Privacy and your data, in plain English

Most people accept privacy policies they haven't read because the alternative is not using the site. The boxes get checked, the wall of legalese gets scrolled past, and the implicit deal is that something happens with your data that you'll never quite know the shape of. There's a real legal page at /privacy with the full policy. This guide is the plain-English one. Same information, none of the legal noise, with two reference visuals up front so you can see the shape of the data flow before reading the prose.

The lifecycle of a single upload

From the moment a photo leaves your browser to the moment it's deleted from our storage, here's every stop on the way:

Every place your data brushes a third party

Three crossings happen, no others. Each one's purpose, what crosses, and what stays:

What we collect, in plain words

No account. No email. No name. No phone number. No credit card. There's no signup form because there's nothing to sign into.

What does flow through icandothat is the stuff you give the tool to do its job: the photos you upload, the descriptions you type in, the condition and damage notes you add, the platform you tell it you're selling on. All of that runs through the temporary session shown in the lifecycle visual above. The session ID is not you. It's a string of characters tied to your browser tab for the duration of your visit.

Because there's no account, there's no behavioral profile getting built across visits. The next time you come back, you're a fresh anonymous session with no link to the last one. That's the structural privacy this design buys you. Optional sign-in may show up later as a user benefit (saving favorites, tracking sales over time), but it would never be required to use the tool.

Why we keep inputs for six months at all

The retention window is the part most sites don't name out loud. We save your inputs (the photos, the descriptions, the notes) for up to six months, after which they're deleted by the lifecycle rule shown above. During that window, we use them for one purpose: improving our own tools. Better identification on the next person's photo, better pricing logic, better listing drafts. That's the bargain, and it's the same bargain every AI tool is making; the difference is naming it instead of burying it in legal language.

The retained data lives on our storage tied to the anonymous session ID, not to you. We don't share it with anyone outside the AI providers already in the request loop, and we don't sell it. There is no account to attach it to, so there is no "your data" set to look up. Structurally, the link between the inputs and a person doesn't exist.

What never crosses, regardless of consent setting

How GDPR and CCPA fit, in one paragraph each

The headline regulatory rights apply, and the structural privacy of the no-account design changes how each one looks in practice. Worth naming so the answer is complete:

• GDPR (EU residents). The right to access, the right to rectification, and the right to erasure all assume an identifiable record about you. There isn't one. The retained inputs from your session are anonymous and bound to a session ID that has no link to your identity, so an erasure request has nothing to look up. The retention window itself is finite (six months) and runs without a request. If you want a session deleted before then, closing the tab and not returning lets the session ID expire naturally; we have no record that the session was yours.
• CCPA (California residents). The right to know what is collected: that's this page, the lifecycle visual above, and the three crossings below. The right to opt out of sale: not applicable, since nothing is sold to anyone. The right to non-discrimination for exercising rights: same answer, since there are no rights-exercise mechanics that could be discriminated against.

When the rule changes, here's how you'd know

A few honest exceptions are worth naming. Input retention for system improvement is real retention: the photos and descriptions sit on our storage for up to six months. They're anonymous and session-bound, but they exist on a server that isn't your browser. We don't currently run any first-party analytics or product-usage rollups; if that changes, this page changes with it.

The privacy commitment isn't a static promise; it's a posture, and if the posture changes, you'll see it: a banner update, a dated changelog on this page, and the same plain language we used to set it up. The dated commitment matters more than the values writeup, because values can drift quietly and dated commitments can't.

If you want the rest of the values picture (the non-negotiables we hold to, why they matter, and the trade-offs that come with them), the next read is free, no-login, no-tracking, and why.