Privacy Policy

Section 01What Information Do We Collect?

Depending on how you sign in and which features you use, we collect the following.

Account and sign-in information

• Discord sign-in (Website and App). Your Discord user ID, username, display name, and avatar. On the Website, Discord also gives us the email address on your Discord account, the list of servers you are in, and your roles in the Resale Rascals server, which we use to check your membership. In the App, your Discord access token is stored on your device.
• Apple, Google, or email sign-in. Your account ID, name, username or display name, and email address (Apple may give us a private relay address instead). Sign in with Apple is offered on iPhone. Discord, Google, and email sign-in are offered in both apps, and the Website may also offer Google sign-in.
• Email sign-in link (Website). If you bought a Website membership through Stripe and have not connected Discord, you sign in to the Website with a one-time link that we email to the address you paid with. We store only a one-way hash of each link, not the link itself. A link works once and expires after 15 minutes, or after 24 hours for the link in your welcome email. We also keep the address the link was sent to and a one-way hash of the IP address that asked for it, and we delete these records within 2 days.
• Profile. The profile photo and handle you add, or your Discord avatar.
• Sessions. Session tokens that keep you signed in, stored on your device. On the Website, a session cookie does the same.

Membership and purchases

• Membership role. Whether you hold our membership role in the Resale Rascals Discord server. We check this with Discord to decide what you can use on the Website and in the App.
• Website memberships. Memberships bought outside the App, on the Website or inside our Discord server ("Website memberships"), are billed either through Stripe, our payment processor, or by our third-party membership billing provider (currently Whop), which gives you our membership role in Discord. We receive your membership status and history, not your card details.
• Memberships paid through Stripe (Website). When you pay on the Website, Stripe collects your card and billing details and processes the payment. Stripe also asks for your phone number and billing address when you pay and shares them with us, so we can tell who made a payment and reach you about billing. Stripe tells us your Stripe customer and subscription IDs, the email address you paid with, your plan status, your renewal and end dates, and whether a payment failed, was refunded, or was disputed. We also keep the time you agreed to the renewal terms, the date you first opened the member dashboard, and the last day you used it, so we can answer billing questions and payment disputes. If you connect Discord, we link the membership to your Discord user ID and give that account our membership role.
• App subscriptions. iPhone: Apple App Store transaction details, so we can confirm your subscription. Android: Google Play purchase tokens, so we can confirm your subscription.
• App integrity. Android: Google Play Integrity verdicts, which tell our servers that requests come from a genuine copy of the App.
• Former members. If your membership has ended, we keep your name, email address, and membership details (such as your plan, its status, and when it started and ended) from our own records and from our membership billing provider, so we can send you occasional emails about what is new and how to come back.

Payment Data. We never receive your card or other payment details. Apple, Google, Stripe, and our membership billing provider handle payment.

Information you send us

• Website forms. The name, email address, phone number, Discord username, subject, message, and other details you type into our contact, help, newsletter, or job application forms, together with the IP address the form was sent from.
• Support. Support tickets and problem reports you send us from the App, from the Website, or by email.
• Chat. Messages, photos, GIFs, and voice notes you send in the in-app chat, and the reports and blocks you make there (see Section 05).
• Replies to our emails. When you reply to one of our emails, we receive and keep your message, the address you wrote from, the date and subject, and the names and sizes of any attachments (we do not download the files), so we can read your message and answer it.

App preferences and data

We store the following on your device and on our servers so your account works across devices:

• Favorites and price monitors
• Search history (UPC codes and item IDs). Your in-app search history is synced to our servers with your account.
• Your ZIP code and saved stores, used to find nearby stores and as an approximate location for stock checks. In the App, this is the only location we keep.
• Notification preferences

Information automatically collected

On the Website: your IP address, browser and device characteristics, operating system, language preferences, referring URLs, the pages you view, and information about how and when you use the Website (see Section 02 and Section 03).

In the App:

• iPhone: the device identifier (identifierForVendor), used for sign-in and security
• Android: the Android ID, sent when you sign in with Discord and kept with your session record and to enforce bans, and a random ID created when the App is installed
• Your push notification token (see Section 07)
• Device type or model, operating system version, and app version
• Your IP address, which our servers receive with every request and keep with some security records, such as screenshot reports (see Section 03)

In our emails: Some of our emails, such as the occasional emails we send to former members, contain a small image that tells us when the email is opened, and their links go through our website first so we can count clicks. Links to our website in these emails carry campaign tags (such as utm_source), so we can see which emails bring visits. The first time an email is opened, we record the time, the browser or mail app that opened it (its user agent), and part of the IP address it came from. For clicks, we record the time and which link was used. These numbers are estimates: some mail apps and security tools open emails and links on their own, and if you turn off images in your mail app, we cannot tell when you open an email.

Camera

The App asks for camera permission to scan barcodes. Camera data is processed locally on your device and is never transmitted to our servers. Only the scanned barcode or UPC code is used for product searches.

Section 02Cookies and Website Analytics

The Website uses a session cookie to keep you signed in, and stores your cookie choice and language preference in your browser. We also save your language in a cookie named rr_lang for one year, so our server can show you pages in that language. We use it only to choose the language of the page. When you open the membership payment form on the Website, we set a cookie for one day that ties the payment to your browser, so the confirmation page can sign you in after you pay. While you connect a Discord account to a membership, another cookie, kept for 10 minutes, makes sure the connection goes to your own account.

We measure how the Website is used with our own analytics, so we can see which pages and offers work and improve the ones that do not. When you browse the Website, we record:

• The pages you view (their address and title), and how long each page was visible on your screen
• How far down each page you scroll
• Which sections of a page came into view, and which buttons and links you clicked (for a link to another website, only that website's name)
• The steps of joining a membership on the Website: opening the payment form, the form loading or failing to load, going back, and finishing, when our billing provider reports that to the page, and seeing the payment confirmation page
• When the newsletter sign-up is shown, closed, or sent, when the support chat is opened, and when a support message is sent, but not what you type
• The website you came from, and any campaign tags in the link you followed (such as utm_source)
• Your browser, operating system, and type of device (phone, tablet, or computer), read from your browser's user agent, and the language of the page
• A random visitor ID kept in your browser's local storage, and a random session ID kept in its session storage, so we can tell one visit from the next. These IDs do not contain your name or email address.
• A one-way hash of your IP address instead of the address itself, made with a random key that is kept for one day and then thrown away, so the hash cannot be traced back to your address afterwards

When you are signed in, we link these records to your Discord account, as we do for the activity described in Section 03. Our page view counter also stores the page address, your IP address, your browser's user agent, and the referring page in our own database.

If you decline the cookie notice, or your browser sends a Global Privacy Control or Do Not Track signal, the Website does not keep a visitor ID or session ID in your browser storage, and removes one it saved before. Your page views are still counted, but they are not linked to one another, to your earlier visits, or to your Discord account, even when you are signed in: for those page views we keep no hash of your IP address, and our page view counter does not store your IP address.

We keep these analytics records, and the page view counter's records made since October 9, 2026, for 400 days and then delete them automatically. Our analytics are first party: the data goes only to our own servers and database, and we do not sell it or share it with advertisers. We do not use advertising cookies or third-party analytics services on the Website.

Website pages load fonts from Google Fonts, which receives your IP address and browser details when a page loads. Some Website pages also load map tiles from OpenStreetMap and code libraries from jsDelivr, unpkg, and Socket.IO, which receive your IP address and browser details in the same way. The membership payment form on our home page is loaded from Stripe, which receives your IP address and browser and device details in the same way, may set its own cookies, and uses this information to prevent fraud.

Section 03Security Monitoring and Activity Logging

To prevent account sharing and other abuse, the App and the Website report some activity to the Resale Rascals team, in a private Discord server and a private staff dashboard on our website. Only the team can see them. The App does not collect your device's location.

App activity logging

The App logs these actions to a private staff channel:

• Sign-ins and sign-outs. Sign-ins include your device identifier.
• Favorites added or removed, with the product's title and UPC
• Price monitors added, changed, or removed, with the product's UPC, the ZIP code, and any target price
• ZIP code changes, with the old and new ZIP code

Every entry includes your user ID, username, and profile photo. Sign-ins (with the device identifier) and favorites added are also recorded in our staff dashboard. This logging is part of how the App works and is not optional; it cannot be turned off in the App or in your Discord settings.

iPhone: the device identifier is the identifierForVendor. Android: the device identifier is the random install ID, and sign-ins also include your device model.

App security reports

iPhone: the App sends a report periodically while you are signed in, and again whenever a screenshot or screen recording is taken inside the App. Each report contains:

• Device details: model, device name, iOS version, screen size, app version and build number, and the identifierForVendor
• Your account ID and username, so the report can be tied to your account
• The network (IP) address the report was sent from

iPhone: screenshot reports are also recorded in our staff dashboard with your device identifier.

Android: taking a screenshot inside the App sends a report to staff with your account, the screen it was taken on, your device (model, Android version, and the random install ID), and your IP address. This works on Android 14 and later. The report is also kept in our security log.

Website activity logging

When you are signed in, the Website records sign-ins, sign-outs, and some member dashboard actions, such as stock checks, searches, barcode scans, lead views, and favorites or monitors added or removed, with your Discord user ID, username, IP address, and browser user agent. Some of these entries are also posted to a private staff Discord channel. Membership billing events, such as a new membership, a cancellation, a failed payment, a refund, or a payment dispute, are also posted to a private staff Discord channel, with the email address partly hidden. We may look up the approximate city and region of your IP address with an IP geolocation service for these security records.

We use this to support members and to prevent abuse.

Section 04Stock Checks

When you check stock in the App or on the Website, the item and your ZIP code or store are sent to our servers so we can look up nearby stores. Some stock checks on the Website send the results to you as a Discord direct message from our bot.

When a retailer's stock check is run from your phone instead of our servers (for example, Home Depot checks where available), the App loads that retailer's public website in the background on your device and reads store stock from it. The retailer and the services its site uses then receive what any visit to that website sends: your IP address, a standard browser request, and the site's own cookies. iPhone: the App clears those cookies when you sign out. The results (item, store, quantity, price, and ZIP code) are sent to our servers to keep stock data current for members.

Section 05Chat

Chat text in the App is checked by an automated moderation service (OpenAI) before it is posted. Messages that break the rules can be blocked, and messages other members report are reviewed by our team.

GIFs come from the KLIPY GIF service, which sees your search terms and your IP address.

Section 06How Do We Process Your Information?

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication through Discord, Apple, Google, or email, and otherwise manage user accounts.
• To confirm your membership role and your subscription.
• To process Website membership payments through Stripe, send membership emails (welcome, sign-in links, cancellation confirmations, and billing notices), and handle refunds and payment disputes.
• To deliver and facilitate delivery of services to the user, including product monitoring, stock checks, deal alerts, and notifications.
• To sync your favorites and monitors across devices.
• To send you price-drop, lead, and chat notifications.
• To run the in-app chat, including automated moderation and review of reported content.
• To respond to user inquiries and offer support.
• To send administrative information to you.
• To enable user-to-user communications.
• To request feedback and to contact you about your use of our Services.
• To send you marketing and promotional communications, where it aligns with your preferences, such as occasional emails to former members, and to measure whether those emails are opened and their links clicked, so we can send fewer emails to people who do not read them.
• To protect our Services, including monitoring and preventing fraud, account sharing, and abuse.
• To identify usage trends and improve our offerings, the App, and the Website.

Section 07Push Notifications

If you allow notifications, your device gives the App a push token, which we store with your account so we can send price-drop, lead, and chat notifications. iPhone: the token comes from the Apple Push Notification service. Android: the token comes from Firebase Cloud Messaging. You can turn notifications off in the App's settings or in your device settings at any time.

Section 08Crash and Diagnostic Data

The platform tools the App is built with can collect crash and diagnostic data:

• iPhone: Apple crash reports and diagnostics, which Apple shares with us only if you have chosen to share analytics with app developers in your iPhone settings
• Android: Google's Firebase and ML Kit libraries, which may send diagnostic and performance data to Google

Section 09When and With Whom Do We Share Your Personal Information?

We do not sell, trade, or rent your personal information to third parties. We may need to share your personal information in the following situations:

• Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us, such as hosting, databases, email delivery, sign-in, push notifications, chat moderation, and GIF search (see Section 10). This includes our community platform Discord, which we use for sign-in, membership roles, and the private staff activity log described in Section 03, our third-party membership billing provider (currently Whop), which bills Website memberships, and our payment processor Stripe, which processes payments made on the Website. When you pay on the Website, Stripe collects your card and billing details directly, and we send Stripe the language of the page and, if you are signed in, your account ID (such as your Discord user ID). We do not store card details.
• Retailers. To look up products and stock, we send item identifiers and a ZIP code or store to retailer services such as Walmart and Home Depot (see Section 04).
• Legal Requirements. We may share your information when required by law.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Affiliates. We may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Notice.

Section 10Third-Party Services

Our Services integrate with:

• Discord: sign-in, membership roles, community features, direct messages from our bots, and the team activity log described in Section 03
• Sign in with Apple (iPhone): sign-in, if you choose it
• Google Sign-In: sign-in, if you choose it
• Apple StoreKit (iPhone): in-app subscriptions
• Google Play Billing (Android): in-app subscriptions
• Whop: billing for Website memberships
• Stripe: payments for Website memberships paid on the Website, the payment form on our home page, fraud checks, and receipts and other billing emails. Stripe handles this data under its own privacy policy, at stripe.com/privacy.
• Google Play Integrity (Android): checks that requests come from a genuine copy of the App
• Apple Push Notification service (iPhone): push notifications
• Firebase Cloud Messaging (Android): push notifications
• Google ML Kit (Android): barcode scanning, which runs on your device
• OpenAI: automated moderation of chat text (see Section 05)
• KLIPY: GIF search and GIF images in chat (see Section 05)
• Walmart and Home Depot APIs: product information and stock checking
• Email delivery providers, including Resend: replies to your messages, confirmations, account emails, membership emails such as sign-in links, and our promotional emails, including receiving your replies to them
• Google Fonts: fonts on the Website
• OpenStreetMap, jsDelivr, unpkg, and Socket.IO: maps and code libraries on some Website pages

These third parties have their own privacy policies. We encourage you to review them.

Section 11How Do We Keep Your Information Safe?

App data is stored locally on your device (iOS UserDefaults on iPhone, Android app storage on Android), and on our backend servers to enable cross-device synchronization.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.

Section 12How Long Do We Keep Your Information?

We keep your account data for as long as your account is open. Device identifiers and IP addresses are kept with your session record and our security records, which are used to enforce bans. What happens when you delete your account is described in Section 13.

Records of Website memberships paid through Stripe (your Stripe customer and subscription IDs, plan status and dates, the email address you paid with, and your Discord user ID if you connected one) are kept for accounting, tax, refunds, and payment disputes, including after the membership ends. Email sign-in link records are deleted within 2 days. The records that tie a payment to the browser that made it are deleted after 30 days.

Records of the emails we send you, including when they were opened and which links were clicked, are kept for up to 2 years. The browser details and partial IP address recorded when an email is opened are deleted after 90 days. The text of replies you send us is kept for up to 2 years. After that, we keep only a short record of each email, such as its dates and whether it was delivered, so our totals stay right and the unsubscribe link in an older email keeps working. If you unsubscribe, or an email to you bounces or is marked as spam, we keep a record of it so you do not get these emails again. If you ask us to delete your information, we keep only a one-way hash of your email address for this purpose.

Otherwise, we will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Section 13Deleting Your Account

How to delete your account

• In the App: tap the gear button at the top right to open Settings, scroll to the bottom, tap Delete Account under Danger Zone, and confirm. If you have not subscribed, Delete Account is also at the bottom of the membership screen you see after signing in.
• By email: write to hello@resalerascals.com from the email address on your account, or include your username. We will delete the account within 30 days and let you know when it is done. If you use only the Website, email us the same way.

What is deleted

Deleting in the App removes your account and everything in it: your profile and sign-in details, favorites, saved stores, price monitors, preferences, search history, chat messages, push tokens, sessions, notifications, and support tickets, including your data in the Resale Rascals Discord bot.

Most of it is removed right away. Copies on our chat server (older chat messages, search history, push tokens, and device sessions) are removed in the same step, unless that server is briefly unavailable at that moment. If you want us to confirm nothing was left behind, email us and we will check and finish the deletion within 30 days. Photos and voice notes you sent in chat are cleared from our file storage by a daily cleanup, usually within two days.

What we keep

• Reports and blocks other members filed about you. Your name and the reported message text are cleared from them. Each one is kept until the member who filed it deletes their own account, or, for a block, until they unblock you.
• Records of App Store purchases, with the link to your account removed. We keep them indefinitely for tax, accounting, refunds, and chargebacks.
• Records of Website memberships paid through Stripe, kept for tax, accounting, refunds, and chargebacks. Stripe also keeps its own records under its privacy policy.
• Security and enforcement records, such as bans, suspensions, and the staff audit log (including screenshot reports). We keep them indefinitely, including after a ban is lifted, so that a ban still applies if the same person signs up again.
• Messages already posted to our private staff Discord server, such as activity log entries and problem reports. These are not deleted and stay indefinitely.
• Activity entries in our staff dashboard, such as sign-ins, favorites added, and screenshot reports (see Section 03). These are not deleted and stay indefinitely.

Deleting your account does not cancel a subscription. Apple and Google handle billing for subscriptions bought in the App, so cancel in your App Store or Google Play subscriptions first if you do not want to be charged again. Website memberships are cancelled as described in our Terms of Service. If a Website membership you pay for through Stripe is still active when you delete your App account, it keeps renewing, and we email you once to tell you how to cancel it. Deleting your account also does not delete your Discord account.

Section 14Do We Collect Information From Minors?

The App is not intended for children under 13 years of age. We do not knowingly collect, solicit data from, or market to children under 13, nor do we knowingly sell such personal information. Website memberships are sold only to people who are at least 18 years old; by buying a Website membership, you represent that you are at least 18. If we learn that personal information from a child under 13 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records.

Section 15What Are Your Privacy Rights?

You have the right to:

• Access the personal information we hold about you, and details about how we have processed it
• Request correction of inaccurate data
• Delete your account and associated data (see Section 13)
• Opt out of optional data, such as your profile photo and push notifications. The activity logging in Section 03 cannot be turned off.

Depending on your location, you may have further rights that allow you greater access to and control over your personal information (see Section 17 and Section 18).

Withdrawing your consent. If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us using the contact details provided below.

Opting out of marketing communications. You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, by replying STOP to one of them, or by contacting us. Every promotional email we send has an unsubscribe link, and we act on it right away. You will then be removed from the marketing lists. However, we may still communicate with you, for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

To exercise these rights, or to request to review, update, or delete your personal information, email us at hello@resalerascals.com.

Section 16Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, apart from the Website analytics described in Section 02, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. On the Website, a Do Not Track or Global Privacy Control signal turns off the analytics visitor ID.

Section 17Do US Residents Have Specific Privacy Rights?

If you are a resident of certain US states, you may have the right to request access to and obtain a copy of your personal information, to request correction or deletion, and to opt out of the processing of your personal information for targeted advertising. If you reside in California, you have rights under the CCPA, including the right to know what personal information we collect and the right to request deletion. We do not sell your personal information. The categories of personal information we may collect are summarized below.

Section 18Residents of the EEA and UK

If you reside in the European Economic Area or the United Kingdom, you have rights under the GDPR, including access, rectification, erasure, restriction of processing, and data portability. The Services are hosted in the United States, so your information is transferred to and processed in the United States. You may also lodge a complaint with your local data protection authority.

Section 19Do We Make Updates to This Notice?

Yes, we will update this notice as necessary to stay compliant with relevant laws. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes, we may notify you either by prominently posting a notice of such changes, by an in-app notice, or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

Section 20How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may contact us at: