Privacy Policy

Scope of this Policy

This Privacy Policy (the "Policy") describes how Personal Data is collected, used, disclosed and retained in connection with the Simple Price Tracker website and emails (together, the "Service"), the purposes of that processing, the recipients of Personal Data, the applicable retention periods and the rights and choices available to Users. The "Operator" is the individual identified in the section of this Policy entitled "Contact". "User" means an individual who uses the Service, and "Personal Data" means information relating to an identified or identifiable User. This Policy forms part of the Terms of Service.

Categories of Personal Data Collected

Personal Data Provided by Users

An email address is required in order to hold an account, because alerts are delivered to that address. All other Personal Data is optional.

Where a User signs in with Google, Google provides the Operator with the User's email address, first name and an indication of whether Google has verified the email address. Where an account already exists with the same verified email address, the Operator links the two, so that both methods of signing in provide access to the same account.

Personal Data Generated through Use of the Service

Data Not Relating to Users

Product details and price history (names, prices, stock and pictures) are shared by all Users who track the same product. Each price record is retained for one year, and a product and its history are deleted once no User tracks it. The shared product record may continue to hold an internal account number identifying the User who last refreshed it. Upon deletion of that User's account, the number no longer refers to any person.

Page visits are also counted by area of the site (for example "landing page" or "item pages"). The count is a number only: no IP address, cookie or account is associated with it.

Data Not Collected

The Operator does not retain IP addresses in its own records. AWS, as host, processes IP addresses in order to deliver pages to the User. The Operator does not collect location, contacts, payment details or browsing history. The Operator does not track whether emails are opened or whether the links in them are followed. The Operator does not use analytics services, advertising pixels or social media plugins.

Price Checking

Approximately once per day, the Operator's servers access the public page of each product tracked by a User, in the manner of an ordinary visitor, and read the price, stock status and product name. No information about the User is transmitted to retailers in the course of this process.

Where a page cannot readily be read, the product link and the public text of the page are transmitted to OpenAI, which extracts the price. For eBay links, the Operator queries eBay's own product service using the item number. In both cases, no information about the User or the User's account is transmitted. Certain product pages are retrieved from other AWS regions, and only the product link is transmitted to those regions.

Recipients and Processors

The Operator does not sell, rent or trade Personal Data. Personal Data is disclosed only to the following service providers that assist in operating the Service, and only to the extent that each requires:

The Operator may also disclose Personal Data where required by law, or to protect the safety of Users, the public or the Service.

Product pictures: the pictures displayed in the app, and in some emails, are loaded directly from the website of each store. The User's browser or email application retrieves them directly, so that the store can see the User's IP address and browser type, as it would upon a visit to its site. In the app, the browser is instructed not to send the store the address of the page on which the User is located.

International Transfers

Personal Data is stored on AWS servers in the United States (Ohio), and the recipients listed above may process it in the locations indicated. Each of these recipients maintains its own privacy and security commitments. By using the Service, the User acknowledges that Personal Data will be stored and processed in the United States and in those other locations, where privacy laws may differ from those of the User's place of residence.

Legal Bases for Processing

Personal Data is processed on the following legal bases:

• Performance of the Service requested by the User: the User's account, tracked items, price checks and chosen alerts.
• Legitimate interest of the Operator in operating a secure, fair and functioning Service: security, abuse prevention, error remediation, counting usage and the occasional reminder concerning the User's own items. Users may disable reminders at any time.
• Consent: product news emails (only where the User has ticked the relevant box) and sign-in with Google. Consent may be withdrawn at any time in Settings.
• Legal obligation: where Personal Data must be retained or disclosed by law.

Emails Sent by the Service

• Price alerts configured by the User: price drops, target price reached, back in stock, and notices where an item ceases to be trackable or is removed. These constitute the core function of the Service. They may be disabled in Settings, or for an individual item.
• Reminders concerning the User's own list, such as a notice that the User's items remain under observation or that one of the User's links is broken. At most one reminder is sent every two weeks. Reminders are enabled unless the User disables them.
• Product news, only where the User has ticked the relevant box. Disabled by default.
• Account emails, such as sign-up and password-reset codes. These are necessary to maintain the security of the account.

Every email other than an account email contains an unsubscribe link, and email applications that support it additionally display a one-click unsubscribe button. All such preferences may be changed in Settings. Alerts and reminders never contain advertising.

Local Storage

The Service does not use cookies. The Service stores a limited number of items in the local storage of the User's browser, solely so that the app functions as the User expects:

None of this data is used for advertising or to track Users across websites. It may be cleared at any time in the browser settings. Clearing it signs the User out.

Do Not Track: the Operator does not track Users across websites and accordingly treats every visit identically, whether or not the browser transmits a Do Not Track or Global Privacy Control signal.

Abuse Prevention

To keep the Service free and operational for all Users, the Operator monitors for abuse:

• The Operator counts, per account and per day, the number of items added, items removed, failed additions and manual checks. Where the counts are unusual, the account is flagged.
• The Operator can view the email address, sign-up date, recent activity and these counts for flagged accounts, and may block an account. A blocked account cannot sign in, receives no emails and its items cease to be checked.
• Sign-ups from known disposable email services are not accepted.
• None of this processing uses IP addresses or device identifiers, and flags never block any account automatically.

A User who believes that an account was blocked in error, or who wishes a blocked account to be deleted, may email support@simplepricetracker.app.

Retention

The tables above set out the retention period for each category of Personal Data. In summary:

• During the existence of an account, the Operator retains the account information and tracked items.
• Upon deletion of an account, the Operator ceases to email the User and schedules the account for deletion after approximately 30 days. If the User reconsiders, the User may sign in before that date and elect to keep the account. Thereafter, the Operator deletes the account, tracked items, tags, settings and email history, together with the sign-in.
• Backups of the database are retained for up to 35 days. Deleted Personal Data may therefore remain in backups for up to 35 further days before it is permanently deleted.
• Error logs may briefly contain an email address or product link when a fault occurs. They are retained for 1 day, or for up to 7 days while a specific problem is being remediated.
• Abuse counts and flags are subject to their own short retention periods (35 and 30 days respectively, see above).
• Where emails to a User have bounced, Amazon SES retains the address on its "do not send" list until the Operator removes it.

Data Subject Rights

A User may:

• Access Personal Data: most Personal Data is available in the app. A full copy may be requested by email.
• Correct Personal Data: name, items and settings may be edited in the app, or correction may be requested from the Operator.
• Delete Personal Data: the account may be deleted in Settings, or deletion may be requested from the Operator.
• Obtain a portable copy: on request by email, the Operator will provide the User's Personal Data in a common format.
• Decline emails: by means of the unsubscribe link in any email, or in Settings.
• Withdraw consent: for product news or sign-in with Google, at any time. Withdrawal does not affect any processing carried out beforehand.
• Object to the use of Personal Data, or request that its use be limited.

To submit a request, the User must email support@simplepricetracker.app from the email address associated with the account. The Operator will respond within 30 days and may request confirmation of the User's identity. A User who is dissatisfied with the response may lodge a complaint with the data protection authority of the User's place of residence.

Information Security

All traffic is encrypted (HTTPS). Data is stored in encrypted form with AWS, passwords are processed by Amazon Cognito, and only the Operator can access the administrative tools, following a recent sign-in. Email addresses and account identifiers are removed from technical error reports. Abuse alerts sent to the Operator do identify the flagged account. No service can guarantee absolute security; where a breach affects a User, the Operator will notify the User as required by law.

Children

The Service is not intended for children under 13, and the Operator does not knowingly collect Personal Data from them. A User under 18 requires the approval of a parent or guardian in order to use the Service. Where a person believes that a child under 13 holds an account, that person may notify the Operator by email, whereupon the Operator will delete the account.

Future Features

At present, the Service is free and contains no advertising, paid plans or affiliate links. Donations are processed through PayPal, and the Operator never receives payment details. Should advertising, paid features or affiliate links be introduced, the Operator will update this Policy beforehand, give notice in the app and obtain consent where required.

Changes to this Policy

Where this Policy is amended, the Operator will update the version and date at the top of this Policy. For material changes, the Operator will give notice in the app before they take effect, and by email where they affect how Personal Data is used.

Contact

The Service is operated by Rotem, an independent developer (the "Operator"), who determines how Personal Data is used. For any matter concerning privacy, the Operator may be contacted at support@simplepricetracker.app.