Privacy policy
Last updated 2026-09-17.
Who is responsible
Calacy, in Sweden, is the data controller for everything described here. Questions, requests and complaints: [email protected].
What we store, and why
- Your email address and a password hash. Needed to give you an account and let you log back into it. The password itself is never stored — only a bcrypt hash, which cannot be turned back into the password.
- Your searches and their results. The brands, sizes, prices and keywords you watch, and the listings that matched. This is the service itself. Results are kept for as long as your plan's history window says, then deleted.
- Your alert destinations. A Discord or Telegram webhook, or your own URL. Stored encrypted; the dashboard only ever shows you the last few characters.
- A marketplace session, if you connect one. Optional, and only if you turn on auto-buy or auto-accounting. The session cookies are encrypted with AES-256-GCM before they are written down, are never shown back to you, never logged, and are used only to act on the marketplace as you asked. Disconnecting the account deletes them.
- Billing state. Your plan, its status, the period end, and the customer and subscription ids that Stripe gives us. Card numbers never reach our servers — Stripe handles the payment and we only see whether it succeeded.
- Accounting entries, if you use auto-accounting. Purchases, sales, fees and shipping costs, plus the tax country and basis you picked, so the figures follow the right rules.
- Technical logs. Request paths, timing, error messages and the IP address a request came from, kept short-term to find faults and to stop abuse. Credentials and cookie jars are excluded from logs by design.
Legal basis
Your account, your monitors, your alerts and your billing are processed to perform the contract you signed up to (GDPR Article 6(1)(b)). Abuse prevention, rate limiting and security logging rest on our legitimate interest in keeping the service up (Article 6(1)(f)). We do not run advertising and we do not profile you.
Cookies
Two, both strictly necessary, both first-party: a session cookie that keeps you logged in, and a small preferences record (theme, language, currency) held in your browser's local storage. No analytics, no advertising, no third-party trackers. Sign-up is protected by Cloudflare Turnstile, which sets its own short-lived challenge cookie for that check.
Who else sees it
Only the processors the service cannot run without: the hosting provider that runs our server, Stripe for payments, and — for the alerts you configured yourself — Discord, Telegram or whatever endpoint you pointed us at. We do not sell data and we do not share it for marketing.
How long we keep it
Monitor results follow your plan's history window. Everything else lives as long as your account does. Delete your account and the account, its monitors, its results, its alert destinations and any stored marketplace session go with it; accounting entries and invoices are kept where bookkeeping law requires it, and nothing more.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to processing based on legitimate interest. Write to [email protected] and you get an answer within 30 days. If you think we have handled your data badly you can complain to Integritetsskyddsmyndigheten (IMY), imy.se.
Security
Passwords are hashed with bcrypt. Marketplace sessions, alert secrets and API keys are encrypted or hashed at rest, and API keys are shown once and never again. Access to the server is restricted to the operator. No system is perfect: if a breach ever affects your data, you will be told about it.