Privacy Policy

1. Information We Collect

Information you provide directly:

• Account data: email address and password when you register.
• Profile data: display name, bio, location, specialties, social links, and profile photo that you choose to add.
• Inventory data: item names, descriptions, purchase prices, sale prices, and photos you upload.
• Route data: stop names, addresses, notes, and routes you create.
• Contact & feedback submissions: name, email, and message content when you use our contact or feedback forms.

Information collected automatically:

• Usage data: pages visited, features used, and actions taken within the Service (e.g. Supabase and Vercel analytics).
• Log data: IP address, browser type, referring URL, and timestamps recorded by our hosting infrastructure.
• Cookies & local storage: session tokens and preference data stored in your browser to keep you logged in and remember your settings.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Authenticate your identity and keep your account secure.
• Display your public profile to other users (only the fields you choose to make public).
• Respond to your contact and feedback submissions.
• Understand how the Service is used so we can improve it.
• Send you important service notices (e.g. security alerts, policy updates), not marketing email without your consent.
• Comply with applicable law and enforce our Terms of Service.

3. How We Share Your Information

We do not sell your personal information. We share data only in the following limited circumstances:

• Service providers: third-party vendors that help us operate the Service (e.g. Supabase for database and auth, Vercel for hosting, Cloudflare for security). These providers process data only on our behalf and under our instructions.
• Public profile: information you voluntarily add to your public picker profile (display name, bio, specialties, public social links) is visible to anyone who visits your profile URL.
• Legal obligations: if required to do so by law, subpoena, or valid legal process.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

4. Data Retention

We retain your account data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal or fraud-prevention purposes.

Contact and feedback form submissions may be retained for up to 2 years to track support history and improve the Service.

5. Cookies

We use essential cookies and local storage to manage your login session and preferences. We do not currently use advertising or tracking cookies from third parties. You can clear cookies at any time through your browser settings; doing so will log you out of the Service.

6. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), hashed passwords, and row-level security on our database. No method of transmission over the internet is 100% secure, so we cannot guarantee absolute security. Please use a strong, unique password and notify us immediately if you suspect unauthorised access to your account.

7. Your Rights & Choices

You have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: update inaccurate or incomplete data via your account settings or by contacting us.
• Deletion: delete your account and associated data at any time from your account settings or by contacting us.
• Portability: request an export of your inventory and profile data in a machine-readable format.
• Objection / Restriction: object to or request restriction of processing in circumstances permitted by applicable law.

To exercise any of these rights, contact us and we will respond within 30 days.

8. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If the changes are material, we will make reasonable efforts to notify you by email or a notice within the app. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

11. Contact

If you have questions or concerns about this Privacy Policy, or to exercise your data rights, please contact us.