ThriftUp — Privacy Policy

Last updated: 10 September 2026

ThriftUp is a fashion discovery app. It shows you a feed of second-hand clothing listings, learns what you like from the items you save, and lets you search by text or by photo. This page explains exactly what data that involves.

ThriftUp has no accounts. You never give us a name, an email address, or a password. The app identifies your device only, so that your saved items and your feed follow you between sessions.

Who is responsible for your data

The data controller is Urban Cretnik, Dordtselaan 100C, 3073 GH Rotterdam, the Netherlands.

For any privacy question or request, including deletion: info@thrift-up.com.

What ThriftUp collects

Data	Why
A device identifier — a random value the app generates on first launch. It is not your Apple ID, your phone number, or an advertising identifier.	To recognise your device on return so your saved items and learned preferences persist.
Your onboarding answers — which style photos you swiped right or left on, the style profile inferred from them, and whether you chose menswear or womenswear.	To give you a feed that reflects your taste from the first session instead of showing random items.
What you do in the feed — items you save, items shown to you, how long each item was on screen, how many of its photos you looked at, and taps through to the seller's listing.	To rank the feed, to avoid repeating items you have already seen, and to improve the recommendation model.
Your chat searches — the text you type, and the filters (garment type, colour, size, price) derived from it.	To answer the search, and to understand which searches the app handles badly.
Photos you upload to search — processed in memory to compute a numerical representation, then discarded. Uploaded photos are not stored on our servers.	To find visually similar or stylistically matching listings.
A push notification token — only if you allow notifications when the app asks. Deleting the app, or turning notifications off in iOS Settings, invalidates it.	To notify you — for example when an item you saved is sold. Never used for marketing.
Technical data — IP address in standard server logs, device model and operating system version, crash reports, and anonymous usage events (screens opened, actions taken).	To operate the service securely, to find crashes and broken flows, and to understand which features are used.

ThriftUp does not collect your name, email, phone number, contacts, precise location, health data, or payment details. ThriftUp does not process payments — buying an item happens on the seller's own site, under their terms and their privacy policy. ThriftUp shows no advertising, does not use advertising identifiers, does not track you across other apps or websites, and does not sell or share your data with advertisers or data brokers.

Legal basis

Providing the service you asked for (GDPR Art. 6(1)(b)) — the device identifier, your saved items, your onboarding answers, your searches, and the push token you opted into. Without these the features they power cannot function.
Legitimate interests (Art. 6(1)(f)) — security logging, crash reports, and privacy-preserving product analytics (anonymous device-level events, no advertising identifiers, no cross-app tracking), to keep the service working and to improve it. You can object at any time by emailing info@thrift-up.com, and we will exclude your device from analytics.

Who else processes your data

ThriftUp uses a small number of service providers. They act on our instructions and may not use your data for their own purposes.

Provider	What they receive	Where
Hetzner Online GmbH — servers, database, image storage	All data described above	Germany (EU)
Groq, Inc. — interprets your chat searches	The text of your chat message	United States
PostHog, Inc. — product analytics	Anonymous usage events with the device identifier	United States
Functional Software, Inc. (Sentry) — crash reporting	Crash traces, device model, OS version	Germany (EU)
Expo (650 Industries, Inc.) — delivers push notifications	Your push token and the content of notifications sent to you	United States
Modal Labs, Inc. — computes the recommendation model	Listing photos only — no user data	United States
Apple Inc. — App Store and TestFlight distribution	Install data and, for TestFlight testers, your tester email and feedback, held by Apple under Apple's own privacy policy	United States / global

Transfers outside the EU rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard offered by the provider (Groq, PostHog, Expo and Modal participate in the EU–US Data Privacy Framework or offer SCCs).

How long it is kept

Server logs (IP addresses) — deleted after 30 days.
Everything else — kept while ThriftUp operates and your device keeps using the app, because the recommendation model learns from your history. We review stored data at least yearly and delete or anonymise what the service no longer needs.
On request — sooner, whenever you ask. See below.

Deleting your data

Email info@thrift-up.com and ask. Because ThriftUp has no accounts, your device identifier is the only thing that distinguishes your data from anyone else's — so we will reply asking for it, and tell you where to find it. Without it we genuinely cannot tell which data is yours, and we will not guess.

We will act within one month. When we do:

The device identifier is destroyed and replaced with a value that cannot be traced back to it, so nothing remaining points to your device.
Your inferred style profile, your onboarding answers, your section preference and your push token are erased.
The text of your chat searches is erased.
The record that some anonymous user saved or viewed certain listings is kept, no longer connected to any device or person, and used only to improve recommendations. We are being deliberately precise here: these records remain grouped together, so while they cannot be linked back to you, they are best described as anonymised-but-grouped rather than mathematically irreversible.

Deleting the app from your phone does not by itself delete data already stored on our servers — Apple does not notify us when an app is removed. Please email us if you want your data erased.

Your rights

Under the GDPR you have the right to access your data, to correct it, to have it erased, to restrict or object to how it is used, and to receive it in a portable form. Exercise any of these by emailing info@thrift-up.com.

You also have the right to complain to a data protection authority — either where you live or where we are based. ThriftUp operates from the Netherlands, where the authority is the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl.

Children

ThriftUp is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has used the app, email us and we will erase the data.

Changes

If this policy changes materially we will update the date at the top and, where the change matters to you, tell you in the app.