Privacy Policy

1. Who is responsible

The controller for the personal data described here is Martin Broder, Küstriner Str. 28, 13055 Berlin. You can reach us at support@thriftly.tools.

2. What we collect

Account data: your email address, your password in hashed form, and the language and theme preference you choose.

Subscription data: your plan, its status and its renewal date. Card details are handled by Stripe and never reach our servers.

Selling data: the listings, messages, offers and order information Thriftly reads from your Vinted session in order to run the automations you switch on, plus the photos you choose to store with us.

AI generation data: when you confirm a quote in Listing Generation, the photos of that one item, its confirmed Vinted category, the listing language and the text template constraints you applied. Your account, your prices and anything about your other items are not sent.

Usage data: counters of the Reposts, automated messages and Auto-Offers you consume, so your plan allowance can be enforced.

Analytics data: for each page view, the page address, the site you arrived from, the country derived from your IP address, your browser, operating system and device type, and how quickly the page loaded. Pages whose address would name a workspace or carry a sign-in code or payment reference are not counted at all, and no identifier ties one page view to another.

Technical data: server logs containing request metadata and IP address, kept for security and troubleshooting.

Error reports: when the website hits an error, and for a sample of requests, Sentry receives a report with the error, where in our code it happened and the values our code held there, the page address, your IP address, browser and device, and the request's address, headers, cookies and body. Header, cookie and address values named as passwords, tokens, keys or sign-in sessions are removed before the report leaves; the request body is sent as it is.

3. Why we process it

To provide the service you signed up for, to bill you, to enforce plan allowances, to answer support requests, and to keep the service secure and working.

4. Legal bases

Performance of our contract with you (Article 6(1)(b) GDPR) for running and billing the service; our legitimate interest (Article 6(1)(f) GDPR) in security, abuse prevention, troubleshooting and counting how many people read each page; your consent (Article 6(1)(a) GDPR) where we ask for it.

5. Who we share it with

Supabase, which hosts our database and authentication. Stripe, which processes payments. Cloudflare, which hosts the website and counts page views for us. Sentry, which records the errors the website hits so we can fix them. OpenAI, which writes the listing titles and descriptions you pay AI Credits for. It receives only the data named under AI generation data, and we ask it not to retain the request. These providers act as processors under contract and may not use your data for their own purposes.

We do not sell your data and we do not share it for advertising.

6. Your Vinted credentials

Thriftly never asks for your Vinted password. The extension works inside the Vinted session already open in your browser. Your Vinted login credentials are not sent to us and are not stored by us.

7. Likeback and other sellers

If you switch on Likeback, Thriftly performs Favorites across accounts for the mutual benefit of the participants: it Favorites other participants’ Vinted Items from your connected Vinted account, and other participants’ sessions Favorite yours. To coordinate, pace and balance that exchange we store your participation, the disclosure version you accepted, the Vinted item identifiers you currently offer and the Favorites that were made.

People whose Items you Favorite can see your Vinted profile as Vinted shows it, exactly as they would for a Favorite you made yourself. We never disclose your Thriftly account, your email address or your workspace to another participant, and we show you no roster, participant count or activity of anyone else.

Your participation record, the disclosure evidence and your exchange totals are kept while the Vinted connection exists; exchange detail is removed after ninety days. Deleting the workspace or its Vinted connection deletes the participation record. What remains is the fact that one seller identity was already pointed at one Vinted Item, which carries no account or workspace and is what stops the same Item being Favorited twice.

8. How long we keep it

Account and selling data are kept while your account exists. Deleting your account removes them, apart from records we must keep for tax or accounting law. Server logs are kept for a short retention period and then discarded.

Listing Generation photos and answers are kept for seven days after your last change, or thirty days once you have paid to generate text, and are then deleted. Where your Photo Storage allows it, the photos of an item Vinted accepts are kept as that item's base photos, with your selling data, instead of being deleted.

Page views are kept as aggregate counts. Cloudflare recognises a visit from the page you came from rather than from anything about you, so there is nothing that could be traced back to you.

9. Your rights

You have the right to access, correct, delete, restrict and port your data, and to object to processing based on legitimate interest. Write to support@thriftly.tools to exercise any of them.

You may also complain to a data protection supervisory authority in the country where you live or work.

10. Changes

We may update this policy. The current version is always published on this page with its date.