Privacy Policy

1. Who we are

Sale Spotted, Inc. (“we,” “us”) operates Sale Spotted!. Privacy questions: privacy@salespotted.com or Contact Us.

2. Overview

This policy describes what we collect, how we use it, who we share it with, and your choices. It applies to the Sale Spotted! website, progressive web app, and related APIs. Related documents: Terms of Service and Community Guidelines.

3. Data we collect

• Account data: email, password (hashed by our auth provider), optional display name, username, avatar, age/terms acceptance metadata you provide at signup.
• Sale content you publish: titles, descriptions, map pins (precise lat/lng), optional address text, photos, categories, times, visibility setting (public vs signed-in only), votes, comments, messages related to a sale.
• Location (optional features): browser geolocation for “near me” / Drive Near while the app is open. Precise coordinates for server-side proximity push are stored only if you opt in to push notifications; readable by backend systems for that purpose, not shown as a public profile field.
• Device / technical: session cookies / local storage, IP addresses in hosting logs, user agent, approximate region. We do not currently run third-party ad trackers; if analytics are added later, we will update this policy.
• Moderation & support: abuse reports, rate-limit hits, suspension records, admin audit logs, Contact Us messages from signed-in users.
• Payments (if enabled): handled by Stripe; we receive limited payment metadata (e.g. customer id, subscription status), not full card numbers.

4. How we use data

• Operate the map, listings, profiles, messaging, reputation, and routing features
• Authenticate you and protect accounts
• Moderate content and enforce Terms / Community Guidelines
• Send optional web push alerts you opt into
• Respond to Contact Us and legal/safety reports
• Improve reliability, security, and product quality
• Comply with law and respond to valid legal requests

5. Public vs limited visibility

Content you mark public (including map location and photos) is visible to guests and signed-in users. Content limited to signed-in users only is still shared with other account holders, not kept private to you alone. Community-reported sales are public by default. Do not publish information you are not prepared to share widely.

6. Sharing & third-party processors

We do not sell your personal information. We use service providers (“processors”) to run the product. Those providers process data under their own terms and privacy policies. Important ones include:

• Supabase — authentication, database, file storage, edge functions. Privacy Policy · Terms
• Cloudflare — app hosting/Workers, CDN, optional R2 object storage for map tiles. Privacy Policy · Terms
• OpenStreetMap contributors / Protomaps — basemap vector data and related assets (self-hosted tiles plus optional style assets). Map use is subject to OSM’s copyright & license (ODbL) and Protomaps data license notes. Attribution appears on the map control.
• MapTiler (optional) — directions/routing when that feature is configured; keys are intended to stay server-side. Privacy Policy · Terms
• Stripe (if payments enabled) — checkout and subscriptions. Privacy Policy · Legal
• OAuth providers (if you use Google/Facebook sign-in) — identity assertion only as you authorize; see each provider’s privacy policy.
• Partners (optional API): only under a separate Partner API agreement; street addresses are not exposed via that API (lat/lng and listing fields per tier only).
• Legal / safety: when required by law, to protect users, or to report CSAM / serious crimes to authorities (e.g. NCMEC).

“Third-party processors” means companies that handle data so we can provide the Service—not that we sell your data to advertisers. Linking their privacy policies helps you understand where your data may be processed outside Sale Spotted, Inc.

7. Retention

Account and listing data is retained while your account is active and as needed for safety, fraud prevention, and legal compliance. Precise last-known location for push is intended to be short-lived and cleared when you opt out. You may request account deletion via Contact Us; some logs and legal holds may remain for a limited period.

8. Security

We use industry-standard controls: HTTPS, database row-level security, private photo storage with short-lived signed URLs, server-side sessions, and rate limits. No system is perfectly secure; report suspected vulnerabilities to abuse@salespotted.com.

9. Your choices

• Edit profile and sale content while signed in; cancel listings you control
• Choose public vs signed-in visibility when creating a sale
• Opt out of push and clear stored location from profile settings
• Deny browser geolocation (map still works with manual pan)
• Request account deletion or privacy questions via Contact Us / privacy@salespotted.com

Depending on your location (e.g. California CCPA/CPRA), you may have rights to know, delete, or correct personal information, and to not be discriminated against for exercising those rights. We do not sell personal information. Submit requests via Contact Us; we may need to verify your identity.

10. Children

The Service is for users 18 and older only. We do not knowingly collect personal information from anyone under 18. Contact us if you believe we have, and we will delete it.

11. International users

Data may be processed in the United States or other regions where our providers operate. By using the Service you consent to such transfers as permitted by applicable law.

12. Cookies

We use essential cookies and similar storage for authentication and security. We do not currently use non-essential advertising cookies. If we add analytics cookies later, we will update this policy and provide choices where required.

13. Changes

We may update this policy. The “Last updated” date will change when we do. Continued use after updates constitutes acceptance where permitted by law.

14. Contact

Sale Spotted, Inc. · Contact form · privacy@salespotted.com · legal@salespotted.com

This policy is written for launch readiness and should be reviewed by counsel for your specific jurisdictions and product changes.