Privacy Policy

Who we are

Oddlot LLC, a Texas company in the United States, is responsible for your personal information. Contact us at support@oddlot.app.

Oddlot is currently offered in the United States.

Information you give us

Guest account: you can scan before you sign in. The app creates an anonymous account with a random identifier and no name or email, so your scans and items are saved. If you then sign in with Apple or email, the same account keeps them. If you sign in to an account you already had, we move the guest account's scans, items and photos into it and delete the guest account. You can delete a guest account in Settings like any other account.

Account: when you sign in with Apple, Apple shares a user identifier and, if you allow it, your name and email. The email can be a private relay address that Apple forwards to you. If you sign in with email instead, we keep your email address and send it one-time sign-in codes.

Photos and scans: the photos you take to identify an item, and any text, labels or barcodes read from them.

Your items: inventory, what you paid, listings, sales, fees, shipping and notes that you enter or that Oddlot drafts for you.

Support: whatever you send us when you contact us.

Information collected automatically

Usage and device: the scans you run, the results shown, app version, device model, operating system, language, time zone and an app user ID. Usage events and app error reports go to PostHog. This is on by default; turn it off any time in Settings, Share usage data.

Logs: our servers and providers record IP addresses, request times and errors so we can run and secure the Service.

Website: oddlot.app uses only cookies needed for the site to work, such as for sign-in and checkout.

Oddlot doesn't ask for access to your location and doesn't collect your precise location.

Information from others

Purchases: Apple, RevenueCat and Stripe tell us whether you have Pro, your plan, trial and renewal dates, the country of purchase and transaction IDs. We never receive your full card number. For web purchases, Stripe may share the card brand, last four digits, expiry date and billing postal code.

Connected marketplaces: if you connect a marketplace such as eBay, we receive an access token and the account and listing information needed to post and track your listings, including whether a listing sold and at what price. If you allow it, we also read your eBay orders for items Oddlot listed, to record the price the buyer paid, the quantity, the shipping charged and eBay's fee. We don't keep the buyer's name, username or address.

Your photos

Scan photos are uploaded to our servers to identify the item. When you add an item to Items, we keep its photos with it so you can see them later and use them in listings, until you delete the item or your account. Photos of scans you don't add to Items are deleted after 30 days.

To identify items and judge which marketplace listings match them, we send your photos, the item's name and listing titles, prices and photos to OpenAI through its API. Under OpenAI's API terms, it does not use this data to train its models. OpenAI may keep it for up to 30 days to check for abuse and then deletes it, unless the law requires otherwise.

To find matching listings, we send scan photos to eBay's image search.

To check which marketplace listings match your item, we also send a scan photo, the item's name and listing titles, prices and photos to TypeSafe through OpenRouter. We route these requests only to providers that don't train on or keep this data.

Please photograph items, not people. We don't use facial recognition or create biometric identifiers.

How we use information

To provide Oddlot: identify items, find comparable listings, estimate prices and profit, draft listings, sync your inventory across devices, and post listings you ask us to post.

To run subscriptions: check whether you have Pro, and handle trials, renewals and refunds, and keep tax and accounting records.

To support you: answer questions and send service messages such as receipts, account notices and policy changes.

To keep Oddlot safe: prevent fraud, abuse and security problems, and enforce our terms.

To improve Oddlot: fix bugs, understand which features are used and measure how accurate our identifications and estimates are, using aggregated or de-identified data where we can.

Sale prices: only if you choose Share when Oddlot asks (the first time you mark something sold or connect eBay), and until you answer nothing is shared. Then, when you mark an item sold, or an item Oddlot listed on eBay for you sells, we record the item, its condition, the sale price, date and marketplace, without your name, the buyer or the listing. Only sales confirmed through eBay feed other users' estimates, and only as rounded totals across at least 5 sellers, one sale each. Turn this off in Settings, Share sale prices; that also removes the prices you shared.

To meet legal requirements: comply with the law, respond to lawful requests and protect rights.

We don't use your information for advertising. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Oddlot's verdicts are suggestions, and you decide.

We send marketing emails only if you agree, and you can unsubscribe at any time.

Who we share it with

We share information only with service providers that help us run Oddlot, under contracts that limit how they can use it, and only what each one needs:

Supabase: database, sign-in and file storage, in the United States.

OpenAI: identifying items from photos and judging which listings match, using your photos and listing titles.

OpenRouter and TypeSafe: checking which listings match an item.

eBay: finding comparable listings. It receives item search terms and scan photos for its image search, never your name or email.

RevenueCat, Apple and Stripe: subscriptions and payments.

Vercel and our other cloud hosting and email providers: hosting oddlot.app and our servers, and handling support email.

PostHog (product analytics and error tracking, United States): in-app events such as a scan finishing (verdict, timing, scan type), an item added, a listing published, a sale recorded, the paywall shown, onboarding answers (where you sell, your minimum profit, where you heard about Oddlot), a rating prompt shown, and subscription events from RevenueCat (trial started, renewed, cancelled, refunded or expired); the names of a few screens without photos; and, when the app or our servers hit an error, the error message and stack trace. With these come the app version, device model, operating system and, from the app, your Oddlot user ID. We never send your photos, email, name, item titles, sign-in tokens or web addresses with their query strings, and we turn off IP-based location. Server error reports carry no user ID. Subscription events and the daily scan limit carry your Oddlot user ID only while Share usage data is on; with it off they are counted without any ID. In the app, turn this off any time in Settings, Share usage data.

Marketplaces you connect: when you ask us to post a listing, we send it to that marketplace, and its own privacy policy applies.

We may also share information to comply with the law or a valid legal request; to protect the rights, property or safety of our users, the public or Oddlot; or as part of a merger, acquisition, financing or sale of assets. In that case this policy keeps protecting it.

No selling, no sharing for ads

We don't sell your personal information and we don't share it for cross-context behavioral advertising, and we haven't done so in the past 12 months. We don't use advertising SDKs, and we don't track you across other companies' apps or websites.

If that ever changes, we will update this policy first, ask for consent where the law requires, and give you a way to opt out, including by honoring Global Privacy Control signals.

How long we keep it

Account and inventory data: while your account is open. You can delete individual items and scans in the app at any time.

After you delete your account: we delete your account, scans, photos and inventory from our live systems within 30 days. Backup copies are overwritten on a rolling basis within 30 days after that.

Purchase and tax records: as long as tax and accounting law requires, usually up to 7 years.

Server logs: up to 90 days, unless needed to investigate a security issue. Support emails: up to 2 years.

We may keep aggregated or de-identified data that can't identify you.

Security

We protect your information with encryption in transit, access controls and providers with strong security programs. Model and marketplace keys stay on our servers, not in the app.

No system is perfectly secure, so we can't guarantee security. If a breach affects your information, we will notify you as the law requires.

Your rights and choices

In the app, you can see and correct your items, export your items and sales as a spreadsheet file, and delete your account in Settings. Deleting your account doesn't cancel your subscription, so cancel it where you paid: your Apple ID settings, or the link in your receipt email for web purchases. You can also stop using Sign in with Apple with Oddlot in your Apple ID settings.

Depending on where you live, you may have the right to: know what personal information we hold and how we use it; get a copy in a portable format; correct it; delete it; and opt out of the sale of your data, targeted advertising and profiling with significant effects. We don't do any of those last three, but you can still ask.

To make a request, use Settings in the app or email support@oddlot.app from your account email. We will verify the request, usually by confirming it came from your account email, and respond within the time the law requires, usually 45 days. Where the law allows, an authorized agent can make a request for you. We may ask for proof of their authority.

We won't treat you differently for using your rights.

US state privacy rights

Residents of California, Texas, Colorado, Virginia, Connecticut, Oregon and other states with privacy laws have the rights above.

In the terms of California law: we collect identifiers (such as your Apple user ID and email), commercial information (your purchases and inventory), internet and app activity (usage and logs) and user content such as photos. We collect it from you, from your device and from the providers above, for the purposes described above, and we disclose it to the service providers listed above. We don't sell or share it, and we don't use sensitive personal information to infer characteristics about you.

Appeals: if we turn down your request, you can appeal by replying to our decision or by emailing support@oddlot.app with the subject Privacy Appeal. We will respond within 45 days and explain our decision. If you aren't satisfied, you can contact your state attorney general, such as the Texas Attorney General at texasattorneygeneral.gov.

Sensitive information

We don't ask for sensitive information such as health, biometric, precise location or government ID data, and we ask that you not include it in photos or notes. If a scan photo happens to show a person or a document, we use it only to identify the item.

Children

Oddlot is for adults 18 and older. We don't knowingly collect personal information from anyone under 18. If you believe a child has given us information, email us and we will delete it.

Changes to this policy

We may update this policy. We will post the new version here with a new date. If a change is material, we will tell you in the app or by email before it takes effect, and ask for your consent where the law requires.