Privacy policy.
01Overview
This Privacy Policy describes how thrift.fit ("we", "us") collects, uses, stores, and shares personal information when you use our website and related services (the "Service"). thrift.fit is a single-player menswear shopping assistant that queries the eBay API for listings and uses AI models to evaluate them against your stated preferences.
02Information we collect
2.1 Information you provide
- Account information. Email address and the authentication records needed to sign you in.
- Preferences. Measurements, style preferences, saved searches, and other settings you enter to configure evaluations.
- eBay authorization. If you connect your eBay account, we receive OAuth tokens scoped to the permissions you grant. We do not receive your eBay password.
- Support communications. Information you send us when you contact us for support.
2.2 Information generated by use
- Evaluation results. AI-generated scores, explanations, and metadata produced when we evaluate listings against your preferences.
- Listing data. Cached copies of public eBay listings we have fetched on your behalf (title, description, price, images, seller name).
- Usage and device data. IP address, browser type, pages visited, and timestamps, collected in server logs for security and debugging.
- Error and performance data. Crash reports and performance metrics collected from the application.
03How we use it
- To provide, operate, and maintain the Service.
- To authenticate you and secure your account.
- To fetch eBay listings on your behalf and evaluate them with AI models.
- To improve reliability, debug issues, and monitor for abuse.
- To communicate with you about the Service, including important notices.
- To comply with legal obligations and enforce our Terms of Service.
We do not sell your personal information. We do not use your personal information for cross-context behavioral advertising.
04Third-party services
We share limited information with vetted service providers so they can perform functions on our behalf. These providers support areas such as hosting, account authentication, database storage, security, payments, listing retrieval, and AI-assisted evaluation. Each provider processes data under its own privacy commitments.
- Infrastructure and security. Hosting, database, authentication, network, monitoring, and fraud-prevention providers may process account data, request metadata, logs, and diagnostic information needed to operate and protect the Service.
- AI model providers. Providers used to evaluate listings may receive listing text, listing images, and your preference context at inference time.
- Marketplace integrations. Marketplace APIs may receive requests needed to fetch public listing data and, if you connect an account, authorization tokens scoped to the permissions you grant.
- Payments and customer support. Providers that help manage billing, taxes, disputes, and support communications may process only the information needed for those workflows.
We do not send AI providers your email address or authentication credentials. Model providers may retain inputs briefly for abuse-monitoring purposes; we use business or enterprise terms with these providers where available to prevent use of your data for training their models.
06Data retention
- Account data is retained for the life of your account and deleted within 30 days after account deletion, subject to legal retention requirements.
- Billing and provider records such as Stripe customer, subscription, invoice, payment, tax, dispute, and webhook event records are retained when needed for refunds, chargebacks, tax, fraud prevention, audit, and provider compliance obligations.
- Evaluation results and cached listings are retained as long as they remain useful for your experience and are periodically pruned.
- Server logs are retained for up to 90 days.
- Error-monitoring data is retained for up to 90 days.
07Security
We use hosted authentication, TLS in transit, access controls, and reputable infrastructure providers to protect personal information. No security measure is perfect, and we cannot guarantee absolute security.
08International transfers
Your information may be processed in countries other than the one in which you live, including the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) to protect international transfers.
09Your rights
Depending on where you live, you may have the following rights with respect to your personal information:
- Access — request a copy of the personal information we hold about you.
- Correction — request that inaccurate information be corrected.
- Deletion — request that we delete your personal information, subject to legal exceptions.
- Portability — request your information in a portable, machine-readable format.
- Objection or restriction — object to or restrict certain processing.
- Withdraw consent — where processing is based on consent, withdraw it at any time.
- Non-discrimination — we will not discriminate against you for exercising any of these rights.
- Opt-out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising.
To exercise any of these rights, contact us at the address below. We may need to verify your identity before fulfilling a request. You also have the right to lodge a complaint with your local data-protection authority.
10Children
The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
11Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be communicated through the Service or by email.
12Contact
For privacy questions or to exercise any of the rights above, contact us at [email protected].