Lookbook is a continuity and department-management tool for film/TV Makeup, Hair, Wardrobe and Prosthetics departments. It handles sensitive material — photographs of actors in various states of makeup and costume, schedules, and crew information — and is built accordingly.
Where the data lives
- On device: each crew member's phone keeps an encrypted-at-rest local copy (standard iOS/Android storage encryption), so the department keeps working with no signal on location. Photos never leave the app's private storage area.
- In the cloud: data syncs through Supabase (built on Amazon Web Services), encrypted in transit (TLS) and at rest. Photos are stored in a private bucket — there are no public links; every download requires a signed, expiring URL issued only to authenticated members.
Who can see what
- Per-production isolation, enforced by the database. Every record is bound to a production, and row-level security rules in the database itself — not just the app — make records invisible to anyone who is not an active member of that production. A crew member on Show A cannot query, guess or stumble into Show B's data.
- Membership is scheduled. Day players are given a last working day; when it passes, their access lapses automatically. Nothing needs to be remembered or revoked by hand.
- Roles. Only the production owner and department heads can invite crew, change roles, or set access dates. Invites are short-lived codes (30 days / limited uses).
- Accounts are individual email sign-ins (Supabase Auth). No shared logins.
What the vendor can see
- AI call-sheet reading sends the sheet's text to the AI provider for parsing only; results are returned to the production and the text is not used for model training under the provider's enterprise terms. No continuity photos are ever sent to AI providers. (The current AI subprocessors are named in the Privacy Policy.)
- Usage metering records counts (who used AI, when, how much text) — never content.
Ownership & wrap
- The production owns its data. At wrap, the department exports the Wrap Archive — the complete continuity book (profiles, looks, product records, per-scene entries and photos) — as a deliverable, and can additionally export the raw data.
- Deletion on request: a production's records can be permanently removed after wrap.
Operational safeguards
- All sync writes are authenticated and validated server-side; conflicting edits resolve deterministically (last-writer-wins with server timestamps).
- Database point-in-time recovery is enabled for paying productions.
- Payment handling is by Stripe; Lookbook never stores card numbers.
See also the Data Processing Addendum — written so a production's legal and security teams can sign off quickly. We will also answer reasonable written security questionnaires and execute a production's standard NDA on request.
Questions: ordynapp@gmail.com