Privacy Policy

1. Contact and scope

This policy applies to GGLY Market. For privacy questions or requests, contact support.gridpoint.tech@gmail.com. Privacy rights and obligations may depend on your location.

2. Information we process

• Account and security data: username, password hash (not your readable passphrase), invite-code usage, hashed session token, session creation/expiry, and last-seen time.
• Connected account data: a third-party bearer token you choose to connect, encrypted before it is stored in the database and in an encrypted, HTTP-only browser cookie; connection validation status and related timestamps.
• Service state: subscription plan/status and provider identifiers if configured, plus per-account marketplace mutation pacing state used to enforce request intervals.
• Browser data: market snapshots in IndexedDB and market preferences, alerts, auto-auction settings, Buy Order preferences, and purchased-listing identifiers in local storage.
• Technical data: our hosting, database, and security providers may process request metadata such as IP address, device/browser details, timestamps, and error logs as part of operating and protecting the service.

3. How we use information

We use information to create and secure accounts; authenticate sessions; store and validate connected credentials; retrieve the market information you request; provide alerts, portfolio views, and marketplace actions; enforce request pacing; troubleshoot errors; prevent abuse; maintain the service; and meet legal obligations. We do not use your connected marketplace token for advertising.

4. Browser storage and cookies

The service uses an HTTP-only session cookie to keep you signed in and may use an encrypted HTTP-only cookie as a local cache for a connected marketplace credential. The app also stores settings and cached market data in your browser's local storage and IndexedDB. These browser records can remain on your device after you sign out. Use Account settings to clear supported local data, or clear site data in your browser. Clearing browser data does not delete server-side account records.

5. How information is shared

We share information only as needed to provide the service, protect users, or comply with law. This can include database and hosting providers acting for us; Giggles or another connected marketplace when your requested feature makes an API request using your credential; and authorities or other parties when legally required or reasonably necessary to protect rights, safety, or service integrity. Third parties process information under their own terms and privacy practices. We do not sell personal information as part of the current service.

6. Retention

We retain account and security records while an account remains active and for as long as reasonably needed for security, legal compliance, dispute resolution, and service operation. Session records expire after 30 days. Connected credentials are retained until you disconnect them or the account is deleted. Browser data remains until cleared by you or removed by your browser. Backups and provider logs may persist for limited periods under provider retention schedules. Contact support.gridpoint.tech@gmail.com to request account deletion; deletion may be subject to lawful retention requirements.

7. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict, or receive a copy of personal information, or to object to certain processing. Contact support.gridpoint.tech@gmail.com to make a request. You can disconnect your marketplace credential and clear supported browser data in Account settings. We do not currently provide self-service account deletion; a request may require verifying account ownership. You may also have the right to complain to your local privacy regulator.

8. Security and international processing

We use safeguards intended to protect information, including password hashing, hashed session tokens, and encryption for connected credentials. No system, transmission, or storage is completely secure. Hosting and database providers may process information in countries other than yours; where required, appropriate transfer safeguards must be put in place. Do not share your passphrase or connected token. If you believe a token is exposed, disconnect it and revoke it with the third-party provider.

9. Children

The service is not directed to children who cannot legally agree to the Terms of Service. We do not knowingly collect personal information from a child in violation of applicable law. If you believe a child has provided information, contact support.gridpoint.tech@gmail.com.

10. Changes and contact

We may update this policy by posting a new version and date. Where required, we will provide additional notice or request consent. Privacy questions or requests: support.gridpoint.tech@gmail.com. Last updated September 28, 2026.