Legal

Privacy Policy

Last Updated: May 26, 2025 · Effective Date: May 26, 2025

1. Introduction

Welcome to Lots & Found (“we,” “our,” or “us”). Lots & Found is a personal collectibles cataloguing application that lets you organise items into named Lots, track condition and professional grading, monitor market prices, and identify items using AI.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your data when you use the Lots & Found mobile application and related services (the “Service”).

By creating an account and using Lots & Found, you agree to the practices described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account we collect:

  • Email address — used to identify your account and for service communications.
  • Password — stored as a one-way hash by our authentication provider (Supabase Auth). We never see or store your password in plain text.
  • Profile photo (optional) — if you choose to upload one.
  • Notification preferences — push notifications, product updates, collection insights, and promotional email preferences.

2.2 Your Collection Data

Lots & Found is built around cataloguing your collection. The following data is stored against your account when you use the Service:

  • Lots: name, description, optional cover photo, timestamps.
  • Items: name, photos, category, year made, year acquired, cost to acquire, condition, grading information (company, grade, certification number), notes, and category-specific fields including:
    • Trading Cards: set/series, card number, sport or game, autograph details
    • Vinyl Records: artist, album, sleeve condition
    • Lego: set number
    • Other categories: relevant fields per the in-app form
  • Item-to-lot relationships: which lots each item belongs to.
  • AI summaries: generated descriptions saved against your items.
  • Market price data: pricing snapshots returned by external sources and stored against your items.

All collection data is private to you by default. Lots & Found does not currently offer public profiles, social sharing, trading, or marketplace features. Your data is protected by per-user Row Level Security in our database — no other user can access your lots, items, or photos.

2.3 Subscription and Usage Data

  • Subscription tier (Free, Pro, Collector) and billing-period anchor.
  • Scan usage counts — number of AI scans performed in the current billing period, used to enforce monthly scan limits.
  • Payment information — handled entirely by Apple App Store and Google Play Store for in-app subscriptions. We do not receive or store your payment card details; we receive only a confirmation of subscription status.

2.4 Information Collected Automatically

  • Device and app information: operating system, OS version, app version, device model, and language.
  • Diagnostic and crash data: error logs and crash reports used to fix bugs and improve stability.
  • Service logs: IP address, request timestamps, and basic usage metadata recorded by our infrastructure providers for security and reliability.

Lots & Found does not collect your precise location or use location-tracking features.

3. How We Use Your Information

We use your information to:

  • Provide, operate, and sync your collection across the devices you sign in on.
  • Identify items via AI scanning when you submit photos through the Scan feature.
  • Generate AI-written summaries when you request them.
  • Fetch and display market pricing when you request it.
  • Enforce subscription limits (e.g. 10 scans per month on Free, 100 on Pro, 500 on Collector).
  • Send service-related emails (account confirmations, security notices, billing).
  • Send product updates, collection insights, and promotional emails only if you've opted in to each category.
  • Diagnose problems, prevent abuse, and improve the Service.
  • Comply with legal obligations and platform requirements (Apple, Google, eBay).

4. Third-Party Services We Use

Lots & Found relies on the following third-party services to function. Each receives only the data necessary to perform its role:

Supabase (database, authentication, storage)

Hosts your account, your collection data, and your photos. Supabase Privacy Policy.

Anthropic Claude (AI scanning and summaries)

When you use the Scan feature, the photo you submit is sent to Anthropic's Claude API for identification. When you generate an AI Summary, your item details (name, year, condition, grading, cost, notes) are sent to Claude. Anthropic processes this data to produce a response and, per its API terms, does not train models on data submitted via the API. Anthropic Privacy Policy.

eBay Browse API (market pricing)

When you tap Get Market Prices or Refresh on an item, item details (name, set, year, grading, and other catalog fields) are sent to eBay as a search query. eBay returns listing prices which we store against your item. We do not send your account email, personal information, or your photo to eBay. We comply with eBay's marketplace account-deletion requirements via a dedicated compliance endpoint. eBay Privacy Notice.

Discogs API (vinyl pricing)

For Vinyl Record items, item details are sent to Discogs to retrieve marketplace pricing. No personal information is included. Discogs Privacy Policy.

Expo / EAS (build and delivery)

The app is built and delivered through Expo Application Services. Expo may collect basic device and crash diagnostics. Expo Privacy Policy.

Apple App Store and Google Play Store

In-app subscriptions are processed entirely by Apple or Google depending on your platform. Refer to their respective privacy policies for how they handle your purchase data.

External grading-company websites

When you tap Look Up on a graded item's certification number, the Service opens the relevant grading company's verification page in your device's browser (PSA, BGS, CGC, PCGS, NGC, VMG, etc.). At that point you are no longer using Lots & Found and your interaction with those sites is governed by their own privacy policies.

5. How We Share Your Information

We do not sell your personal information, and we do not share it with advertisers.

We share information only:

  • With the service providers listed in Section 4, strictly to deliver the Service.
  • For legal reasons — if required to comply with a subpoena, court order, or other legal obligation, or to protect the rights, safety, and property of users or the public.
  • In the event of a business transfer — if Lots & Found is involved in a merger, acquisition, or sale of assets, we will notify you before your information becomes subject to a different privacy policy.

Your collection data is never shared with other Lots & Found users. There are no public profiles or shared lots in the Service.

6. Your Photos

Photos you upload are stored in our private Supabase Storage bucket. Photos use a URL-based access model — they are not listed or browseable publicly, but anyone with the exact direct URL could view a specific photo. We do not publish, share, or surface your photos to other users.

Photos submitted to the Scan feature are also transmitted to Anthropic for AI identification, as described in Section 4.

Supported formats: JPEG, PNG, WebP, HEIC. Maximum size: 10MB per photo.

7. Data Retention

We retain your information for as long as your account is active.

If you delete your account:

  • Your account, lots, items, photos, and AI summaries are deleted within 30 days.
  • Backups containing your data are purged within 90 days.
  • Limited records may be retained where required for legal, accounting, or fraud-prevention purposes (e.g. subscription transaction history).

Deleting the app from your device does not delete your account or data. Sign in on any device to access your collection again.

8. Your Rights

Depending on where you live, you may have the following rights over your personal information:

  • Access — request a copy of the data we hold about you.
  • Correction — ask us to fix inaccurate information.
  • Deletion — request deletion of your account and data. You can do this in the app via Profile → Delete Account, or by emailing us.
  • Portability — receive your data in a machine-readable format.
  • Objection / restriction — limit or object to certain processing.
  • Withdraw consent — at any time, where processing is based on consent (e.g. marketing emails — use the unsubscribe link or in-app email preferences).
  • Right to lodge a complaint — with your local data protection authority (EU/UK users).

For US residents, additional rights may apply under state laws including the California Consumer Privacy Act (CCPA/CPRA). We do not sell or share personal information for cross-context behavioural advertising.

To exercise any right, email us at privacy@lotsandfound.app.

9. Legal Bases for Processing (EU/UK Users)

If you are in the EEA, UK, or Switzerland, we process your personal data on the following bases:

  • Contract — to deliver the Service you've signed up for.
  • Legitimate interests — to operate, secure, and improve the Service, prevent abuse, and enforce our Terms.
  • Consent — for marketing emails and certain optional features. You can withdraw consent at any time.
  • Legal obligation — to comply with applicable laws.

10. Data Security

We use industry-standard safeguards to protect your information:

  • Transport encryption — all data is transmitted over TLS.
  • At-rest encryption — provided by Supabase for databases and storage.
  • Password hashing — handled by Supabase Auth; we never store plaintext passwords.
  • Row Level Security — strict per-user access controls at the database layer prevent one user from reading another user's data.
  • Limited internal access — only essential personnel can access production systems, under audit.

No system can be guaranteed completely secure. If we become aware of a breach affecting your personal data, we will notify you and the appropriate authorities as required by law.

11. International Data Transfers

Your data may be processed in the United States and other countries where our service providers operate, including the locations of Supabase, Anthropic, and eBay. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

12. Children's Privacy

Lots & Found is not directed to children under 13 (or under 16 in the EU/UK). We do not knowingly collect personal information from children under these ages. If you believe a child has provided us with personal information, contact us at privacy@lotsandfound.app and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email at least 30 days before the changes take effect. The “Last Updated” date at the top of this policy reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information:

EU/UK users have the right to lodge a complaint with their local data protection authority.

This policy should be reviewed by qualified legal counsel before publication, particularly to confirm compliance with App Store / Play Store privacy disclosure requirements, GDPR, CCPA/CPRA, COPPA, and any other regulations applicable to your user base.