Legal

Privacy Policy

Effective October 10, 2026

The short version: we store what you need to track your flips, nothing more. We don't run ads or analytics, we don't sell or rent your data, and we only email you if you check the box asking for it. Your flips only appear on the public board if you turn sharing on, your profit only appears on the members leaderboard if you join it, and a win card is only public if you share it. Your email, notes and links always stay private.

This policy covers stickypicks.com and the Sticky Picks member app ("Sticky Picks", "we", "us"). It explains what we collect, why, who helps us run the service, and the choices you have.

What we collect

Your account. Your email address, the name you give us (if you don't give one, we use the part of your email before the @), and your password. We never store the password itself, only a one-way scrypt hash of it. We also keep when the account was created, when the password last changed, whether sharing is on, whether you joined the leaderboard and the display name you picked for it, whether you asked for email (and when you said yes or no), and a secret ID used to connect Zapier.

Sign in with Google. If you use Continue with Google, Google tells us your email address, whether Google has verified it, your name, and an account ID that Google assigns to Sticky Picks. We keep the email, the name (you can change it) and that ID. We don't get your Google password, contacts or anything else in your Google account, and we don't post to it. If you link Google to an account that already has a password, that password is turned off and other sessions are signed out; you can set a new one in Settings.

Win cards you share. When a product sells out, the app can make a win card. If you tap Share, we store the card image and its numbers (product name, profit, cost, revenue, units and return percent) and give it a public link. The card never includes your name or email.

Your ledger. Everything you enter in the app: products, purchases, sales, adjustments, prices, fees, notes, links and the stores you bought from.

Images you upload. Product photos are stored with our file host at web addresses that are hard to guess but not password protected. Anyone who has the exact address of an image can open it.

eBay orders you connect through Zapier. If you set up a Zap, we receive order details from it: the order number, listing numbers, item titles, quantities, item and shipping amounts, your payout and the order date. That is all we keep from each order. We don't store eBay buyer names or addresses. If you use Storage by Zapier, our servers read your Zapier storage with your secret ID, when you open the app and once a day.

Technical data. Your IP address is used to limit repeated sign-up and sign-in attempts. Those counters expire within an hour. Our hosting provider also keeps standard request logs (such as IP address, page requested and browser type) for security and troubleshooting.

Cookies and browser storage

One cookie, sp_session, keeps you signed in. It is set only when you sign in and lasts up to 30 days or until you sign out.
If you use Continue with Google, a short-lived cookie, sp_gstate, protects the sign-in round trip. It lasts at most 10 minutes and is erased when you come back.
If you pick light or dark mode, that choice is saved in your browser's local storage. It never leaves your device.
No advertising, tracking or analytics cookies.

How we use it

To run your account and show you your ledger, profit numbers and eBay sync status.
To show your shared flips on the public board, only if you turned sharing on.
To rank you on the members leaderboard, only if you joined it.
To email you new price errors and Sticky Picks updates, only if you opted in. Every email has a way to unsubscribe, and you can turn it off in Settings.
To keep the service secure: stopping password guessing, signing out old sessions after a password change, and investigating abuse.
To restore your ledger if something goes wrong (see backups below).

We look inside an individual ledger only to keep the service running, to fix a problem you asked us about, or when the law requires it.

The public flip board

Sharing is off for new accounts. If you turn it on in Settings, the home page can show your products that are in stock or sold in the last 45 days, with only these details: product name, product image, the store you bought from, what you paid per unit, what it sold for on eBay per unit, and profit per unit. If you added sold comps, the board also shows their median, range and count, and it shows an expected sale price and profit per unit worked out from your comps, target price or bundle price. Your name, email, notes, links and comp screenshots are never shown. You can hide single products in their edit form, or turn sharing off at any time. The board refreshes about once a minute, so changes show up shortly after.

The members leaderboard and win cards

The leaderboard is off until you join it in the app. Once you join, signed-in members can see your display name, realized profit (all time and the last 30 days), units sold, products sold out and return percent. It doesn't show your email, products, stores or prices. Leave it any time and you disappear from it within a few minutes.

A shared win card link is public: anyone who has it can see the card, and sites like Facebook or X can show a preview of it. The link is hard to guess and isn't listed in search engines. Email us to take one down.

Who helps us run Sticky Picks

We don't sell or rent personal information, and we don't share it for advertising. These providers process data on our behalf so the service works:

Vercel hosts the website and app, and stores uploaded images.
Upstash hosts our database, where accounts, ledgers and backups live.
Zapier carries your eBay orders to us, only if you set up a Zap. Your Zap runs under your own Zapier account and Zapier's own terms.
Google Fonts serves the typefaces on our pages, so your browser contacts Google when a page loads.
Google Sign-In confirms who you are when you choose Continue with Google, under Google's own privacy policy.
UPCitemdb, Open Food Facts and eBay answer barcode and price lookups from the comp checker. They receive the barcode or product name you search, not your account details.

We may also disclose information if the law requires it, to protect the rights and safety of our users or the service, or as part of a sale or merger of Sticky Picks, in which case this policy continues to apply to your data.

How long we keep it

Your account and ledger: until you ask us to delete them.
Daily ledger backups: 60 days, then they are erased automatically.
Sign-in sessions: up to 30 days. Password reset links: 24 hours.
Rate-limit counters tied to your IP address: up to one hour.
Shared win cards: up to two years, or until you ask us to remove them.

Your choices and rights

Change your name, password, sharing, leaderboard and email settings any time in Settings.
Edit or delete anything in your ledger from the app.
Ask us for a copy of your data, a correction, or deletion of your account by emailing marketing+stickypicks@rouillardmedia.com from the address on your account. Deleting your account removes your account, ledger and uploaded images. Backups age out within 60 days.

Depending on where you live, you may have more rights under laws such as the California Consumer Privacy Act or the GDPR. Email us and we will honor them as those laws require. We don't sell or share personal information as those laws define it.

Security

Passwords are hashed with scrypt. Session and reset tokens are stored only as SHA-256 hashes. The site runs over HTTPS, and the session cookie is HttpOnly and Secure. No system is perfectly secure, so use a password you don't use anywhere else, and keep your Zapier secret ID private.

Children

Sticky Picks is for adults 18 and older. We don't knowingly collect information from anyone under 18. If you believe a minor has signed up, email us and we will delete the account.

Changes to this policy

If we change this policy, we will update the date at the top. For significant changes we will also post a notice in the app before they take effect.

Contact

Questions or requests: marketing+stickypicks@rouillardmedia.com.