Privacy Policy

Obistrip helps sellers keep their own Discogs and eBay inventory in sync. This policy explains the personal data we collect or may process as the service grows, why we use it, who we share it with, and how you can ask us to export or delete it.

1. Data we collect

• Account data: your email address, email verification status, theme preference, sync cadence, and account settings.
• Marketplace connection data: OAuth tokens, refresh tokens, connection status, marketplace user IDs, usernames, granted scopes, consent history, OAuth callback records, and sync timestamps for the Discogs or eBay accounts you connect.
• Inventory, listing, and seller setup data: cached Discogs inventory, cached eBay listings, item matches, draft listings, listing titles, descriptions, images or image URLs, SKUs, offer IDs, prices, quantities, conditions, categories, item specifics, business policies, merchant locations, shipping, payment, return, and fulfillment settings, pricing rules, condition mappings, sync freezes, and deferred write records.
• Order and sold-item data: order IDs, sold-item signals, cancellation or refund status, fulfillment status, shipment or tracking metadata, and account-deletion or closure notices when a connected marketplace provides those records and they are needed to operate or comply with the service.
• Activity records: audit log entries, sync events, failed job records, consent records, and other operational records needed to show what Obistrip did on your behalf, investigate errors, prove authorization, or respond to platform compliance questions.
• Email-related data: magic-link sign-in tokens, notification preferences, and transactional email delivery data.
• Cookies and technical data: session cookies, temporary OAuth cookies, theme cookies, request metadata, diagnostics, IP address, user agent, device and browser information, error information, security logs, and feature-flag or product-usage events.

2. Why we use it

We use this data to sign you in, connect your marketplace accounts, keep inventory, price, quantity, offer, and listing status in sync, create and publish listing drafts you approve, detect sold items, prevent unsafe automation or oversells, pause or disconnect risky integrations, show an audit trail, send service emails, comply with marketplace account-deletion requirements, investigate errors, answer support requests, respond to data-rights requests, and document our compliance posture to connected platforms.

Obistrip uses marketplace data only for the seller account that connected it, unless you explicitly ask us to share information with a service provider or platform for support, security, compliance, or dispute-resolution purposes.

3. Who we share it with

• Discogs and eBay: when needed to read or update your own marketplace account, carry sync data between your connected accounts, process account-deletion or closure notices, or resolve platform compliance, security, or support issues.
• Resend: to send magic links and service emails.
• Cloudflare and our hosting providers: to route, secure, host, and operate the service.
• PostHog, if enabled and you consent: for product analytics and feature flags. Analytics cookies and masked session replay start only after you accept the in-app analytics banner, and you can withdraw that choice any time from Settings / Data & Privacy. We avoid sending marketplace listing contents as event properties.
• Sentry, if enabled: for error monitoring, performance diagnostics, and masked session replay when replay is turned on.
• Internal development and operations tools: including project management, code review, security, support, and AI-assisted tools used to review code, tickets, error reports, and operational issues. We limit the information sent to these tools to what is needed for that purpose.
• Email providers: for messages you send to our support, privacy, or legal mailboxes.

We do not sell your personal data. We do not use your inventory data to train AI models, build customer-facing AI features, or create cross-seller marketplace analytics. We will not add those uses unless we update this policy first and, where needed, obtain any platform permission or user consent required for the new use.

4. Payments

Paid subscriptions are processed by Stripe. Card details never touch Obistrip — checkout and payment-method management happen on Stripe-hosted pages. Stripe is the system of record for payments: it retains transaction, invoice, and tax records for the periods required by law, under its own privacy policy. Obistrip keeps a minimal projection of your subscription state (plan, status, period end) plus the raw Stripe webhook events for that projection; when your account is deleted, that internal projection is deleted with it, while Stripe retains the legally required payment records on its side.

5. How long we keep data

We keep account, connection, inventory, draft, sync, consent, and audit data for as long as your account is active or as long as needed to provide the service, meet marketplace requirements, investigate disputes, protect connected accounts, or preserve a security/compliance record. Some short-lived data, such as magic-link tokens and temporary OAuth cookies, expires automatically. Some cached marketplace data is refreshed or pruned by background jobs.

If you request account deletion, Obistrip starts a 7-day grace period. After that, the deletion job hard-deletes your account and account-scoped data — including photos you uploaded to our object storage — except for limited records we are required or allowed to keep for security, legal, dispute, or abuse prevention reasons (payment records stay with Stripe as described in section 4; hard-bounce suppression entries for an email address outlive the account so we never mail a dead address again). When a platform account-deletion or closure notice applies to only one connected marketplace account, we delete the platform-scoped data required by that platform even if your Obistrip account remains open.

Some operational records age out automatically: the client IP address and browser details captured with an OAuth consent acknowledgement are redacted after 90 days (the consent record itself is kept). Your in-app activity log is never auto-pruned — you control its retention with the delete controls on the activity page.

6. Export and deletion

You can request a JSON export of your account data from Settings / Data & Privacy. OAuth access tokens and refresh tokens are not included in exports. Consent versions and consent text hashes are included so you can see what authorization records exist without exposing your secret tokens.

You can also request account deletion from the same settings page. If a connected platform sends us an account-deletion notification, we process the notification according to that platform's requirements and delete the relevant connected-platform data.

7. Security

OAuth tokens are encrypted at rest. We use session controls, rate limits, endpoint allowlists, audit logging, and sync pause controls to reduce the risk of accidental or unauthorized automation. No service can guarantee perfect security, but we design Obistrip to avoid storing more sensitive data than it needs.

8. Your choices

You can disconnect marketplaces, pause sync, change notification preferences, export your data, or request account deletion from the app. You can also revoke Obistrip from Discogs or eBay directly; if you do, sync may stop until you reconnect. You can contact us to ask for access, correction, deletion, restriction, portability, or objection where those rights apply.

9. Marketplace independence

Obistrip is an independent service. This application uses Discogs' API but is not affiliated with, sponsored, or endorsed by Discogs. Obistrip is also not affiliated with, sponsored, or endorsed by eBay.

10. Contact

Privacy inquiries: privacy@obistrip.app. General inquiries: support@obistrip.app.