Privacy Policy

1. What We Collect

When you create an account and use EarlyBirdit, we collect the following information:

• Name and email address — provided when you sign up, used to identify your account and send you transactional emails.
• Password — stored as a secure one-way hash (bcrypt). We never store your plain-text password.
• Location (GPS) — collected only at the moment you tap "Check In" to verify you're at a sale. We do not track your location in the background, at any other time, or between sessions.
• Photos — images you upload when posting a sale listing or reporting a sign. Photos are stored securely in our database.
• Usage data — check-ins, sign reports, listings posted, and points earned. This powers your profile and the leaderboard.
• Device information — browser type and operating system, collected automatically by our hosting infrastructure for security and performance purposes.

2. How We Use Your Data

We use the information we collect solely to operate EarlyBirdit:

• To create and manage your account
• To display sale listings on the map and in the app
• To verify check-ins and award points
• To send transactional emails (password resets, notifications you opt into)
• To display your profile, points, and ranking on the leaderboard
• To moderate listings and maintain a safe community

We do not use your data for advertising, profiling, or any purpose outside of operating the EarlyBirdit app.

3. What We Don't Do

• We do not sell your personal data to any third party, ever.
• We do not track your location in the background. GPS is used only during the active check-in moment — not passively, not between sessions.
• We do not run ads or share data with ad networks.
• We do not share your email with any party other than our email delivery provider (SendGrid), which is used solely to send messages on our behalf.

4. Data Storage & Security

EarlyBirdit is hosted on Railway, a cloud infrastructure provider. Your data, including account information, photos, and activity history, is stored in a PostgreSQL database on Railway's infrastructure.

Photos you upload are stored as encoded data directly in our database — they are not uploaded to or shared with any external image hosting service.

We use HTTPS for all communication between your device and our servers. Authentication tokens are signed with a secret key and expire after 7 days.

5. Cookies & Local Storage

EarlyBirdit does not use tracking cookies. We use your browser's localStorage (and sessionStorage as a fallback) to store:

• Your authentication token, so you stay logged in across sessions
• Basic user profile information (name, points) for display purposes
• Your notification preferences
• App state such as dismissed announcements and game high scores

None of this data is transmitted to third parties. Clearing your browser's local storage will log you out of the app.

6. Third-Party Services

EarlyBirdit uses a small number of third-party services to operate:

• SendGrid — email delivery for transactional messages (password resets, opt-in notifications). Your email address is shared with SendGrid only to send messages you've requested.
• Railway — cloud hosting and database storage. Your data resides on Railway's servers.
• OpenStreetMap / Nominatim — map tiles and address geocoding. Address searches you perform may be sent to Nominatim's public API. No account information is included.
• Anthropic Claude API — used to read text from garage sale sign photos you submit. The photo is sent to Anthropic's API for processing and is not retained by Anthropic beyond the API call.

We do not use Google Analytics, Facebook Pixel, or any other advertising or analytics trackers.

7. Your Rights & Data Deletion

You have the right to access, correct, or delete your personal data at any time.

To request deletion of your account and all associated data — including your profile, check-in history, listings, sign reports, and photos — email us at support@earlybirdit.com. We will process your request within 30 days.

When you delete your account, all personal information is permanently removed. We retain a minimal anonymized record of your consent to our Terms of Service for legal compliance purposes. This record contains no personal information and cannot be used to identify you.

You may also update your profile information and notification preferences at any time from within the app.

8. Children's Privacy

EarlyBirdit is not intended for children under 13. We do not knowingly collect personal information from anyone under 13 years of age. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of EarlyBirdit after changes are posted constitutes your acceptance of the updated policy.