Last updated 19 October 2026
In short
This notice covers the Nomma app: your account and everything you add to it. Joining the waitlist on nomma.io is covered by the waitlist privacy notice.
Nomma (Mikke Leskinen, business ID 3376510-6) decides how your data is used, which makes us the controller under the GDPR. For anything in this notice, write to privacy@nomma.io.
Your account: your email address, your password if you choose one (stored only as a secure hash, so nobody can read it) and when you were invited, signed up and last signed in. To keep accounts safe, the sign-in service also records the IP address and browser of each signed-in session.
When we email you a sign-in code, we note when, with your address scrambled so it can't be read back from the note, so that nobody can use the sign-in page to flood your inbox. The note is deleted after two days. Our legal basis is our legitimate interest in keeping Nomma safe (Article 6(1)(f) GDPR).
What you add:
If you turn on the home screen widget in the iPhone app, a key just for it. The phone keeps the key. We keep only a secure hash of it, the kind of phone (such as “iPhone”) and when it was turned on. You → Home screen widget lists every phone it's on, and turning it off deletes the key.
If you log what you wear, Zake may suggest a piece you haven't worn for a while, once a day. We keep which piece and outfit he suggested each day, and whether you tapped “Not today”, so the app and the widget suggest the same one.
Photos are resized on your device before they're uploaded, which also strips where and when they were taken, and the camera details a photo file can carry. Nomma never keeps them, even when your phone's photo picker says the location is included.
Cookies: signing in sets cookies that keep you signed in, and a cookie (nomma-locale) remembers your language. There are no tracking or advertising cookies.
To run Nomma for you: to keep your closet, show it to you on any device you sign in on, and show what you share to the people you share it with. We use your email address to sign you in and to write to you about your account, never for marketing.
Our legal basis is our agreement with you when you use the app (Article 6(1)(b) GDPR).
To see whether Nomma helps: from what's already stored, we add up totals for everyone who joined in the same week, such as how many pieces people added in their first week and whether they came back. Nothing extra is recorded for this, only we see the totals, and they never name anyone. Our legal basis here is our legitimate interest in knowing whether Nomma works (Article 6(1)(f) GDPR), and you can ask us to leave you out.
Now and then we may write to ask how Nomma is working for you. Replying is up to you, and if you'd rather not get these emails, tell us and we'll stop. Our legal basis is our legitimate interest in making Nomma better (Article 6(1)(f) GDPR).
Everything you add is stored with Supabase, in their EU region in Ireland. The app runs on Vercel, on servers in Dublin. Both process data only for us, under data processing agreements. If either processes data outside the EU/EEA, for example for support, it's covered by the European Commission's standard contractual clauses.
Emails about your account, such as your sign-in codes, your invite and links for setting a new password, are sent through Brevo, an email service in France, also under a data processing agreement. Brevo counts whether its emails are opened and their links clicked, so the link in each email passes through Brevo's servers on its way to nomma.io. We've set this counting to anonymous, so it isn't tied to your address, and we don't use it.
Emails you send us, and your replies to ours, arrive in our mailbox at Google Workspace. Google processes them for us under a data processing agreement and the European Commission's standard contractual clauses.
Like any website, the hosting briefly handles technical data such as your IP address to deliver pages and keep them secure.
You → Download a copy puts everything you've added into one ZIP file: your data in nomma.json, and every photo at full size. The file is put together on your device, and nothing is uploaded to make it.
You → Delete account removes all your photos from storage, then your account, which takes every row of your data with it. Share links stop working at once, and if your email address is on the waitlist, it goes too. Then you're signed out.
Deleted data drops out of the database's backups within 7 days. Photos aren't kept in backups, and copies cached for fast delivery stop being served within minutes.
Removing a single piece removes its photos too.
For as long as you have an account. If Nomma ever closes, we'll tell you in good time, so you can download your closet, and then delete everything.
If you join with a code, your account is made as soon as you ask for the code. If the code is never typed, the account is deleted after 7 days.
You can see, correct, download or delete your data yourself, right in the app. You can also ask us to:
Email privacy@nomma.io from the address you sign in with and we'll reply within a month. You can also complain to your local data protection authority.
If this notice changes, the date at the top changes with it. If a change affects what we do with your closet, we'll tell you in the app before it applies.