This Privacy Policy explains what data ListBuddy collects, how we use it, and your rights. It applies to the ListBuddy web app at app.listbuddy.org, the ListBuddy Chrome extension, the API at api.listbuddy.org, and this site.
ListBuddy is operated by Karl Bordt, sole proprietor, in Fairfield, New Jersey, United States. Contact: support@listbuddy.org.
When you sign up: your email address and a password (stored as a one-way hash, never in plaintext). Used to authenticate you.
When you connect your eBay seller account, eBay issues us OAuth tokens (an access token and a refresh token). These let us read your listings, orders, and account standing, and place/update listings on your behalf. We store these tokens encrypted at rest on our servers using AES-256-GCM with a key only the server can read. You can disconnect eBay at any time from the in-app Settings page, which revokes the tokens.
We never see or store your eBay password. We do not share eBay tokens with any third party.
When the ListBuddy Chrome extension is signed in to your ListBuddy account, it visits Amazon product pages in your browser to read product data (title, price, image, availability) for items in your sourcing queue. The extension uses your existing Amazon browser session. It does not store your Amazon credentials and never sees your Amazon password. The product data the extension reads is sent to our server and stored in your account.
Once your eBay is connected, we store metadata about your listings (title, price, quantity, status), incoming orders (order ID, buyer ZIP for fulfillment, sale price), and aggregated statistics. We store this on our servers so the app can show it to you and run the background jobs (price sync, autolist, cleanup).
Payments are processed by Stripe, Inc. Your card number is never sent to or stored by ListBuddy. Stripe handles it directly. We store the Stripe customer ID and subscription ID returned by Stripe, plus the tier, status, trial dates, and billing period.
When you email support, opt in to Telegram notifications, or use the in-app message templates feature, we store the contents to provide the service.
We use a single HTTP-only session cookie to keep you signed in. Server logs record your IP address, user agent, and request path for debugging and abuse-prevention. Logs are retained for up to 30 days unless required longer for a specific incident or legal matter.
When you use Auto List or single-product listing, we send the source product's title, description, attributes, and category to Google's Gemini API to generate the eBay listing copy (title, description, item specifics). The Amazon source data is sent in real time and is not used by Google to train its models (per Google's Gemini API terms for paid usage). Generated listing content is then shown to you for review before being published to eBay. You can disable AI-generated content in Settings if you prefer to write listings manually.
ListBuddy is a small operation. We share data only with the service providers we need to run the Service:
We do not sell your data. We do not share your data with advertisers. We do not let third parties run their tracking code on our app.
Servers are in the United States (Hetzner Cloud, Hillsboro, Oregon). All data in transit uses HTTPS. The application database is on the server's local SSD, encrypted at the filesystem level. Backups are encrypted in transit and at rest.
We keep account data for as long as you have an active account, plus up to 12 months after closure for tax/audit purposes. After that we delete or anonymize it. You can request earlier deletion (Section 7).
Lawful basis for processing. We process the data described above on the bases of (a) performance of a contract with you (operating the Service you signed up for), (b) legitimate interests in running, securing, and improving the Service (debugging, abuse prevention, and core analytics), and (c) compliance with legal obligations (tax records, fraud reporting). Where required by law, we rely on your consent for any other use and you may withdraw it at any time.
You can:
Send any of those requests to support@listbuddy.org. We'll respond within 30 days.
The Service is not directed to anyone under 18. We do not knowingly collect data from minors.
We use industry-standard practices: HTTPS everywhere, password hashing with scrypt, encryption-at-rest for sensitive tokens, scoped database access, principle-of-least-privilege for service accounts. No system is perfectly secure, but we try to be. Report security issues to support@listbuddy.org.
If we materially change how the Service handles data, we'll update this page and the "Last updated" date and notify active customers by email at least 14 days before the change takes effect.
Questions or requests: support@listbuddy.org