DealDrop

Privacy

How DealDrop handles information.

A factual product-data draft based on the current repository inventory. It is not approved legal text yet.

Version: [OWNER TO CONFIRM] · Effective date: [OWNER TO CONFIRM]

1. Scope

This draft describes the information used by the DealDrop mobile application and its supporting services. The public website is a static information site; it does not provide account creation, marketplace search, or payment checkout.

2. Information used by DealDrop

The current product and database inventory includes the following categories. The purpose and lifecycle below reflect the repository’s production data-governance runbook.

CategoryPurposeLifecycle in the current runbook
ProfilesAccount identity, email, display identity, and support context.Account lifetime; deleted through the account cascade.
WatchlistsSaved queries, filters, lifecycle state, and selected marketplace sources.Until watchlist or account deletion.
ListingsNormalized marketplace data used to match and display results.Inactive, unreferenced provider data after 180 days; referenced or active listings are protected.
MatchesUser-specific match history and notification source.Until watchlist or account deletion.
NotificationsIn-app alert history and delivery state.Read records after 90 days; unread records after 365 days, subject to the runbook safeguards.
Push tokensDevice delivery token for opted-in notifications.Active while seen; inactive tokens after 180 days.
Price observationsHistorical prices used for trend and price-drop calculations.Older than 365 days only when the listing has no match or favorite reference.
Match feedbackRelevance feedback attached to a user’s match.730 days, or earlier when the match/account is deleted.
Product eventsPrivacy-minimized lifecycle events and weekly-summary inputs.365 days; properties must remain event-scoped and non-sensitive.
Listing problem reportsStructured support reports for broken or incorrect listing data.Open/reviewed reports remain until resolved; resolved/dismissed reports after 730 days.

3. Marketplace data

DealDrop’s current adapter catalog includes eBay, Etsy, and Rakuten Ichiba. The app may only use sources that are enabled and configured for the relevant environment. Marketplace availability, permitted display fields, currency, condition, location, freshness, filters, and deep-link behavior can vary by source and region. Marketplace provider terms and data-use requirements continue to apply.

4. Supabase

DealDrop uses Supabase for authentication and database services. The server uses a service-role credential only in the server process; it is not part of the mobile bundle or public website. User-facing access is scoped to the authenticated account and database access controls.

5. Notifications

If a user enables push notifications, DealDrop stores a push token and notification preferences so it can deliver relevant alerts. Quiet hours pause push delivery without removing alerts from in-app history. A user can change notification settings in the app.

6. Premium access and RevenueCat

Premium access is checked through RevenueCat and the relevant Apple or Google store. DealDrop’s approved access model is a 7-day free trial followed by paid-only access; there is no free tier. Store products determine the available price, renewal period, and localized billing details. Billing is managed through the relevant store, and the app includes restore and subscription-management flows.

7. Account deletion

A signed-in user can use Profile → Delete account in the app. The current deletion function removes the profile and relies on the database cascade for user-owned records including watchlists, matches, notifications, push tokens, favorites, feedback, product events, and related reports. Marketplace listings are not user-owned; they are removed only when they have no match or favorite reference. Live-project deletion does not immediately erase historical backup images held within a provider’s backup window.

8. Support and reports

Listing problem reports use structured categories such as broken link, wrong price, stale listing, incorrect match, missing image, or other. The current report path stores the authenticated user ID, DealDrop listing ID, server-derived marketplace, optional validated match/watchlist IDs, app version, request ID, category, status, and timestamps. Reports do not need passwords, tokens, payment details, seller contact data, raw provider payloads, or authorization headers.

9. Contact and review items

The repository does not contain a confirmed public support address or legal entity details. Before this policy is published, the owner must supply the reviewed support destination, legal owner identity, effective date, and any required rights or jurisdiction disclosures.

Publication blocker: the items marked for owner confirmation must be completed and reviewed before this draft is connected to a production mobile build or presented as DealDrop’s final privacy policy.