Privacy Policy
AuctionHelper — last updated 2026-05-08
What we collect
When you create an account, we store your email address and a one-way bcrypt hash of your password — your password itself is never stored in plain text and cannot be recovered, only reset.
When you sign in, we record the session: a one-time token, the time of sign-in, the time of last activity, the IP address, and the browser user-agent. This is used solely to keep you signed in and to let you review your active session on your account page.
When you connect a marketplace account (eBay, etc.), we store the OAuth tokens issued by that marketplace, encrypted at rest. We never see or store your marketplace password.
Inventory and listing content you create within the app is stored on our servers so you can manage it across sessions and devices.
What we don't do
We do not sell, rent, or share your personal data with any third party other than the marketplaces you choose to connect. We do not run advertising trackers, analytics that profile you across the web, or session-replay tools.
Cloudflare Turnstile is loaded on our sign-in / register / password-reset pages to verify you're not a bot. Turnstile is privacy-preserving by design and does not track users across sites.
Cookies
We set two cookies: an authentication cookie that keeps you signed in (HttpOnly, Secure, SameSite=Lax) and a CSRF protection cookie. Both are strictly necessary for the app to function. We do not use tracking cookies.
Data retention & deletion
Active session records are retained while you're signed in and for a short period after expiry for audit purposes. Brute-force protection records (rate-limit attempts) are stored as one-way hashes of IP and email and pruned after 24 hours.
To delete your account and all associated data, use the account-deletion option on your account page or email noreply@ah2.jerryland.com. We will delete your data within 30 days of the request.
Contact
Questions? Email noreply@ah2.jerryland.com.