HeyElroy ("we", "us", "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy describes what data we collect, how we use it, how we protect it, and your rights regarding your information.
When you create an account, we collect your email address, display name, and profile photo as provided through Google Sign-In. We also store your Stripe customer ID and subscription details for billing purposes.
When you use HeyElroy to scan items, we collect the images you upload, AI-generated identification results, pricing analysis, comparable sales data, and listing content. Your scan data (images, results and listing content) is stored under your account while the account exists and is removed when you delete it; only an anonymous, structured copy of your listing details and your images, with no link to your account, are kept afterwards.
If you operate a storefront, we store buyer information (name, email, shipping address) as provided during checkout, solely for order fulfillment purposes.
We collect scan counts, feature usage patterns, and error telemetry to improve service reliability and performance. Error alerts in the app are automatically deleted after 60 days; the copy of an error event in our analytics warehouse is deleted after 180 days.
We collect your IP address for rate limiting and abuse prevention purposes. IP addresses are anonymized using one-way hashing before storage in our analytics systems and are not linked to your account profile or shared with third parties. Rate limiting records containing IP-derived identifiers are automatically deleted after 60 days.
All payment processing is handled entirely by Stripe. We do not store credit card numbers, bank account details, or other sensitive payment information. We store only Stripe reference IDs necessary to manage your subscription and transaction history.
HeyElroy maintains a strict separation between personal data and market intelligence data.
Personal data (your name and email, and your billing customer ID) is stored in your user profile and is fully under your control. You can delete your profile by deleting your account through the Settings page (a seller with a paid, unrefunded sale in the last 30 days must wait until 30 days after that sale; the Settings page shows the date).
Market intelligence data (pricing history, comparable sales data, and the anonymized listing details and images kept after an account is deleted) carries no account identity. Your own scan results and images are tied to your account while it exists and are removed from it when you delete the account. Since this change took effect, seller activity in our product-event, error-event, listing-generation, inventory-event and comparable-sales analytics tables is recorded under irreversible cryptographic hashes (SHA-256) of the account ID and listing ID, with no listing titles, brands, models, order IDs or other seller-typed text. Error events in the analytics warehouse hold only an alert type, a severity, a short code and counts, durations or status codes, never the message text (a new-account alert is a fixed line without the name or email). Analytics rows recorded before then may still contain the account ID, listing ID or order ID, item details (titles, brands, models, categories), search text or error messages that included text a person typed, and, in error events, the name and email of a new account, until they expire: 180 days for error events, 365 days for product-event and listing-generation rows, and up to 10 years for inventory-event and comparable-sales rows.
This separation means that once your account is deleted, the market data we keep cannot identify you. Two kinds of record are kept differently, as described under Deletion below: order and payment records needed for accounting, refunds and tax, and a buyer’s name and shipping address on any paid or still-pending order.
Product images you upload are retained to support ongoing services including item identification, authentication verification, market value tracking, pricing accuracy over time, and listing regeneration. Images are stored securely in cloud storage and are not shared publicly unless you choose to publish them to your storefront.
Upon account deletion, images are moved out of your account and kept as anonymous market data to support our authentication database, counterfeit detection systems, and market analytics. The original files you uploaded with scans are deleted; the processed images that are kept have camera and location metadata stripped, and their storage path and metadata no longer carry your user ID, so they are kept without any link to your account.
We use the following categories of third-party services to operate HeyElroy:
We do not sell your personal data. We share data only in the following circumstances:
You can view your account data, subscription details, and usage information through the Settings page at any time. You can also download a machine-readable copy of all your personal data (profile, inventory, orders, and messages) in JSON format from the Settings page.
You can delete your account through the Settings page. A seller with a paid sale in the last 30 days can delete their account 30 days after that sale, or sooner once those sales are refunded. This permanently removes your profile, your email and sign-in, your inventory and your storefront, your scan and listing records, and your contact messages (their name, email address and text are blanked; messages found only by your email address are included when that address is verified), the log of automatic replies we sent to your verified email address, and the storefront hold-limit counters that carry a one-way hash of it, and cancels your subscriptions. Order and payment records needed for accounting, refunds and tax (order amounts, dates, and the payment processor’s transaction and merchant-account references) are kept; the link to your HeyElroy account is removed. A minimal marker that the account ID was deleted (no other data) is kept so that nothing new can be added under it. Anonymized market data is retained as described in this policy. If you delete your account, your name and shipping address stay on any order of yours that is paid or still pending, until it is fully refunded or 30 days after payment (after checkout, for an order that was never paid), so the seller can ship it, and are then removed. Your email is replaced straight away. Orders are found by your verified email address; an order placed with an address that was never verified on your account is not matched.
If you made a purchase through a HeyElroy storefront and wish to have your personal data (name, email, shipping address) removed from our order records, you may submit a request through our Contact page. Select "Data Deletion Request" as the category.
You can update your display name and profile photo through your Google account settings, which will be reflected in HeyElroy on your next sign-in.
If you have concerns about how your data is used, please contact us through the Contact page.
| Data Type | Retention Period |
|---|---|
| Account profile | Until account deletion |
| Product images | Indefinite (anonymized on account deletion) |
| Scan and listing records | Until you delete your account, then deleted (an anonymized copy of structured listing details is kept indefinitely) |
| Comparable sales data | Indefinite (no personal data attached) |
| Storefront order data | Indefinite (buyer data deleted upon valid request; after an account deletion, the name and shipping address on any paid or still-pending order are kept until it is fully refunded or 30 days after payment (after checkout, for an order that was never paid), then removed) |
| Error telemetry | 60 days in the app, 180 days in the analytics warehouse (auto-deleted) |
| Analytics events | 365 days for product-event and listing-generation rows; up to 10 years for inventory-event and comparable-sales rows (hashed account and listing IDs and no seller-typed text or order IDs since this change took effect; older rows may contain account IDs, order IDs, item details and typed text) |
| Rollover credits | 90 days after subscription cancellation |
We implement industry-standard security measures including encrypted data transmission (TLS), secure authentication with cryptographic session validation, and role-based access controls. However, no system is completely secure, and we cannot guarantee absolute security of your data.
HeyElroy uses a single essential session cookie (__session) to maintain your authenticated session. This cookie is httpOnly, secure, and required for the service to function. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.
HeyElroy is not intended for use by anyone under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will take steps to delete that information promptly.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the service after any changes constitutes your acceptance of the updated policy.
For privacy inquiries, data access requests, or data deletion requests, please use our Contact page.