Privacy Policy
Effective date: February 19, 2026
Last updated: October 20, 2026
This Privacy Policy explains how Thommen IT ("we", "us", "our") collects and uses information when you access platform.cmtyone.com ("Service") or use our mobile app ("App"). By using our Service, you consent to the collection and use of your information in accordance with this Privacy Policy.
Data Controller
Thommen IT
Bifangstrasse 21a
5430 Wettingen, Switzerland
UID: CHE-406.697.051
Email: [email protected]
Information We Collect
Usage Data
When you visit our Service, we automatically collect:
- Internet Protocol (IP) address
- Browser type and version
- Pages visited and time of access
- Referring web pages
- Device type and operating system
Voting Data
When you vote on items, polls, or gallery images, we store your IP address and a device fingerprint to prevent duplicate voting. This data is not linked to any personal account.
User Submissions
If you submit gallery images or feedback, we collect the content you provide along with your IP address and email (if provided). Submissions are voluntary.
Mobile App
When you use our mobile app, the following applies in addition to the above.
No ads and no tracking in the app. The iOS app shows no advertising and does not track you across apps or websites owned by other companies. It contains no advertising SDKs and no Google Tag Manager, and it does not use the device advertising identifier (IDFA). The advertising, ad partners and targeting cookies described in this policy apply to our websites only.
App Account
On first launch, the app creates an anonymous account for your install. We do not ask for your name, email address or phone number. The app syncs your coplist, favorites, outfits, watches, collection/inventory and push notification preferences to this account, so they survive a reinstall. You can optionally create recovery codes in the app; a recovery code restores the same account on a new phone. Keep your recovery codes private, because anyone who has one can restore the account.
Account Deletion
You can delete your account in the app at any time: Menu > Settings > Delete my account. This deletes the account and its server data, including try-on photos and renders, synced lists (coplist, favorites, outfits, collection/inventory), watches, votes and push tokens. Purchase and subscription records are kept by Apple and RevenueCat as required for billing, tax and legal purposes; deleting your account does not cancel an active subscription, which you manage in your Apple ID settings (iOS) or Google Play account settings (Android). As an alternative, you can request deletion by email to [email protected].
Photos (Virtual Try-On)
If you use the Virtual Try-On feature, the photo you choose is sent over an encrypted connection to our servers and processed by third-party AI providers that check that it is suitable and generate the try-on image. We do not store your photo: it is used only for that request and then discarded. The generated try-on image is stored so you can revisit past try-ons; you can delete it in the app at any time. We do not use your photos to train AI models, and we do not share them with anyone other than the processing providers listed below.
Purchases and Subscriptions
Optional subscriptions and credit top-ups are processed by Apple (App Store, iOS) or Google (Play Store, Android). RevenueCat processes purchases on our behalf. Your purchases are linked to the app's account ID (see App Account above), which contains no name or email address. We never receive your name, payment details, or Apple/Google account.
App Diagnostics and Analytics
- Sentry: crash reports with stack trace and device model/OS version.
- PostHog: anonymous product events (screens viewed, features used) to understand what to improve. Not linked to your identity.
- Push tokens: if you enable notifications, your device push token is stored to deliver drop and restock alerts.
- Device integrity: we use Apple App Attest / Google Play Integrity to verify requests come from a genuine app install (abuse prevention). This processes a device identifier but no personal profile.
App Data Retention
- Try-on photos and results: until you delete them in the app or delete your account
- App account and synced data: until you delete your account
- Analytics events: up to 12 months
- Crash reports: up to 90 days
To delete all app data, use Menu > Settings > Delete my account in the app, or email [email protected].
How We Use Your Information
- Providing the Service: To operate and maintain the website, including vote tallying, content display, and session management.
- Analytics: To understand usage patterns, identify trends, and improve the Service.
- Security: To detect and prevent abuse, spam, and bot activity (via Cloudflare Turnstile).
- Advertising (websites only): To serve relevant advertisements on our websites through our ad partners. The app shows no ads.
Legal Basis for Processing
We process your data under the following legal bases (Swiss nDSG and EU GDPR):
- Legitimate interest: Website operation, analytics, security, and fraud prevention.
- Consent: For non-essential cookies on our websites (performance, targeting). You can manage consent via the cookie banner.
- Contract: To provide the app account, sync and purchased features you request.
- Legal obligation: Where required by applicable law.
Third-Party Services
We use the following third-party services that may process your data:
| Service | Purpose | Data Processed |
|---|---|---|
| Cloudflare | CDN, DDoS protection, bot verification (Turnstile), image storage (R2) | IP address, request headers |
| Google Tag Manager | Tag management and analytics (websites only) | Usage data, IP address |
| Google AdSense | Advertising (websites only) | Cookies, device info, browsing data |
| Sentry | Error monitoring (web + app) | Error data, browser/device info, URL |
| AI image services (third-party providers) | Virtual try-on: photo checks and image generation (app) | Uploaded photo, garment image (not stored after processing) |
| RevenueCat | Subscription / purchase management (app) | App account ID (no name or email), receipt data |
| PostHog | Product analytics (app) | Anonymous usage events, device type |
Cookies
We use cookies and similar technologies to operate our websites. The app does not use advertising or targeting cookies. For full details on the cookies we use, please see our Cookie Policy.
Data Retention
We retain your data for as long as necessary to provide the Service:
- Session data: 7 days (Redis-backed sessions)
- Vote records: Retained indefinitely (anonymised IP + device hash)
- Usage logs: Up to 30 days
- User submissions: Until removed by request or moderation
Data Transfers
Your data may be transferred to and processed in countries outside Switzerland and the EEA. Our third-party providers (Cloudflare, Google) maintain appropriate safeguards including Standard Contractual Clauses (SCCs) and adequacy decisions.
Your Rights
Under Swiss nDSG and EU GDPR, you have the right to:
- Access: Request a copy of your personal data
- Correction: Request correction of inaccurate data
- Deletion: Request deletion of your personal data
- Data portability: Receive your data in a structured, machine-readable format
- Withdraw consent: Withdraw consent for non-essential data processing at any time
- Object: Object to processing based on legitimate interest
To exercise your rights, contact us at [email protected].
Supervisory Authority
If you believe your data protection rights have been violated, you have the right to lodge a complaint with:
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Bern, Switzerland
www.edoeb.admin.ch
Children's Privacy
Our Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us.
Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date.
Contact
Thommen IT
Bifangstrasse 21a
5430 Wettingen, Switzerland
Email: [email protected]
