Skip to content
Hatrack

Privacy policy

Last updated: October 29, 2026

This privacy policy explains how personal data is processed when you use the Hatrack app for iPhone (“the app”) and this website, in accordance with EU Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Data controller

Kevin Detter, Carrer Serra Grossa, 10 - Vivienda 3, 03110 Mutxamel, Alicante, Spain. Email: legal@hatrack.eu

Data we process in the app

Account

When you create an account we process your email address and password (stored only as a secure hash). If you use Sign in with Apple, we receive an identifier from Apple and the email address you choose to share, which may be a private relay address.

Profile and collection

Your username, optional avatar, the hats in your collection, their condition, size, notes, and optional purchase location and date, and the photos you add. The app only accesses your camera or photo library when you choose to add a photo. Before a photo is uploaded, the app re-encodes it on your iPhone, which removes its location and other metadata, such as the camera model and the time it was taken.

Catalog submissions

When you submit a hat that’s new to the catalog, we process its details and photos, and whether “Share my photos with Hatrack” was turned on when you submitted it.

Community

Who you follow, who follows you, the tips you give to other collectors’ hats, and the comments you write on them. Comments are visible to everyone who can see the hat.

Wishlist

The hats you add to your wishlist. Only you can see your wishlist. Other users see only how many collectors want a hat, never who.

Reports and blocks

Reports you file about a hat, a collected hat, a comment or a profile (the reason and an optional note), and the collectors you block.

Feedback

The content of messages you send through “Give feedback” in the app.

Notifications

If you allow push notifications, we store a device push token and your notification preferences.

Diagnostics

When the app crashes or runs into an error, we receive a technical report including device model, operating system version, app version, and the error details. Account and record identifiers are removed from these reports before they are sent, and the reports are not linked to your account. When the app checks for updates, it sends its version, your operating system and a random installation identifier that doesn’t identify you or your device. None of this data is used for advertising.

Usage statistics

The app counts a few anonymous events: when you open it, sign up, add a hat to your collection, submit a hat to the catalog or use search. Each event comes with its name, a time, a session identifier, the app and operating system version, your language and a coarse country or region. No account identifier, username, email address, search text or content is ever sent. Your IP address is used only in memory to derive that country or region and a daily pseudonymous identifier, and isn’t stored. You can turn this off at any time in Settings › Privacy.

  • Providing the app (account, collection, catalog, catalog submissions including the automated analysis of their photos, community features, support, data download): performance of a contract, Art. 6(1)(b) GDPR.
  • Push notifications: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time in the app or in your iPhone’s settings.
  • Using and keeping accepted catalog photos: legitimate interest in a complete catalog, Art. 6(1)(f) GDPR. The “Share my photos with Hatrack” toggle is on by default for public profiles, and you can turn it off when you submit a hat. You can object at any time (see Your rights).
  • Moderation (reviewing submissions, handling reports, enforcing the terms of service): legitimate interest in a safe community and an accurate catalog, Art. 6(1)(f) GDPR, and our legal obligations as a hosting service under the EU Digital Services Act, Art. 6(1)(c) GDPR.
  • Similarity search across the catalog, diagnostics, security and improving the app: legitimate interest in an accurate catalog and a stable and secure app, Art. 6(1)(f) GDPR.
  • Usage statistics: legitimate interest in understanding which features are used so we can improve the app, Art. 6(1)(f) GDPR. The data is anonymous, and you can object at any time by turning it off in Settings › Privacy.

Catalog photos and automated analysis

When you add a hat that’s new to the catalog, its photos are analyzed automatically to suggest details like brand and colors, and to find visually similar hats. Every suggestion is reviewed by a person before a hat appears in the shared catalog. No decisions with legal or similarly significant effects are made automatically.

The analysis is done by Mistral AI and Jina AI (see Service providers). They receive only the photos, never your name, email address or any other account data, and neither of them uses the photos to train AI models.

Your submission photos only become catalog photos if “Share my photos with Hatrack” is turned on when you submit the hat. It’s on by default for public profiles and off for private ones, and you can turn it off for each hat.

A person reviews every photo before it’s accepted into the catalog, to make sure it contains no personal information, and location metadata is removed when it’s uploaded. Photos accepted into the catalog stay after you delete your account, no longer linked to you. If a catalog photo shows you or something that identifies you, email legal@hatrack.eu and we’ll remove it.

Who can see your data

Your username and avatar are visible to other users. They also appear in the preview of a link you share to your profile or to one of your collection entries, to everyone who receives that link, and the messaging app you share it with may fetch the link to build that preview. If your collection is set to public, other users can see your collection and follow you. If it’s set to private, only you can see it. Which hats you’ve tipped is visible to other signed-in users. Hats approved for the catalog, including their photos, are visible to all users. Collectors you block aren’t told, and reports are never shown to the person reported.

Service providers

We use the following providers, who process data on our behalf under data processing agreements:

  • Supabase Inc. (USA): database, file storage, authentication and server functions. Your data is stored on servers in Sweden.
  • Functional Software Inc., Sentry (USA): crash and error reporting. Reports are stored on servers in Germany.
  • Aptabase (EU region, Germany): anonymous usage statistics. Events are processed and stored within the European Union, using AWS EMEA SARL (hosting) and Tinybird Data S.L. (Spain, analytics database) as sub-processors.
  • 650 Industries Inc., Expo (USA): delivering push notifications and app updates.
  • Resend Inc. (USA): sending account emails such as sign-up confirmations and password resets. Emails are sent from servers in Ireland, and link tracking is turned off.
  • Mistral AI SAS (France): automated analysis of catalog submission photos.
  • Jina AI GmbH (Germany), part of Elastic N.V.: generating image embeddings of catalog photos for similarity search.
  • Cloudflare Inc. (USA): hosting of this website.

Apple Inc. provides Sign in with Apple and delivers push notifications to your iPhone. For Sign in with Apple, Apple acts as an independent controller under its own privacy policy.

Where data is transferred outside the European Economic Area, it is protected by the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

We do not sell your data, do not show ads, and do not track you across other companies’ apps or websites.

Retention

We keep your account data for as long as your account exists.

When you delete your account in the app (Settings › Delete account), we permanently delete your profile, avatar, collection and photos, your tips, comments, follows, blocks, wishlist, feedback and notification settings, and any hats you submitted that haven’t been approved for the catalog. Hats already approved for the catalog, and the catalog photos accepted with them, remain available to other users without any link to you.

Reports you filed are kept without any link to you for as long as we need them to handle the report and document our decision. Reports about your hats, your comments or your profile are deleted together with them.

Deleted data stays in our database backups for up to 7 days, until they are overwritten. Photos aren’t part of these backups and are gone immediately. Crash reports are deleted automatically after 90 days at the latest. Usage statistics are kept for up to five years. Copies of account emails are kept by our email provider for 10 days.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. You can download a copy of your data, including your photos, at any time in the app (Settings › Download my data), and delete your account in Settings › Delete account. For anything else, write to legal@hatrack.eu. You can object to our use of catalog photos at any time (Art. 21 GDPR) by emailing legal@hatrack.eu, and we’ll remove the photo. Where processing is based on your consent, you can withdraw it at any time, without affecting the processing that took place before. If you believe your data is being processed unlawfully, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority in your country.

This website

This website does not use cookies and does not collect personal data. When you visit it, our hosting provider Cloudflare processes technical data such as your IP address to deliver the page securely. Aggregated, cookie-free visitor statistics may be collected through Cloudflare Web Analytics.

Children

The app is for people aged 16 and over. We do not knowingly collect data from anyone younger, and if we learn that an account belongs to someone under 16, we delete it.

Changes

We may update this privacy policy when the app or the law changes. The current version is always available on this page.