Privacy Notice

Accounts and membership

Email signup asks for your email address, password and password confirmation. Your account also records your display name, membership status and plan, and your acceptance of the membership terms and privacy notice. The profile service can store a date of birth and email or SMS marketing preferences if you provide them.

Passwords are stored as salted scrypt hashes, rather than as readable passwords. We use account information to sign you in, maintain your membership and associate your saved information with your account.

If you choose an available social sign-in option, we receive the provider account identifier and available profile details, such as a name and profile picture. Google sign-in can also supply a verified email address. We use these details to sign you in or connect the account you choose.

Security and bot checks

When enabled, Cloudflare Turnstile checks email signup and password recovery requests for automated abuse. The browser loads the Cloudflare check and our server verifies its response with Cloudflare. Verification can include your IP address when available from the hosting service.

Signup, sign-in and recovery use attempt limits to help prevent abuse. Security records include attempt counters and hashed identifiers used for these limits.

Cookies and sessions

A session cookie keeps you signed in and identifies your membership, role and plan so the app can check access to your account. It is marked HttpOnly, which prevents browser scripts from reading it, and expires after 14 days. Signing out clears the session cookie.

Social sign-in also uses temporary cookies to check that the sign-in response belongs to the request you started. Browser storage supports app preferences and recovery of unfinished captures or drafts.

Storage and hosting

Account and member records are stored in PostgreSQL, with Neon Postgres used by our database hosting setup. Vercel hosts the website and processes web requests. Vercel can apply firewall and bot protection checks to those requests.

Account email

When account email is enabled, we use a configured SMTP email service to send verification links, password reset links and notices about attempts to sign up with an existing email address. Your email address and the message are passed to that service for delivery.

eBay account connection

The eBay connection is in sandbox/testing. If an authorized store operator connects a test seller account, the connection stores the seller identifier, environment, connection status, token expiry times, and access and refresh tokens. Tokens stay server-side and are never shown in the account interface.

The test integration supports reading seller inventory and offers, listing status, and order references and sale details used to match sold items. Listing imports retain item details such as title, description, SKU, condition, category and price. Sandbox functionality is testing, not live eBay selling.

Wants and finds

Wants can include categories, brands, specific items, written requests or notes, and optional price or quantity preferences. You can view and edit your own wants. Store owners and accounts granted demand access can see combined item counts to help with stocking.

Distributors our store works with see only combined counts of how many members want a category, brand or item, never individual wants.

Finds and Personal Inventory can contain item photos, barcodes, descriptions, notes, purchase details and pricing references you save. The member inventory view is limited to your account. Business inventory is a separate store workspace for authorized staff. Listing Studio uses the items you select to prepare listing or resale drafts.

Wants sharing: To help us stock what you're looking for, we share combined wants information with the distributors our store works with. This shows only how many members want a category, brand or item (for example, '12 members want Legos'). We never share your name, contact details, the words you typed, or what you're willing to pay.

Load results sharing: When you record how a load or pallet turned out, such as what was in it and what it resold for, we include that result in combined, anonymous figures that help members and our store judge loads. Your name, contact details and the words you typed are never shared. A combined figure is shown only when at least 5 members contributed and no single member makes up most of it, and locations are shown only at a broad regional level. This sharing is on by default, and you can opt out at any time by contacting us using the details below.

Membership plans

Membership plan confirmation records your selected plan and its status. The current membership checkout does not take card details or charge a live payment processor.

Retention and deletion requests

The app keeps account records and saved information to support your membership and saved work.

Item Lens text: When Item Lens reads your photos, it records what it saw, such as visible details and labels, and anything it was unsure about. We keep this text for 90 days from when it was read. After that, it is removed from the item record. The item itself stays in your inventory, along with its title and the details you typed or confirmed.

Item Lens photos: Photos you save with Item Lens are kept for 1 year from when they were saved, then deleted. The item stays in your inventory without the photo.

Backups: Our database is backed up regularly. Deleted text and photos can remain in those backups for a limited time until the backups expire or are removed.

Contact us using the details below to request deletion of your information.

Voicemail recordings, transcripts and call logs are kept for one year, then deleted.

Staff may upload their own contacts to show caller names. Private contacts are visible only to that staff member. Google import is read-only and can be disconnected. Contacts remain until deleted; private contacts are deleted when the staff phone record is removed.

Changes to this notice

Updates to this notice will appear on this page with an updated effective date.

Contact us

For questions about this notice or to request deletion of your information, contact What A Bargain.

Email: support@what-a-bargain.com

Phone: (518) 579-7283