Privacy Policy

1. In short

• We collect only what is needed to run the dashboard: your email, the cars you save and, if you use the Facebook features, demand numbers taken from your own Facebook Marketplace pages.
• We never collect your Facebook password, cookies, friends, private profile data, the full names of buyers or the text of your messages.
• We do not sell your data, do not show ads and do not use your data for anything except the features you use.

2. Account data

• Your email address. It is used to send one-time sign-in codes and to identify your account. Sign-in codes are stored only as one-way hashes and expire quickly.
• A sign-in cookie that keeps you logged in (httpOnly, same-site). We do not use advertising or analytics cookies.
• A personal API key that connects the extension to your account. Only its one-way hash is stored on our servers; the key itself is kept by the extension in your browser. A new key replaces the old one at any time (the old key stops working immediately).
• The days on which you used the dashboard (one record per day), used for aggregate usage statistics.

3. Your cars and notes

• Cars you save from CarMax Auctions and ADESA: photos, VIN, prices, mileage, options, location, the listing description and the AutoCheck data or report file for the car.
• What you add yourself: status, expenses and their notes, sold price and date, and your analysis settings.
• Results of the AI analysis and generated listing descriptions.

4. What the extension reads and sends

• On CarMax Auctions, ADESA and AutoCheck pages, only when you click to save a car: the details of that car.
• On the Facebook Marketplace listing form, only to fill in the fields with your car's data. Nothing is read from the form.
• On two pages of your own Facebook account, your Marketplace inbox and “Your listings”: for each listing it sends the listing title, the current price and the number of clicks; for each conversation it sends the listing title, the time of the last message, the initials of the person who wrote (for example “J.S.”) and a one-way hash of the conversation, used only to avoid counting it twice.
• It never sends full names, message text, Facebook passwords, cookies or session tokens, or anything from other Facebook pages.
• In your browser the extension keeps your dashboard address, its API key and the last list of cars it collected. This stays on your computer.

5. Why we use the data

• To show your cars, run the analysis you request, help you publish listings, and show how demand (conversations and clicks) changes when you change the price.
• We do not use it for advertising, profiling, or credit or lending decisions, and we do not sell it or pass it to data brokers.
• The use of information received from Facebook pages follows the Chrome Web Store User Data Policy, including its Limited Use requirements: it is used only to provide the demand features you asked for, it is not sold, it is not used for advertising, and people do not read it except when needed for security, to comply with the law, or with your consent.

6. Service providers

• Vercel hosts the website and its API.
• A managed PostgreSQL database stores the data.
• Resend sends the sign-in emails (it receives your email address and the code).
• Google Gemini API runs the AI features when you use them: analysis, expense totals, listing descriptions and photo editing. The car data or photos in that request are sent to Google for processing.
• These providers process data only on our behalf. The extension does not send your dashboard data to Facebook, CarMax, ADESA or AutoCheck, except the car details it types into your own Facebook listing form.

7. Retention and deletion

• Data is kept until you delete it. Deleting a car also deletes its price history, click history and conversation records.
• To delete your account and all your data, write to us at the address below.
• Removing the extension deletes the data it keeps in your browser. It does not delete your account on the dashboard.

8. Security

• All traffic uses HTTPS. Sign-in codes and API keys are stored as hashes. Each account can only see its own data.

9. Facebook's rules

• The extension reads only your own Marketplace pages while you are logged in. Facebook's terms limit automated access to its pages, so you use this feature at your own risk. You can stop at any time by turning off or removing the extension.

10. Children

• The dashboard is not intended for anyone under 18.

11. Changes to this policy

• If we change this policy, we update the date at the top. Significant changes are announced in the dashboard.

12. Contact

Questions or a request to delete your data: use the contact address of the person who gave you access to this dashboard.