Privacy

Last updated 29 July 2026

Hopstr is a discovery app for clothes. You can use all of it without an account and without telling us who you are. Signing in is optional, and this page describes exactly what we store either way.

What we store without asking

On your first visit we set one cookie, hopstr_uid. It holds a random identifier — not your name, email, or anything derived from your device. It exists so your wishlist is still there when you come back. It is signed so nobody can edit it to read someone else's wishlist, and it lasts a year.

Against that identifier we store:

• Which products you swiped, and in which direction
• Which products are in your wishlist
• Which retailer links you followed
• Which language you read the app in
• Which country you want things delivered to, only if you change it — see below

We need all of it to run the product: swipes decide what you are shown next and stop the same item reappearing, the wishlist is the feature itself, retailer clicks are how Hopstr earns money, and the language is what stops the app changing back every time you open it. We rely on legitimate interest for this, because without it there is no product.

Analytics, only if you allow it

If you accept the analytics prompt, we load PostHog and record ten specific events — screens opened, cards swiped, links followed — so we can see which parts of the app people use. It is configured not to capture anything automatically, so nothing outside those ten events is collected. Data is processed in the EU.

Decline and PostHog is never loaded at all. You can change your mind at any time under Profile, and withdrawing clears what it stored.

Where we think you are

Some shops run a separate Belgian and Dutch store and only deliver in their own country. So that we do not show you clothes you cannot buy, we read the approximate country your connection comes from — the same signal every website receives — and use it to decide which shops appear.

We do not store it. It is worked out fresh each time and thrown away. The only thing saved is your answer if you change it under Profile, because at that point it is your choice rather than our guess. We never see your address, and the country is never attached to anything else about you.

When you visit our public pages

On the pages anyone can reach — this one, the home page and the other legal pages — we count how many visits each page gets, and nothing more. No cookie is set, no identifier is stored, and no profile is built. We cannot tell who you are, we cannot recognise you on a later visit, and none of it can be connected to a waitlist signup or to anything you do inside the app.

It exists for one narrow reason: without it we cannot tell the difference between nobody visiting and people visiting and leaving. The counting is done by Vercel, who host the site, and the figures we see are totals rather than people.

If you join the waitlist

We store the email address you type in, and nothing else — no name, no tracking pixel, no profile. It is kept separate from any account you later create and from any swiping you do, and it is used for one purpose only.

The legal basis is your consent, given by submitting the form, and the purpose is narrow: one email when Hopstr opens. It is not a newsletter list, we will not sell or share it, and we will not repurpose it for marketing without asking you again.

Ask us to remove you at any time at legal@hopstr.co and we delete the row — no confirmation loop, no retention period.

If you sign in

Signing in is optional and nothing requires it. If you choose to, we send a six-digit code to your email address and store:

• Your email address
• Your first name, if you give one — it is skippable, and only used to greet you

These attach to the anonymous identifier you already had, so your existing wishlist and swipes stay yours — nothing is merged from anyone else, and no second profile is created. The legal basis is your consent, given by verifying the code.

The email is used to sign you in and for nothing else. We send no newsletters and no marketing. The sign-in code itself is sent through Resend, our email provider, and is stored only as an unreadable hash that expires after ten minutes.

You can delete your account and everything attached to it from Profile, at any time, without asking us.

What we never do

• Sell or share your data with advertisers
• Use advertising or cross-site tracking cookies
• Ask for your address or payment details
• Require an account, or require a name if you make one
• Send you anything you did not ask for

Hopstr never handles payments. When you follow a link to a retailer you are on their website under their privacy policy, and what happens there is between you and them.

Affiliate links

Most links to retailers are affiliate links: if you buy something, the retailer pays us a commission at no extra cost to you. Where we have no agreement with a retailer, we earn nothing. Either way the retailer is named before you leave, and so is which of the two this is. More about how this works.

Following an affiliate link takes you through the network that runs that retailer's programme — TradeTracker or Awin, depending on the retailer. The network sets its own cookie in order to credit the sale to us, under its own privacy policy rather than this one. We do not pass it your email address, your name or your wishlist, and we do not learn what you bought — only whether a purchase was attributed to Hopstr.

A link we are not paid for involves no network at all. You go straight to the retailer's own page, and no affiliate cookie is set by anyone. We still record the click, exactly as above.

How long we keep it

Until you delete it or the identifier expires. If you have not signed in, clearing your browser storage ends the association — and loses your wishlist with it, because the cookie is the only thing linking you to it. If you have signed in, your email is that link instead, so signing in again on any device brings your wishlist back.

Your rights

Under the GDPR you can request access to your data, correction, deletion, or a copy of it, and you can object to processing. If you have signed in, you can delete everything yourself from Profile — no request, no waiting. Otherwise, or for anything else, email legal@hopstr.co; if you have not signed in, include your identifier so we can find the right rows.

You can also complain to the Belgian Data Protection Authority at gegevensbeschermingsautoriteit.be.

Who we are

Hopstr is operated by Kristof Houben, Gilissenweier 14, 3600 Genk, Belgium.

For any question about your data, or to exercise any of the rights above, write to legal@hopstr.co. We answer within one month, as the GDPR requires.