Data Privacy

Overview

Hookito is built local-first: most of what you do — bookmarks, favorites, settings — is stored in your own browser. An account is optional and exists for one reason: so the things you save can follow you to another device. We collect the minimum needed to run the service, we run no advertising and no analytics trackers, and we never sell or share your data with third parties.

Data Collection

Without an account, everything stays on your device. We store nothing about you on our servers.

With an account, we store your email address, username, an optional display name and avatar choice, a securely hashed password, and the items you choose to save (bookmarks, likes, languages, countries, interests, an optional home country). Your sessions are stored without your IP address and without any location data.

Abuse protection (IP addresses): to defend sign-in and registration against password guessing and automated abuse, our servers count requests per IP address. These counters are anonymous rate-limiting buckets that expire automatically after 60 seconds — the IP is never written to our database, never linked to your profile, and never shared. This is strictly technical processing in our legitimate interest of keeping accounts safe (Art. 6(1)(f) GDPR).

Location hint at registration: the optional “Where are you from?” field is only pre-filled when you press “Use my location”, and only saved when you confirm it. Nothing is detected or stored in the background.

Newsletter & personalized emails: at registration you may optionally tick a box to subscribe to the Hookito newsletter. It is off by default and never pre-selected. We use double opt-in: ticking the box only records a request, and we email you a confirmation link — you are subscribed only after you click it. Until you confirm, and if you never tick the box, we store no marketing consent and send you no marketing email. You can unsubscribe at any time.

Cookies & Local Storage

We set exactly one cookie: the session cookie that keeps you signed in. There are no tracking, advertising, or analytics cookies.

Your browser’s local storage holds device settings and — for guests — your saved items. That data lives on your device and is only transmitted if you sign in and choose to keep it in your account.

Third-Party Content

Some features load content from third parties when you actively use them: playing a video loads YouTube’s player (Google’s privacy policy applies), playing a radio station connects your browser to that station’s stream server, and map views load map imagery from tile providers. These connections only happen when you use the feature in question.

YouTube videos need your consent. No YouTube player is loaded until you accept the notice shown in place of the video. We embed in YouTube’s privacy-enhanced mode (youtube-nocookie.com), which delays cookies until you actually play something. Your choice is stored on this device only and you can change it here at any time — revoking puts the notice back in front of every video.

Your Rights

Under the GDPR you can request access to, correction of, or deletion of your personal data at any time. You can delete your account yourself under Settings → Account → Delete account: this permanently erases your account and every item synced to it, on our servers and on this device. For access or correction requests, reach us via the contact page and we will handle it promptly.