Privacy Policy

1. Who is responsible

Thriftly is the controller for the personal data described here. You can reach us at support@thriftly.tools.

2. What we collect

Account data: your email address, your password in hashed form, and the language and theme preference you choose.

Subscription data: your plan, its status and its renewal date. Card details are handled by Stripe and never reach our servers.

Selling data: the listings, messages, offers and order information Thriftly reads from your Vinted session in order to run the automations you switch on, plus the photos you choose to store with us.

Usage data: counters of the Reposts, automated messages and Auto Offers you consume, so your plan allowance can be enforced.

Analytics data: for each page view, the page address, the site you arrived from, the country, region and city derived from your IP address, and your browser, operating system and device type. The address has workspace names, sign-in codes and payment references stripped from it first, and no identifier ties one page view to another beyond 24 hours.

Technical data: server logs containing request metadata and IP address, kept for security and troubleshooting.

3. Why we process it

To provide the service you signed up for, to bill you, to enforce plan allowances, to answer support requests, and to keep the service secure and working.

4. Legal bases

Performance of our contract with you (Article 6(1)(b) GDPR) for running and billing the service; our legitimate interest (Article 6(1)(f) GDPR) in security, abuse prevention, troubleshooting and counting how many people read each page; your consent (Article 6(1)(a) GDPR) where we ask for it.

5. Who we share it with

Supabase, which hosts our database and authentication. Stripe, which processes payments. Vercel, which hosts the website and counts page views for us. Sentry, which records the errors the website hits so we can fix them. These providers act as processors under contract and may not use your data for their own purposes.

We do not sell your data and we do not share it for advertising.

6. Your Vinted credentials

Thriftly never asks for your Vinted password. The extension works inside the Vinted session already open in your browser. Your Vinted login credentials are not sent to us and are not stored by us.

7. How long we keep it

Account and selling data are kept while your account exists. Deleting your account removes them, apart from records we must keep for tax or accounting law. Server logs are kept for a short retention period and then discarded.

Page views are kept as aggregate counts. The hash Vercel uses to recognise a visit is discarded after 24 hours, so there is nothing left that could be traced back to you.

8. Your rights

You have the right to access, correct, delete, restrict and port your data, and to object to processing based on legitimate interest. Write to support@thriftly.tools to exercise any of them.

You may also complain to a data protection supervisory authority in the country where you live or work.

9. Changes

We may update this policy. The current version is always published on this page with its date.