Privacy Policy

All Second Hand is a search engine that aggregates listings from multiple European second-hand marketplaces. We are based in Belgium and can be reached at [email protected].

• Account information: When you sign in via Google OAuth, we receive your email address and display name from Google. When you sign in via email magic link, we store your email address.
• Search queries and saved searches: Every search you perform and any search you save for automatic scanning.
• Notification preferences: The channels you choose to receive alerts on (Telegram, Discord, Slack, email, RSS) and associated identifiers (e.g. Telegram chat ID, Discord webhook URL).
• Technical data: IP address, browser User-Agent, and Accept-Language headers. These are used for rate limiting and abuse prevention. A partial browser fingerprint (hash of User-Agent and Accept-Language) is stored anonymously.
• Subscription data: If you subscribe to a paid plan, Stripe processes your payment and we store your Stripe customer ID and subscription ID. We never see or store your credit card details.
• Saved listings: Any listing you bookmark on the platform.
• Anonymous usage analytics: We run a self-hosted, cookieless analytics tool (Umami) that records aggregate page views, referring sites, and device types. It collects no personal data and sets no cookies.

All data we collect serves the core functionality of the service:

• Service delivery: To perform searches across platforms, run automatic scans, and send you alerts when new listings appear.
• Billing: To manage your subscription, process payments via Stripe, and track credit usage.
• Security and abuse prevention: IP addresses and browser fingerprints are used to enforce rate limits, prevent automated abuse, and detect multi-account activity.
• Improvement: Aggregated, anonymized usage patterns help us understand which platforms and features are most used.

• Contractual necessity: Processing your email, search queries, and notification preferences is necessary to provide the service you signed up for.
• Legitimate interest: IP addresses and browser fingerprints are processed under legitimate interest to protect the service from abuse and enforce fair-use limits.
• Consent: Our authentication cookies are strictly necessary for the service to function. Should we ever introduce non-essential cookies (e.g. analytics), we will ask for your explicit consent.

• Account data: Kept until you delete your account. You can delete your account and all associated data from your Settings page.
• Rate-limit and security counters: Automatically cleaned after 30 days of inactivity.
• Seen-listing tracker: Kept for the lifetime of your saved search. Stale entries (listings absent from results for 90 days) are automatically removed.
• Subscription records: Retained for the duration required by Belgian tax law (7 years for invoices).

We use the following third-party services to operate. Each receives only the data it needs to perform its function:

• Stripe— Payment processing. Stripe receives your email, payment method, and billing address. Stripe’s privacy policy: stripe.com/privacy
• Resend— Email delivery for sign-in links and alert notifications. Resend receives the recipient email address and message content. Resend’s privacy policy: resend.com/legal/privacy-policy
• Cloudflare— DNS, content delivery, and bot protection. Cloudflare may process your IP address as part of its security services, including Turnstile CAPTCHA challenges. Cloudflare’s privacy policy: cloudflare.com/privacypolicy
• Google— OAuth sign-in. When you use “Sign in with Google,” Google shares your email and display name with us. Google’s privacy policy: policies.google.com/privacy

We use the following strictly necessary cookies. None are used for advertising or tracking:

• Authentication session cookie (authjs.session-token) — Keeps you signed in. Expires when you close your browser (if you chose “keep me signed in,” it persists for 30 days).
• Anonymous session cookie (anon_searches) — Tracks daily search limits for users who are not signed in. HMAC-signed to prevent tampering. Expires after 24 hours.
• Local storage:Your selected platforms and display preferences are saved in your browser’s local storage. This data never leaves your device.
• Third-party cookies: Cloudflare Turnstile and Stripe Checkout may set their own strictly necessary cookies for security and fraud prevention.
• Analytics: Our self-hosted analytics (Umami) is cookieless — it does not set any cookies or store personal data, so no consent is required.

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Access: Request a copy of all data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Delete your account and all associated data via your Settings page or by contacting us.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Belgian Data Protection Authority.

We may update this policy from time to time. When we make material changes, we will notify you by email and update the “Last updated” date above. Continued use of the service after changes constitutes acceptance.

For any privacy-related questions or to exercise your rights, contact us at [email protected].