1. Information We Collect

• • Account information: your email address, plus your name and phone number if you give them. Your password is held by our sign-in provider (Supabase) only in scrambled form, so nobody at Reskale can read it. If you sign in with Google or Apple, they send us your email address instead and no password is created.
• • Marketplace connections: for eBay and Discogs, the access tokens those marketplaces give us when you approve Reskale. For eBay, Mercari, Depop and Vinted, the signed-in session your browser holds for that site (a cookie), which the extension sends us when you connect. We encrypt all of these before storing them. We never see or store your marketplace passwords.
• • Inventory data: product titles, SKUs, prices, photos and notes you enter
• • Marketplace data: listings, orders, sales, fees, shipments, messages and offers from the marketplaces you connect. These can include details about your buyers, such as their usernames and the messages they send you.
• • Photos: product photos you scan, photos of receipts and photos of vehicles you ask us to identify
• • Location: only while you are running a mileage trip. Your route is saved every 30 seconds during the trip. When you finish, it is replaced by the trip’s distance and duration, and the route itself is not kept. A trip you discard is deleted.
• • Support requests: what you write to us or to the help assistant, plus technical details captured with it (see section 4)
• • Usage data: the pages you view and the features you use (see section 10), and error reports when something breaks
• • Payment information: handled by Stripe. We never see or store your card details. We keep your plan and subscription status.
• • Newsletter: your email address and consent record, only if you subscribe (see section 8)

Poshmark: Reskale no longer connects to Poshmark or acts on your Poshmark account. It does not sync, list, share, delist or send offers there. Sales, orders and fees recorded before stay readable in your account. One exception today: if you have the extension and open your own Poshmark inbox, orders, offers or news pages, it still reads them and saves what it finds to your account, as it does for the other marketplaces. If you connected Poshmark before, its stored sign-in details stay encrypted in your account. Poshmark no longer appears on the Connections page, so to erase them, email us (section 12) or delete your account.

2. How We Use Your Information

• • Provide the App’s features: crosslisting, marketplace sync, orders, offers, shipments, inventory and bookkeeping
• • Identify products, vehicles and receipts from the photos you give us
• • Process subscription payments through Stripe
• • Send account emails (verification, password reset, billing notices)
• • Send the newsletter, only if you subscribed and confirmed
• • Answer your support requests
• • Find and fix errors
• • Understand which features are used, so we know what to fix and build next

We do not sell your data, and we do not share it with anyone for advertising.

3. The Browser Extension

The extension works only on eBay, Mercari, Poshmark, Depop and Vinted, and on the servers that host their listing photos. It cannot see any other website you visit.

• • Reading your seller pages: while you are signed in to the extension, it reads your own messages, orders, sold items, offers and notifications pages on eBay, Mercari, Depop and Poshmark when you open them, and saves what it finds to your Reskale account. It does this for any of those marketplaces, not only the ones you have connected in Reskale.
• • Connecting a marketplace: when you connect eBay, Mercari, Depop or Vinted, it reads the signed-in session that marketplace gave your browser and sends it to our servers, where it is stored encrypted (see section 1).
• • Crossposting and delisting: when you ask it to, it opens the marketplace’s page in a background tab and fills in, submits or removes the listing for you.
• • It does not read your marketplace passwords and does not set any cookies of its own.
• • It keeps your Reskale sign-in and sync settings in the browser’s extension storage. Uninstalling it removes them.

Our servers also contact eBay and Discogs directly, using the access you approved for those marketplaces, to sync your account and to carry out what you ask, such as creating or ending a listing. Each time you connect eBay through the extension, our servers also use your eBay session to check that the connection works.

4. Services That Receive Your Data

These companies process data for us. Each receives only what is listed, and only when you use the feature that needs it.

• • Vercel — hosts the website and our servers. Like any web host, it receives every request your browser makes to Reskale, including your IP address and browser type. Vercel Web Analytics also counts page views (see section 10).
• • Supabase — our database, sign-in and file storage. Holds everything stored in your account.
• • Twilio, through Supabase — sends the text-message code when you verify a phone number. Receives your phone number.
• • Google and Apple — only if you choose Sign in with Google or Sign in with Apple. They confirm who you are and give us your email address.
• • Stripe — payments. Receives your email address, your Reskale account ID and the plan you choose. You enter your card details on Stripe’s own page; we never see them.
• • eBay and Discogs — when you connect them, receive requests from our servers made with the access you approved (see section 3).
• • Mercari, Depop and Vinted — receive what you list or change there through the extension, from your own browser.
• • Google Gemini (AI) — the product photos you scan, vehicle photos you ask us to identify, receipt photos you upload, your conversation with the help assistant, and listing titles and descriptions when we fill in eBay item details.
• • Google Cloud Vision — the product photos you scan, to identify them.
• • SerpApi — when visual search is switched on, the product photo you scan, to find similar items through Google Lens. For this the photo is placed at a temporary web address that anyone with the link could open, and deleted as soon as the search finishes.
• • Google Maps — the map shown during a mileage trip. Receives your location while the map is on screen.
• • NHTSA, VinAudit and Bumper — the vehicle identification number (VIN) you look up, to return the vehicle’s details.
• • Upstash — short-lived counters that stop abuse, labelled with your account ID or a shortened form of your IP address.
• • Resend — sends the newsletter and its confirmation emails. Receives your email address.
• • PostHog — usage analytics for the website and the mobile app (see section 10).
• • Sentry — error reports when something breaks: the error, the page or address involved, and your browser or device type. Reports are not linked to your account and do not include your IP address, though an error can occasionally quote the data being processed when it happened.
• • Telegram — alerts our team when you file or reply to a support request. The alert includes your email address, the first 400 characters of what you wrote (with the request’s subject, for a reply) and, for a new request, your plan, which marketplaces you have connected, the page you were on, your browser, operating system and time zone, your extension version and recent error messages.
• • Linear — our internal task tracker. Receives the subject and full text of your support request and the same technical details, never your email address.

Each of these companies handles data under its own privacy policy.

5. Data Storage and Security

Your data is stored by Supabase, encrypted at rest and in transit. Row-level security in the database, and separate checks in our own code, limit each user to their own data. Marketplace sign-in details are encrypted with AES-256-GCM before they are stored, are never stored in plain text, and are never sent back out by any part of Reskale, including to you.

Photos you upload for crossposting are stored at web addresses that anyone with the link can open, because the marketplaces need to fetch them. Each address contains a long random code and is not published anywhere.

Reskale and most of the services in section 4 are based in the United States, so your information is processed there. While we take reasonable measures to protect your information, no system is 100% secure.

6. Data Retention

We keep your data for as long as your account is open. What is removed when you delete your account, how quickly, and what we must keep for tax law is set out on our account deletion page.

Website usage analytics are pseudonymous: they are tied to your account ID, never your email address. They may be kept after you close your account. If you want them removed, email us and we will delete them. The mobile app’s analytics also include your email address (see section 10).

7. Your Rights and Choices

• • Access: email us for a copy of your data
• • Correction: update your details in the App, or email us
• • Deletion: delete your account on the website (Settings, then Delete account) or in the mobile app (Settings, then Delete Account), or email support@reskale.xyz from your account’s email address. Details are on the account deletion page.
• • Export: download your inventory and bookkeeping records as spreadsheet (CSV) files
• • Disconnect: remove a marketplace under Settings, then Connections. This erases the stored sign-in details for it immediately. We keep the account’s username so your past sales still make sense. Poshmark is no longer listed there; email us to erase its details (see section 1).
• • Analytics: there is no switch for analytics in the App. On the website they are cookieless and are not stored on your device (section 10). To object, email us and we will delete the analytics linked to your account. Blocking analytics with a content blocker does not stop Reskale from working.
• • Newsletter: unsubscribe at any time from any newsletter (section 8)

If you are in the EU or UK, you can also complain to your local data protection authority.

8. Marketing Email and the Newsletter

We send a newsletter only to people who asked for it. Subscribing takes two steps: you enter your address, and then you confirm it by clicking a button in an email we send you. The confirmation link expires after 72 hours. An address that is never confirmed never receives the newsletter and never counts as a subscriber. The newsletter and the confirmation emails are sent through Resend.

For each address we store:

• • The email address and whether it is waiting for confirmation, confirmed or unsubscribed
• • The exact consent wording shown when you signed up, and the date and time you consented
• • When you confirmed and, if you did, when you unsubscribed
• • Where you signed up: the pop-up on our home page, the website footer or the registration page
• • A shortened form of your IP address with the last part removed (such as 203.0.113.0/24), used to spot floods of fake signups. We do not store your full IP address for this.
• • A scrambled copy of the confirmation code, until it is used or expires
• • If you claim the subscriber bonus: a link to your Reskale account and the date you claimed it

We never sell, rent or share the list with anyone.

• • Every newsletter has a one-click unsubscribe link that works without signing in, and works with your mail app’s own unsubscribe button
• • Unsubscribing is immediate and permanent unless you sign up again yourself
• • If your mail provider reports a message as spam, we suppress your address permanently and stop sending
• • Addresses that hard bounce are suppressed automatically
• • Account and security emails — sign-in codes, password resets, billing notices — are separate, are not marketing, and continue regardless

Subscribing is optional and is never required to use Reskale. If you were offered bonus trial days for subscribing, unsubscribing later does not take them back.

9. Children’s Privacy

The App is not intended for users under 18. We do not knowingly collect data from minors. If we learn that we have collected data from a user under 18, we will delete their account.

10. Cookies, Local Storage and Analytics

Cookies on the website:

• • Sign-in cookies from Supabase, which keep you signed in. The website cannot work without them.
• • A referral cookie, only if you arrive through someone’s referral link. It holds their referral code for 30 days so they can be credited if you sign up.
• • A language cookie, set when you choose a language or open a page in Spanish. It remembers your choice for one year.

The website also keeps a few settings in your browser’s local storage, such as your light or dark theme, whether the sidebar is collapsed, whether you have seen the newsletter pop-up, and items you chose to hide from crosspost lists. These are used by the website itself, not for tracking.

Analytics on the website: we use PostHog and Vercel Web Analytics to see which pages are visited and which features are used. Neither sets cookies, and neither stores anything on your device. PostHog keeps a temporary ID in memory that is gone when you reload or close the page. When you are signed in, the events are linked to your Reskale account ID, never your email address. Like any web request, PostHog and Vercel receive your IP address.

• • What is recorded: the pages you visit, named actions such as starting a crosspost or connecting a marketplace (with details like which marketplace and how many items), your plan, and the language you use Reskale in
• • What is not recorded: your clicks and keystrokes, what is on your screen, session recordings or heatmaps, your listings, your buyers or your messages
• • Private links, such as newsletter confirm and unsubscribe links, have their codes removed from the page address before it is sent to PostHog or Vercel

We use website analytics on the basis of our legitimate interest in knowing which features work and which need fixing. To object, see section 7.

The mobile app works differently. It also uses PostHog, and it stores an analytics ID on your device. It records the screens you open and the buttons you tap, including the text shown on what you tap. Once you sign in, these are linked to your account ID, your email address, how you signed in, your plan and trial dates, and your referral code. It also sends crash reports and performance measurements to Sentry, with your device type and operating system, not linked to your account.

Stripe’s checkout page, Google’s and Apple’s sign-in pages, and Google Maps are run by those companies and follow their own cookie policies.

11. Changes to This Policy

We may update this policy from time to time. We will notify users of material changes via email or in-app notification. Continued use after changes constitutes acceptance.

12. Contact

For privacy-related questions or data requests, contact us at privacy@reskale.xyz.