. We keep them for as long as your try-on is running so it can be rebuilt or corrected; ask and we will delete them.

Installing the Shopify app also stores your shop domain, your product catalogue as Shopify reports it, and the status of each garment we are building for you.

What we never store

• Photographs of you. The avatar is built from numbers you type, not from a picture.
• Payment details. No payment ever passes through exactli.
• Your email address against a saved avatar — only a hash of it.
• Your precise location.

Who else can see it

• Cloudflare — hosts the site, the database and the storage, and provides the cookieless page statistics.
• Resend — sends sign-in links and delivers contact-form messages to us.
• Shopify — where the shop's own product data lives, if you met us through a store.

Nobody else. Nothing here is sold, and none of it is used for advertising.

How long it is kept

• Sign-in records: deleted when used or expired, swept hourly.
• Sessions: deleted when they expire.
• Saved avatars: kept until you ask for them to be removed.
• Messages you send us: kept so we have a record of the conversation.
• Site activity: kept while it is useful for improving the site.

Removing your data

Email support@exactli.org from the address you saved your avatar with and we will delete it. Because we hold only the hash, that address is how the record is found — and once it is gone there is nothing left tying the avatar to you. Ask and we will confirm when it is done.

You can also clear a saved avatar from a single device at any time from the try-on panel, though that leaves the saved copy in place for your next sign-in.

Asking us anything

support@exactli.org for anything about your own data, ahmedali@exactli.org for anything about putting exactli on a shop. A person reads both.