Privacy Policy

1. Data We Collect

We collect the following categories of information to provide and improve our services:

Account Information

When you register, we collect your email address, username, and name. If you subscribe to a paid plan, Stripe processes your payment information on our behalf.

Location Data

We collect addresses you search for and, if you enable location services, your GPS coordinates. This data is used to show nearby sales and build driving routes.

Listing Data

We collect information about sale listings you create, save to your stops, or import via the browser extension. This includes addresses, dates, descriptions, and photos you upload.

Route & Navigation Data

We collect data about routes you build, stops you add, mileage you track, and purchases you log. This data powers route optimization and your personal history.

Payment Data

Payments are processed by Stripe. We do not store your credit card numbers, bank account details, or other sensitive financial information on our servers. We receive only a confirmation of your subscription status from Stripe.

Usage Data

We collect your IP address (used for rate limiting and abuse prevention), pages visited, and feature usage to understand how the Platform is used and to improve it.

Communications

If you send messages to other users on the Platform, we store the content of those messages to deliver them and to enforce our community guidelines.

Newsletter & Marketing Emails

If you subscribe to our newsletter, we collect your email address and optionally your ZIP code to send you information about yard sales in your area. Your ZIP code is geocoded to determine your city, state, and approximate coordinates for regional targeting. You can unsubscribe at any time via the link in any marketing email or by visiting our unsubscribe page. We do not share your email address with third parties for their marketing purposes.

2. How We Use Your Data

We use the information we collect to:

• Provide the core service, including showing nearby sales, building and optimizing routes, tracking mileage, and logging purchases
• Improve the Platform by analyzing usage patterns and identifying areas for enhancement
• Prevent fraud and abuse, including enforcing rate limits and detecting unauthorized access
• Send transactional emails such as password resets, subscription confirmations, and account notifications
• Send marketing emails about yard sales in your area, if you have opted in to our newsletter (you may unsubscribe at any time)

3. Third-Party Services

We use the following third-party services to operate the Platform. Each service receives only the minimum data necessary to perform its function:

• Stripe — Processes subscription payments. Stripe receives your payment details directly and is subject to Stripe's Privacy Policy.
• Nominatim / OpenStreetMap — Geocoding service. When you search for an address or create a listing, the address is sent to Nominatim to retrieve latitude and longitude coordinates.
• OSRM (Open Source Routing Machine) — Routing service. When you build or optimize a route, stop coordinates are sent to OSRM to calculate driving directions and distances.
• Upstash Redis — Used for server-side caching and rate limiting. No personally identifiable information is stored long-term.
• Cloudflare R2 — Used to store photos you upload to your sale listings. Photos are stored securely and served via Cloudflare.
• Google Maps / Directions API — Used for route optimization only. Stop coordinates are sent to Google to calculate optimal driving order and directions. Subject to Google's Privacy Policy.
• Resend — Used to send transactional emails (password reset, affiliate approval, notifications). Your email address is shared with Resend for delivery purposes only.

4. Your Rights

Under applicable privacy laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), you have the following rights:

• Access your data — You can request a copy of the personal data we hold about you.
• Delete your account and data — You can request deletion of your account and all associated data. We will process your request within 30 days.
• Export your data — You can request an export of your data in a portable format.
• Opt out of non-essential data collection — You can opt out of non-essential data collection by adjusting your account settings or contacting us directly.
• Unsubscribe from marketing emails — You can unsubscribe from our newsletter at any time via the unsubscribe link in any email or by visiting garagesalehq.com/unsubscribe.

To exercise any of these rights, contact us at adhdaveflips@gmail.com.

5. Cookies & Local Storage

• NextAuth session cookie — An essential cookie used to maintain your authenticated session. This cookie is required for the Platform to function and cannot be disabled.
• localStorage — We use your browser's localStorage to save UI preferences such as notification dismissal states and daily visit tracking. This data never leaves your device.
• No third-party tracking cookies — We do not use any third-party analytics, advertising, or tracking cookies.

6. Data Retention

• Account data — Retained for as long as your account is active. When you delete your account, all associated data is permanently removed within 30 days.
• Listings — Active listings are retained while they are published. Canceled or expired listings are removed from public view but may be retained in backups for up to 90 days.
• Messages — Retained for 90 days after the conversation ends, then permanently deleted.

7. Children's Privacy

The Platform is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly.

If you believe a child under 13 has provided us with personal information, please contact us at adhdaveflips@gmail.com.

8. Data Security

We implement reasonable technical and organizational measures to protect your data, including encrypted connections (HTTPS), secure password hashing, and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the date at the top of this page. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

10. Contact Us

If you have any questions about this Privacy Policy or your data, please contact us at adhdaveflips@gmail.com.