Your data, in plain English.

1. About this policy

This policy explains what personal information Shoepal collects about you, why we collect it, how we use it, who we share it with, and the rights you have over it. It applies to everyone who uses shoepal.uk, the Shoepal web app, and any related Shoepal services (together, "Shoepal" or the "Service").

We have written it in plain English because we want you to actually read it. Where we have had to use a legal term, we have explained what it means. If anything is unclear, email us at hello [at] shoepal.uk and we will do our best to explain.

2. Who we are

Shoepal is operated by Jamie Tomlinson, trading as Shoepal, a sole trader based in the United Kingdom. For data protection purposes, that sole trader is the data controller — the person who decides how and why your personal information is used.

• Email: hello [at] shoepal.uk
• Post: Jamie Tomlinson, trading as Shoepal, The Bristol Office, 2nd Floor, 5 High Street, Westbury-on-Trym, Bristol, BS9 3BY
• ICO registration number: ZC253131

We are registered with the UK's Information Commissioner's Office (ICO). If you have a complaint, please contact us first so we can try to put things right — but you can complain directly to the ICO at any time (see section 17).

3. Quick summary

If you only read one section, read this one. The detail is below.

• We collect the shoe sizes, style preferences and any shoes you pick, so we can match you with someone whose sizes mirror yours. Your pals can see these.
• We collect the email address, name, and login details you give us so we can run your account.
• If you turn on local matches, we collect your postcode and travel distance to show you nearby pals. You can turn this off any time.
• We screen every chat message through an automated content filter to keep the platform safe (see section 15).
• We use Google Analytics 4, and may use Meta (Facebook) and Google advertising tools, but only if you give consent through our cookie dialog. Google Tag Manager loads on every page before you choose: it sets no cookies and sends no analytics or advertising data, but Google's servers see your IP address and the page address (see section 9).
• If you opt in to marketing emails, you can unsubscribe at any time.
• We never sell your personal information.
• Your data is hosted in the United Kingdom (London). A few carefully chosen suppliers process specific data outside the UK — listed in section 7, safeguards in section 10.

4. What information we collect

Most of this only exists because you have actively given it to us.

4.1 Account information. Your email address; a password (encrypted — we never see it in plain text) or, if you use Sign in with Google, the identifier and name Google gives us; and your first name, which other pals will see. Those are the only two ways to sign in. We also record that you confirmed you're 18 or over, and when.

4.2 Profile information. Shoe type (Women's, Men's, Girls', Boys'), your left and right shoe sizes, the style categories you're interested in, and the shoes you pick or add to your wishlist, including any links you paste. We deliberately do not ask why your sizes differ.

The choices you make on the way to signing up (sizes, shoe type, styles and any shoe picks) are held in a cookie in your browser, shoepal_onboarding, which goes when you close the browser. We don't write them to our database until you have an account. When you sign up with an email address they move onto your sign-up record (user_metadata), so the verification link works on any device. When your first profile is built, your shoe picks become your wishlist and are removed from that record. We're starting with style categories only, so at first you may not be asked to pick shoes during sign-up.

4.3 Child profiles (parent-managed). Only the shoe type, shoe sizes, style categories and shoes picked for that profile, plus the pals it matches with and the chats you have for it. No name, date of birth, photograph, or other identifying information about the child. Child profiles are labelled "Profile 2", "Profile 3" and so on, sit under your account, and are not separately accessible by the child (see section 13).

4.4 Optional location information. If you opt in to local matches, your postcode and the map coordinates for it (to calculate distance) and the maximum distance you'll travel. To get the coordinates we send your postcode to postcodes.io, a public postcode lookup service (see section 7.5). We do not track real-time location, and never share your postcode with pals — only a rough distance. You can turn local matches off and remove your postcode in Settings any time.

4.5 Chat content. The content of messages you send and receive, shoe cards shared in a chat, links, timestamps and read receipts, and whether you've told us you swapped. You can't send photos or files. Every message is screened by automated moderation before delivery (see section 15). When you paste a link in a chat or on your wishlist, our server fetches that page to get its title and picture, without passing on your details.

4.6 Safety information. If you block or report a user, we record the fact and time, the report category and any explanation, and enough context to review it fairly. If your account is put on hold, we record that and any message we wrote to you. We use this to keep the platform safe and meet our Online Safety Act 2023 obligations. Child-safety records are covered in section 15. When someone reports a pal, we read the chat between them to review it, and we keep a record that we did. If we remove a message, we keep its text privately for 90 days in case it's needed as evidence, then delete it.

4.7 Subscription and payment information. Payment is processed by Stripe — we do not see or store your full card number, expiry, or security code. We store your subscription status, plan, start/end dates, and a Stripe customer ID to manage renewals and cancellations.

4.8 Technical information. Our hosting providers automatically collect your IP address (to deliver the service and detect abuse), device and browser information, and log data. Google sees your IP address and the page address when the Tag Manager container loads (see section 9). Shoe pictures load directly from retailers' websites, so a retailer can see your IP address when your browser shows one of its pictures.

4.9 Analytics and advertising information. If you consent to analytics cookies (see section 9), Google Analytics 4 collects pseudonymous usage data. If you consent to marketing cookies, and where we're running that advertising, the Meta Pixel shares activity with Meta to measure and target ads on Facebook and Instagram, and Google Ads conversion and remarketing tags share activity with Google to measure campaigns and show ads on Google Search, YouTube, and the Display Network. If you choose Essential only, none of these run.

4.10 Marketing information. If you opt in to marketing emails, we store the fact and date of your consent. We send marketing emails through our email provider (Resend), which may record opens and clicks so we can improve our content.

4.11 Support requests. If you email us, we receive your email address, your message, and anything you attach.

4.12 Push notifications. If you turn on push on a device, we store the delivery address and keys your browser gives us for that device, the browser's details, and when it was last used, along with your notification settings. Your browser's own push service carries the notifications (see section 7.5).

4.13 Affiliate links. Some retailer links may carry a code that lets the retailer pay us a commission if a purchase follows, and we say so next to those links. The code identifies Shoepal, not you. If you follow one, the retailer and any affiliate network it uses can record the visit under their own privacy policies.

4.14 Safety recalls. If a shoe you saved or shared is recalled, we may email you about it.

5. Why we collect it, and our lawful bases

Under UK data protection law we need a lawful basis for each thing we do with your data:

• Create and run your account (4.1) — Contract.
• Match you with a pal (4.2, and 4.4 if opted in) — Contract.
• Manage child profiles you set up (4.3) — Contract with you, the parent.
• Deliver chat and provide safety controls (4.5, 4.6) — Contract, and Legal obligation (Online Safety Act 2023) for safety processing.
• Take subscription payments (4.7) — Contract.
• Run the Service reliably and prevent abuse (4.8), including loading Tag Manager so your cookie choice can be applied — Legitimate interests.
• Send the notifications you've left on, by push or email (4.12) — Contract.
• Earn commission on retailer links (4.13) — Legitimate interests.
• Tell you about a safety recall (4.14) — Legitimate interests.
• Keep child-safety records (section 15) — Legal obligation.
• Understand how the Service is used (4.9 analytics) — Consent.
• Show and measure Shoepal ads on Meta and Google (4.9 advertising) — Consent.
• Send marketing emails (4.10) — Consent, with the PECR soft opt-in for existing customers where applicable.
• Respond to support (4.11) — Legitimate interests.
• Comply with legal obligations — Legal obligation.

Where we rely on legitimate interests, we have weighed our interest against your rights; you can object any time (see section 12). Where we rely on consent, you can withdraw it any time without affecting what we did beforehand.

6. Health information

We don't treat your shoe sizes as health information. We use them to find pals with your mirror sizes, and for nothing else.

• We never ask why your sizes differ, and we don't record a reason.
• We make no assumptions about anyone's health from their sizes, and we don't treat anyone differently because of them.
• What you tell a pal in chat is up to you, and it's handled as chat content under 4.5. Automated moderation checks messages for safety (see section 15). We don't look through chats for health information.

The same applies to the sizes on a child profile.

7. Who we share your information with

Only for the reasons given.

7.1 Other Shoepal users. Your first name, shoe type, sizes, style categories and wishlist are visible to pals you've matched with. A pal sees a shoe on your wishlist only if it's from a retailer we recognise and its title has passed moderation; a pasted link that hasn't stays private to you. On a child profile or any other additional profile, pals see your first name and that profile's shoes. If you opted in to local matches, a rough distance is visible (never your postcode). Chat content, including shoe cards, is visible to the pal you're chatting with. Your account email is never visible to other users.

7.2 Our service providers (processors). These handle information for us under their own published terms:

• Supabase — database, authentication, real-time messaging. United Kingdom (London, eu-west-2).
• Vercel — web and app hosting, content delivery. Global edge network (primary region UK / EU).
• OpenAI — automated moderation of chat messages and of titles fetched for pasted links (see section 15). United States.
• Stripe — subscription billing and card processing. UK / United States.
• Google — Sign in with Google; Tag Manager, on every page (see section 9); Google Analytics 4 and Google Ads (with your consent). EU / United States.
• Meta — Meta Pixel (with your consent). EU / United States.
• Resend — account, notification and marketing emails. United States.
• NetHosted — hosting for the @shoepal.uk mailbox we use to reply to you. United Kingdom.

We may add or change providers; we'll update this list and, for significant changes, let you know.

7.3 Meta and Google as joint controllers for advertising. When you load a page containing the Meta Pixel and you've consented to marketing cookies, some of your information is collected and used by both Shoepal and Meta — for that collection, we are joint controllers under Article 26 UK GDPR. Meta's policy: facebook.com/privacy/policy. A similar position applies to the Google Ads tags; Google's policy: policies.google.com/privacy. Summaries of the joint-controller arrangements are available on request to hello [at] shoepal.uk.

7.4 Authorities, advisers, and successors. We may share information where legally required (e.g. a valid court order, or under the Online Safety Act 2023), or with our advisers under duties of confidence. If Shoepal is ever sold or merged, your information may transfer to the buyer — we'll tell you in advance and your rights will be honoured. We do not sell your personal information or share it with data brokers.

7.5 Other services. A few things also pass through services that work independently of us:

• postcodes.io — receives the postcode you enter for local matches, to return its coordinates. Contains OS data © Crown copyright and database right.
• Your browser's push service (run by Google, Apple or Mozilla, depending on your browser) — carries any push notifications you've turned on.
• Retailers — see your IP address when your browser loads a shoe picture from them, and whatever you do on their site if you follow a link.

8. Marketing

With your consent, or under the PECR soft opt-in for existing customers (for similar Shoepal services), we'll send you marketing emails — new features, tips, and offers. With your consent we may also use Meta and Google advertising tools to show you Shoepal ads, including building Custom Audiences / Customer Match from your email or your activity on shoepal.uk.

You can opt out any time: click "unsubscribe" in any marketing email, turn off product news in Settings → Notifications, or email hello [at] shoepal.uk; turn marketing cookies off under "Cookie settings"; and adjust ad personalisation in your Meta or Google account settings. Opting out of marketing does not stop service emails (verification, password resets, subscription reminders, and the match and message notifications you've left on).

9. Cookies and similar technologies

The first time you visit, a cookie dialog gives you three options: Essential only, Accept, or Configure to choose analytics and marketing separately.

• Essential — keep you logged in, remember your cookie choice and your place, protect against abuse. Used without consent (you can't turn these off).
• Analytics — Google Analytics 4. Only with your consent.
• Marketing — Meta Pixel and Google Ads tags. Only with your consent.

The Google Tag Manager container loads from Google on every page, before you've made any choice, because it's what applies your choice. Until you say yes it sends no analytics or advertising data and sets no cookies, but Google's servers see your IP address and the page address, as with any file your browser downloads.

We keep your choice for about six months, then ask again. You can change it any time using "Cookie settings" at the foot of our public pages. Our Cookie policy lists everything we store in your browser.

10. International data transfers

Your information is held primarily in the United Kingdom (our main database is in Supabase's London region). Where a provider in section 7 processes data outside the UK — usually the EEA or the United States — we rely on one of: a UK adequacy decision; the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the standalone UK IDTA); or certification under the UK Extension to the EU–US Data Privacy Framework. Ask us for a copy of the safeguard for any transfer at hello [at] shoepal.uk.

11. How long we keep your information

• Sign-up choices before you have an account — in a browser cookie that goes when you close the browser.
• Account and profile information — while your account is active; removed when you delete your account. Copies in our hosting provider's routine backups clear as those backups expire.
• Additional and child profiles — until you delete the profile or your account. Deleting a profile removes it, its styles and its wishlist.
• Chat messages, including shoe cards — for the lifetime of the chat. If you delete your account, your own messages are removed straight away. The chat is closed and hidden from both people, and the other person's messages are kept, because they're that person's own data, until they delete their account. If you delete a profile, its chats are hidden from both people, and the messages on both sides are kept until the account that sent them is deleted.
• Child-safety records — up to 6 years, even if the account or chat is deleted (see section 15).
• Moderation audit log (decision, category, latency — not blocked message bodies) — 2 years, for Online Safety Act record-keeping, even if the account is deleted.
• Record of admin actions, such as putting an account on hold — kept for 6 years, even if the account is later deleted.
• Block records — while both accounts exist; removed when either account is deleted, or when the block is undone.
• Report records — kept for 2 years after either account is deleted, then removed.
• Removed messages — 90 days, kept privately in case they're needed as evidence.
• Recall records (which accounts had a recalled shoe, and whether we emailed them) — 1 year.
• Subscription and billing records — our subscription record is removed when you delete your account. Payment and tax records, including those held by Stripe, are kept for 7 years after the subscription ends, for HMRC and tax obligations.
• Server access logs — up to 90 days.
• Analytics data — 14 months.
• Push subscriptions — until you turn push off on that device or delete your account.
• Marketing data — until you withdraw consent, then deleted within 30 days.
• Support correspondence, including our log of complaints, appeals and data requests — 2 years after the matter is resolved.

We may keep information longer where the law requires it or where necessary for legal claims.

12. Your rights

Under UK GDPR you have the rights to: access; rectification; erasure; restriction; portability; objection (including to marketing, which we always stop); to withdraw consent; and not to be subject to a solely automated decision with legal or similarly significant effect (see section 15).

"Download my data" — automated Subject Access Request. Go to Settings → Download my data while you're signed in, and you'll get a file straight away covering your account, profiles, styles, wishlists, messages you sent, blocks, reports you filed, subscription, notification settings, push devices, shoe cards and links you sent, swaps you confirmed, matches you've viewed and chats you've muted. It leaves out other people's content and child-safety records, which are withheld under a legal exemption. For anything it doesn't cover, email us. Both routes use the same legal right of access.

Erasure. You can delete your account yourself in Settings → Delete account, or by emailing us. Section 11 says what goes and what stays. Deleting your account cancels any paid subscription straight away and does not issue a refund (see section 5 of our Terms). If your account is on hold, email us for a copy of your data or to delete it.

To exercise any other right, email privacy [at] shoepal.uk. We respond within one month, normally free of charge, and may need to verify your identity first. If you're unhappy with how we handle a request, you can complain to the ICO (see section 17).

13. Children

Shoepal is for adults. You must be 18 or over to create an account.

If you set up a profile for a child as a parent or guardian, we keep what we collect to an absolute minimum: shoe type, sizes, style categories and shoes picked; no name, date of birth, photograph, or contact details; labelled "Profile 2", "Profile 3" and so on; managed by you, with no separate login for the child. A child profile has its own pals, shoes and chats, all run by you, and its pals see your first name. We use a child profile only to find and rank pals with mirror sizes, and we do not advertise to child profiles — the consent-based bases in section 5 apply to your account as the parent, not the child profile.

We have designed Shoepal in line with the ICO's Age-Appropriate Design Code (Children's Code), including highest privacy by default and data minimisation. If you believe someone under 18 has created an account in their own right, tell us at privacy [at] shoepal.uk and we'll close it and delete the data.

14. Security

• Data in transit is encrypted using TLS 1.2 or higher.
• Data at rest in our database is encrypted by our hosting provider.
• Passwords are stored using industry-standard one-way hashing — we cannot read them.
• Access to production data and admin tools is restricted, and admin actions are logged.
• We follow the principle of least privilege for internal access.
• We have a breach response process and will notify the ICO within 72 hours of a notifiable breach, and affected users without undue delay where required.

No internet service can be guaranteed 100% secure. If you believe your account has been compromised, email hello [at] shoepal.uk straight away.

15. Automated content moderation in chat

As a user-to-user service we must put proportionate safety measures in place (Online Safety Act 2023). One is automated moderation. When you send a message, its text is sent to OpenAI's Moderation API (in the United States) before delivery; OpenAI returns a decision — allow, warn, block, or review — and matching categories. If that check fails or takes too long, the message is refused and you can try again. We also check the titles fetched for links pasted on a wishlist, and for links in chat to retailers we recognise. OpenAI's standard terms say that data sent through its API isn't used to train its models unless the customer chooses to allow it, and we haven't.

• Allow — delivered normally.
• Warn — delivered, but blurred until the recipient taps to reveal, with a plain-English category label.
• Block or review — not delivered. You'll usually see a brief friendly notice with a link to our Community Guidelines. The text of a blocked message is not stored, with the one exception below.

Child-safety records. If a message is blocked because it appears to be sexual content involving a child, we keep its text, the accounts and chat involved, and the sender's email address in a separate, restricted record for up to 6 years, even if the account or chat is later deleted. A person reviews it, and we report every confirmed case to the National Crime Agency. These records aren't included in Download my data.

For every decision we keep an audit log (sender account ID, chat ID, provider, model, decision, category, and call duration — not blocked message bodies) for 2 years, even if the account is deleted. Because meaningful consequences (warnings, restrictions, bans) involve human review, we do not consider this a "solely automated decision" with legal or similarly significant effect under Article 22. If you disagree, contact us and we'll look into it.

16. Changes to this policy

We'll update this policy from time to time. For material changes we'll post the updated policy with a new review date and a brief summary, and for significant changes we'll email you in advance. The current version is always the one at shoepal.uk/privacy.

17. How to contact us and how to complain

Email hello [at] shoepal.uk, or write to us at the postal address in section 2.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint (opens in a new tab); helpline 0303 123 1113; or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We'd appreciate the chance to put things right first, but you're always free to go straight to the ICO.

Last reviewed November 2026.