Privacy
Who we are
Operator: [to be completed]
Country: [to be completed]
Postal address: [to be completed]
Contact: [to be completed]
What we collect
Your email address; your alert choices (product, size, retailers); the roundup consent record (date, wording version, where you gave it); optionally one “remember this browser” cookie; hashed (not raw) IP addresses for rate limiting, kept under 24 h; and standard server logs kept by our hosting providers.
We do not use tracking pixels, and we do not track which links you click in our emails individually.
Why and the legal basis
| Purpose | Basis |
|---|---|
| Alerts, confirmation and expiry reminders | The service you asked for — Art. 6(1)(b) |
| The roundup | Your consent — Art. 6(1)(a), withdrawable at any time |
| Abuse prevention, the bounce/complaint block list, anonymous statistics | Legitimate interests — Art. 6(1)(f) |
Who processes it
- Resend: email delivery, United States (EU–US Data Privacy Framework and/or standard contractual clauses).
- Supabase: database. Region: [to be completed]
- Vercel: website hosting. Region: [to be completed]
- Railway: background jobs. Region: [to be completed]
- Upstash: rate limiting. Region: [to be completed]
- PostHog: cookieless, anonymous analytics, never your email. Region: [to be completed]
- Kutoku: affiliate links. It receives no personal data from us.
How long we keep it
| Data | Kept for |
|---|---|
| Unconfirmed sign-up (address, pending alerts, unconfirmed roundup consent) | Until the 72 h confirmation window ends |
| Live alert | Until it fires (one-time), is stopped, or expires (6 months, extendable) |
| Ended alert | 30 days, so "Keep watching" links still work |
| Address with no alerts and no roundup consent | 30 days after the last activity; "Stop all" deletes immediately |
| Roundup consent | Until withdrawn, or 12 months if no roundup has launched |
| Record of each alert sent (product, retailers, size — no content) | 90 days |
| Queued/sent email records | 30 days |
| Links in emails | Confirm 72 h; manage, keep-watching and extend links 60 days; stop links as long as we hold your address |
| Remembered-browser cookie record | 180 days |
| Hard-bounce / complaint block list | Indefinitely, as a one-way hash (not the address) |
| Rate-limit counters (hashed IP / mailbox) | ≤ 24 h, in Upstash |
Our database backup window: [to be completed]
Resend’s log retention: [to be completed]
Cookies
__Host-idx_alert_device: the optional remember-this-browser cookie, kept up to 6 months and set only if you tick the box.
__Host-idx_alert_session: the manage-page session cookie, 30 minutes, strictly necessary.
No other cookies, and no advertising or analytics cookies.
Your rights
You can ask for access, correction or deletion, object to how we use your data, withdraw consent, and complain to a regulator (the ICO in the UK, or your EU authority). Use the links in any alert email, the manage page, or email the contact address above. “Stop all” deletes your data immediately.
Unsubscribe links
The one-click unsubscribe link in our emails' headers contains a single-purpose code that our hosting provider's request logs may briefly record; that code can only stop alerts.
Last updated
4 October 2026