Privacy

Signing in

When you press Continue with Google, Google sends us the email address on your Google account and tells us it is verified. If sign-up is not open to you yet, we keep that address, whether you asked us to write to you or not, together with what you chose on that screen, the page you arrived from, and an approximate location (country, state, city) worked out from your network address. We use it to know who is waiting to get in, to recognise you if you come back, and — only if you asked, or if the screen said we would unless you declined — to send you one email when sign-up opens. We never use it for other marketing without asking you first, we never sell it, and we never send it to anyone to learn more about you. We keep it until you ask us to remove it. To have it removed, press Continue with Google again and choose "forget my address", or write to support@zeto.app.

This browser

We set a cookie that groups this browser's visits so the page can remember what you looked at; we log what you looked at, before and after you sign in, on servers we run or that run on our behalf, and no third party's code or cookie runs on our pages. If your browser sends Global Privacy Control we record that. If you create an account, personalising what you see and any advertising targeting start switched off. When a page loads, our own script asks this browser a few questions about itself, so that our counts can tell people from programs: whether the browser reports that a program is driving it; whether the cookie we set can be read by the page; whether this browser's storage works, which we test by writing one throwaway item to it and removing it straight away; which of five width bands the window falls in, never its exact size; whether you prefer light or dark; how the page was reached — a fresh visit, a reload, or back or forward; and whether the browser had loaded it ahead of time before you opened it; none of these identifies you on its own, and we log them with what you looked at, with the automation answer also written on the record of that visit.

Location

Approximate location is derived from your network address using GeoLite2 data. This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com. We keep your network address itself only in a short-lived hashed abuse counter and, for an account you sign in to, as the address each session was opened from, for a limited time for security. From your network address we also work out, again using GeoLite2 data, which network the visit came from — the registered number of the internet provider or hosting company that address belongs to — and we keep that number, not the address itself, on the record of the visit, so that our counts can tell people from programs.

Inviting someone. When someone joins through your invitation link, we show you the name on their account.

Searching the web for you. When you add something to your closet by typing what it is and we cannot find it ourselves, we send the words you typed to a web-search partner to look for it on the web. We send only those words — not your name, your email address or a receipt — and the partner keeps those searches for a limited time, for its own billing and troubleshooting, under its own privacy policy. The partners we use are named on our partners page.

Searching the web with a photo. When you add something to your closet from a photo and we cannot find it ourselves, we send the part of the photo that shows the item — never the whole picture, and nothing that says who you are — to an image-search partner to look for it on the web. The partner uses the picture only to answer, does not keep it and does not learn from it, under its own terms; we do not keep it either. The partners we use are named on our partners page.

What we collect

• Your email address, only from a sign-in provider and only as described above.
• What you chose on the screen after a refused sign-in, and the page you arrived from.
• Roughly where you are — country, state and city — worked out from your network address.
• Which network you came from — the registered number of your internet provider or of a hosting company, worked out from your network address — so our counts can tell people from programs.
• A cookie that groups this browser’s visits, and what you looked at on our pages.
• A few answers from this browser about itself — whether a program is driving it, whether our cookie and its storage work, its rough width, light or dark, and how the page was reached — so our counts can tell people from programs.
• How quickly our pages loaded and responded for you.
• Who you told us you are shopping for, if you chose one — kept in this browser so the page opens on it next time, and never guessed from anything else.
• The city you picked, if you picked one — kept in this browser so we can show how far a store’s shop is from you.
• If you create an account: your sizes, the stores and brands you follow, the items you watch, if you set one, your home area and how far from it you shop, and any note you put on your invite link.

If you create an account, your feed is ordered by your sizes, the stores and brands you follow, and what you open, save, hide and watch in ZETO.

Who else sees it

The sign-in provider you chose (it tells us your address; we tell it nothing back). The companies that host our servers, our database and our image delivery, and the companies that receive our error reports and performance telemetry — all of which process data on our behalf and for no purpose of their own. If you join through someone’s invitation link, that person sees the name on your account. When we search the web for something you added, the partners named below receive what those sections above say they do. Nobody else: no advertising network, analytics vendor or data broker receives what we collect.

Our partners

• Brave Software, Inc. (Brave Search API) receives the words you typed, or — for a photo — the words our image-search partner guessed for it, never the photo. Its privacy terms.
• Google LLC (Cloud Vision API — Web Detection) receives the part of a photo that shows an item, when we search the web for it. Its privacy terms.

Do Not Track and Global Privacy Control

Nothing we do depends on tracking you across other sites, so neither signal changes what a signed-out visitor sees. If your browser sends Global Privacy Control we record that beside the visit, and an account created under it starts with personalisation and any advertising targeting switched off.

Reviewing or removing it

To have a refused sign-in’s address removed, press Continue with Google again and choose “forget my address”. To review or remove anything else, or if you no longer have the account you signed in with, write to support@zeto.app.

Changes

Effective 2026-10-07. We post changes here with the date, and we do not apply a changed policy to data collected before it without asking you.