Privacy Policy

Who operates the service

MarketplaceAlert is a commercial service operated by Yuri Filanovsky, an individual based in Israel. It is not operated by an incorporated company. You can contact the operator by email (see “Contact” below). No postal address is published.

Who the service is for

MarketplaceAlert is intended for adults aged 18 and older. If you are under 18, please do not use the service.

Technical note: the app does not currently verify your age or ask you to confirm it, and does not currently require you to accept these documents when you register.

Data we process

To provide the service, MarketplaceAlert processes the following categories of data:

• Account data: your email address and a password. Passwords are stored only as a salted hash, not in readable form.
• Authentication data: short-lived access tokens and longer-lived refresh tokens (refresh tokens are stored on our servers only as hashes so they can be revoked), password-reset codes (stored as hashes) and their attempt counters.
• Saved searches: the keywords you enter, the marketplaces you select, how often the search runs, whether it is active, and when it last ran.
• Discovered listings: public listing information returned by the marketplaces (such as title, price, link, image, seller name, condition and location), and which of your searches matched it.
• Notification settings and records: your notification preferences, a Telegram chat ID if you provide one, and records of notifications queued or sent to you, including delivery status and error information.
• Device data: if you enable push notifications in the Android app, an Expo push token for your device, the device platform and the time it was last seen.
• Security data: counters and timestamps used to limit repeated failed sign-ins and password-reset attempts.
• Technical connection data: like most online services, our hosting and network providers (such as Render and Cloudflare) may process technical connection data, including IP addresses and request logs, when you use the app or this website. We have not verified exactly what is logged or for how long, and we do not state retention periods here.
• Planned, not collected yet: if the free trial and paid plans described on our home page are introduced, we expect to record your trial start date and chosen plan. If paid plans are introduced, a payment provider would be needed to handle payment details; none has been selected or activated.

How we use it

• To create and secure your account and sign you in.
• To run your saved searches against the marketplaces you selected.
• To detect new listings and avoid repeating ones you have already been told about.
• To deliver notifications about new listings to your device and, if configured, to Telegram.
• To send a verification code by email if you use “forgot password”.
• To protect the service against abuse and keep it running.

Service providers and third parties

The service relies on third parties. We describe below what each receives. Where we have not verified a provider’s location or retention practices, we say so rather than guess.

• Render (hosting): the backend, the PostgreSQL database and the scheduled scanning service run on Render in Oregon (US West), USA. All account and service data described above is stored there.
• Cloudflare (website hosting): this website is served through Cloudflare Pages. Cloudflare may process technical request data such as IP addresses.
• Expo push notification service: receives your device push token and the notification content (a fixed title, the listing title, the listing link, the marketplace name, a listing identifier and a sound setting) in order to deliver push notifications. Android push delivery may also involve Google’s notification infrastructure; we have not verified the details.
• Telegram: only if you configure a Telegram chat ID, notification content (listing title, marketplace, price, location and link) is sent through Telegram’s Bot API.
• Resend (email): receives your email address and a verification code when you request a password reset.
• The marketplaces (eBay, Etsy, Reverb, Bonanza, Tradera): your search keywords are sent to their public APIs to find listings. They do not receive your account details from us.

International processing

The operator is based in Israel and the backend and database are hosted in the United States (Oregon). If you use the service from another country, your data is transferred to and processed in those countries, and by the providers listed above in locations we have not verified.

Website, cookies and analytics

Today, this public website is a marketing and information site with no registration, sign-in, payment or download. This website is a static information site. It does not require an account and its code sets no cookies and includes no analytics or advertising trackers. The Android app stores its sign-in token in the device’s secure storage. To our knowledge, the app’s own code does not include analytics or advertising tools, but we have not audited every third-party component and library the app depends on, and those components (including platform and notification services) may process technical data under their own terms.

Advertising and affiliate arrangements may be introduced in the future. None is active today. If one is introduced, we intend to update this policy before it takes effect.

When the owner last checked, Cloudflare Web Analytics was not configured for this website. This is a point-in-time finding, not a permanent guarantee, because account settings can change.

Retention, backups and logs

This section concerns the MarketplaceAlert application and backend, which are not offered to the public through this website; this website itself has no accounts. We do not currently run any scheduled automatic deletion of data, and we have not defined fixed retention periods for any category of data, so we state none here. Data generally stays in the service until it is removed in one of the ways described under “Account deletion and your requests”.

Two categories of data are kept even when you delete a saved search: the public listing information we have collected from the marketplaces (it is stored once and is not owned by a single user), and the history of notifications that were queued or sent to you, including their delivery status. We do not currently delete either on a schedule.

Our hosting provider may keep database backups and application logs for limited periods that are outside our day-to-day control, so data that has been removed from the service may remain in backups or logs for some time afterwards. We have not defined or verified specific retention periods for these, and we do not state any here. Other providers listed above follow their own practices; those practices do not replace our own responsibilities for the data we control, and we have not verified them.

Planned trial policy: if you do not choose a paid plan after a trial, your scheduled searches are intended to be paused, not automatically deleted.

Account deletion and your requests

You can remove some data yourself: you can delete a saved search in the app. The service’s technical interface also allows a Telegram chat ID you provided to be cleared and a device’s push-notification token to be removed, but the current app does not necessarily offer these as separate options. Deleting a saved search removes the link between that search and the listings it found; it does not delete the collected listings or your notification history (see “Retention, backups and logs”).

There is currently no way to delete your account yourself, and we have not yet implemented or tested a process for deleting an account. You may contact us at the email address below with any privacy request, including one about your account or data. This is only a way to reach us – it does not mean a deletion process is already in operation. We will consider requests under the law that applies to you, and we may need to verify your identity first, for example by confirming that you control the email address registered to the account. We do not promise that a request will result in deletion, or any specific process or timeframe.

Your rights

Privacy rights differ between countries, and this policy does not assert that every country gives you identical rights. Depending on where you live, you may have rights such as access, correction, deletion, or objection. You can ask to exercise them by emailing us.

Security

Passwords and refresh tokens are stored hashed, connections to the service use HTTPS, and an account is temporarily locked after repeated failed sign-in attempts. Access to the database from the public internet is blocked, and the backend connects to it through the hosting provider’s internal connection. No system is perfectly secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy. When a “Last updated” date is shown at the top of this page, it indicates the date of the latest update.

Contact

For privacy questions or requests about your data, contact us by email:

marketplacealert@gmail.com