Privacy Policy

What we collect

Accounts: your email address and a hashed password (never the password itself), whether you verified the email, for a shopper a username, and, if you add them, a name and a profile photo. Sign-in codes are stored hashed and stop working after 10 minutes. To stop guessing, wrong passwords are counted per account (five lock password sign-in until an emailed code unlocks it) and sign-in attempts per network address (IP) for 15 minutes; the network records are deleted after a day.

Claims: which listing you claimed, when, how many you took, and whether it was picked up, missed, or cancelled by the shop. The reviews you post and the XP you earn. Whether you opted in to the Sunday email, and when it was last sent.

Messages: what you send through the support form, with the email and name you give, and notes sent through the feedback form it replaced. A support message sent while signed in is linked to your account.

Shops: business name, type, username, phone number, opening hours and time zone, address, and the coordinates of that address, so the shop can be placed on a map and ranked by distance. All of it but the coordinates shows on the shop's public page.

Listings: whatever the shop types in, plus the photos it uploads.

Usage: when a listing is viewed, when its phone number is revealed, and when directions are opened. This is counted per listing, never per person, and only if you allowed optional cookies.

Your location

If you agree to it on the first screen, the browser asks for your position and we round it to roughly 100 meters (about 330 feet) before it is used. It is kept in a cookie on your device and read on each request purely to sort the feed by distance.

It is never written to our database, never attached to your account, and never shared. Decline, or clear the cookie from the preferences link in the footer, and the feed simply shows the newest listings instead.

Cookies

Essential — the sign-in session cookie (it lasts up to 300 days, renewed as you use the site, and ends when you log out), one the sign-in system uses to finish signing you in, a short-lived cookie tying this browser to a sign-in code while you enter it, a short-lived cookie remembering where you were headed when a page asked you to log in, and the preferences cookie holding the choices from the first screen. These cannot be switched off; without them the site cannot keep you signed in or remember your language.

Optional — if you allow them, we count which listings get opened, contacted and navigated to, so a shop can see how its stock is doing. The count is per listing, not per person. Decline and nothing is counted; everything else works exactly the same. Your answer is stored in the same preferences cookie and can be changed at any time from the footer.

Who else sees it

Our hosting, database, and photo storage providers process this data on our behalf so the site can run. Addresses typed during store signup are sent to OpenStreetMap's Nominatim service to turn them into coordinates. Map images are loaded from OpenStreetMap's servers, which see your network address, on every page that shows a map: the home page, the deals feed and each listing.

Your public profile (yallastock.shop/u/your-username) shows anyone your username, your photo if you added one, your name if you choose to show it, your level and XP, how many claims you picked up and didn't, and your claims and reviews with their dates. Which items and shops they were at shows only if you turn that on in your account. A review also appears on that shop's own pages, with your name. A shop sees the name of whoever claims its offers. Emails are sent through Resend: sign-in codes, and the Sunday email only if you turned it on.

We do not sell personal data and we do not run advertising networks on the site.

How long we keep it

Account and shop records last as long as the account does. Listings and their view counts are kept while they are useful to the shop. Delete your account from your account page and we remove the account, its profile, photo and XP. Your claims and reviews stay, with nothing linking them to you (a review shows as by “a former shopper”), so shops keep their history. For a shop, we remove its store, page and listings with their photos, and the claims and reviews made at it.

Support messages and old feedback notes are kept after that, without the link to your account, so we can follow up. Ask through the contact form and we delete them too.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to us through the contact form at yallastock.shop/support and we will answer within 30 days.

Children

The site is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If this policy changes, the date at the top changes with it, and the first screen is shown again when the change is material.