Privacy & your collection

What the app stores

Signing in creates or restores an account through Supabase. Depending on your sign-in method, the account includes an email address, an account identifier and profile details supplied by your sign-in provider. Google handles Google sign-in; the app does not ask for your Google password. The sign-in screen shows Google’s own button, which your browser loads from Google whether or not you use it.

Your collection contains the artwork and frame details you choose to save, including photos, measurements, notes, favorites and planning projects. Sharing a household also involves its membership and invitation information.

Supabase provides authentication and collection records (hosted in Canada). Cloudflare R2 stores private photos, Fly.io serves the website and the AI worker, and OpenAI performs photo reads (all in the United States). These services process the requests needed to provide the app and may keep operational logs. The free beta does not request a payment card or use Stripe checkout.

Resend delivers the sign-in codes we email, so it receives your email address and the code. Before a code is sent, Cloudflare Turnstile checks that a person rather than a script is asking: your browser loads Cloudflare’s check, which most people never see. Google sign-in doesn’t use it.

Feedback you send from the app (the dog’s help, or You → Send us feedback) is kept with your account and emailed to our support inbox through Resend, with the app page you were on. Your sign-in email goes with it only when you tick that we may reply. Messages are removed after a year, or with your account.

When a sign-in step doesn’t work (the security check, sending or checking a code, or Google’s button), or the sign-in page opens inside another app’s browser, the app adds one to a daily count of that kind of problem, so we can see and fix sign-in trouble. A count holds only the day and the kind of problem: no email address, account, IP address or device details. Counts older than 90 days are removed as new ones come in.

Shopping photos and AI evaluation

Automatic scan descriptions, when available and enabled, send one small preview of a new scan to OpenAI for a category and short description. This can name an untouched “New find” and add a type; your own names and categories are preserved. It does not research prices or estimate measurements. You can turn it off in You. Saving a photo does not wait for the description, and these reads have a separate allowance from Research.

Using Snap & evaluate saves the find to your household and sends resized photos, the asking price you supply, and its currency to OpenAI for evaluation. Quick gives a photo-based read. Detailed can also use web search and link to external sources. AI results are saved with your household’s find.

The camera preview stays on your device until you capture a photo. Offline captures remain in browser storage and upload for evaluation when you reconnect with Thriftcraft open. Removing a saved find from the trip tray removes that device copy, while keeping the saved find and evaluation in your collection.

Research (Beta) runs only for a snap you ask about: tap the Beta button on Scan, then snap. With it on, each snap and each reply sends the find’s resized photos (the newest labelled shot at a higher resolution), anything you wrote, and the earlier replies in that conversation to OpenAI for the reply. The AI searches the web when a reply needs it, for what the find is, what similar ones sell for, or whatever you asked (up to three searches a reply); the reply says when it searched and links its sources. It answers only about the find, and treats anything in a message that tries to change its instructions as text, not a request. Details a reply is sure of are offered, and written to your find only when you tap Keep these. A household can start five researches a day (and sixty a week), with up to forty messages each and a hundred messages a day in all; every reply counts against the household’s daily spending limit.

The thrifting guide stores nothing about you. Its links open other companies’ sites, or your map app, in a new tab and carry nothing about you; those sites’ own privacy terms apply there. Look over a sale is a research you start: the screenshots and link you add are saved as a find titled “Sale · …” and sent to OpenAI like a find’s photos, and the AI may open that link to read the sale’s page. Delete the find to remove them.

Style my space makes a picture only when you ask for one. It sends the place’s photo, and the photos, names and saved sizes of up to four finds you choose, resized, to OpenAI’s image model, which pictures those finds in that place. A smaller OpenAI model then looks at the picture and the finds’ names to suggest one more thing that would finish the look. The picture is saved as one of your household’s private photos, included in backups, until you delete it or the household. A household can make three pictures a day.

A shared household, not a public gallery

Collection access is restricted to your household. A household has at most two accounts, and both members can view its shared artwork, frames and photos. Joining a household does not create a separate personal copy.

Invitations are tied to the intended account. Removing a member preserves the shared records while revoking their online access. It cannot recall photos, exports or screenshots that person already downloaded.

People operating the app and its hosting services may have administrative access needed for support and maintenance. Private collection content is not included in marketing reports.

Saved research and connected agents

The Research Library stores answers you choose to save, their summaries, sources, conversation links, suggested details, dates and saving account. Research and attached photos are shared with your household. Saving imported research does not start a paid AI read or import your other conversations.

A connected agent can retrieve your household’s finds, their photos and your research, plus the account details you allow when connecting, such as your name and email address. Photo links it receives expire after five minutes, but the agent may keep the pictures and answers in its conversation. You choose read-only access or permission to also save research, attach it to a find and create a new find. Changing an existing find’s name, notes, tags or details needs a separate “Allow item updates” setting for that connection, which starts off; the agent shows the changes before applying them. Information returned to an agent is handled under that provider’s policies. Connected apps shows your connections and lets you revoke access immediately; revocation cannot recall information already returned to the provider.

Research drafts and incoming shares are kept privately on your device. An incoming share expires after one hour unless you open and keep it as a draft. Nothing is saved to the household until you submit it. Original answers are retained when you edit summaries. Removed research can be restored, and remains in backups and storage until the household is permanently deleted.

Connection diagnostics record operation names, timings, results and aggregate use and storage counts. They exclude private answers and access tokens. Saved research is included in household records-and-photos backups. Contact support for permanent deletion during the beta.

What stays on your phone or browser

The browser stores sign-in information and preferences. Entry drafts and photos waiting to upload are stored on that device until they are saved to your collection.

Signing out clears the app's private device copies and drafts. Downloaded backup files, exported images and screenshots are separate files; signing out does not remove them. On a shared device, sign out when you finish and keep downloaded files somewhere appropriate.

Browser storage can be cleared or evicted. Keep a separate backup of anything you want to preserve.

Keeping, exporting and removing records

Your saved collection remains in the service while you keep it. Trashed artwork and archived frames still exist until permanently deleted. An interrupted deletion may need a retry before both its record and photo are removed.

Household settings provide a records-and-photos backup. Keep every downloaded archive part together. Automatic restoration and self-service household/account deletion are not available in the current beta.

Removal from the live collection does not establish when every provider backup or operational log expires; providers keep operational logs for a limited time under their own policies. To close an account or delete a household during the beta, contact support (below) and we will do it for you.

Where legally required, we preserve specified records for the applicable period, which may delay their deletion. See our policy on government and third-party requests.

Government and third-party requests

Effective October 23, 2026. This policy covers requests from governments, law enforcement, courts and private third parties for non-public Thriftcraft user information.

Send requests for user information to support@thriftcraft.io. Include your identity and organization, a contact we can independently verify, any case reference, the specific account or records sought, relevant dates, the legal basis, and supporting legal documents. This contact does not replace any legally required method of service.

Thriftcraft’s owner reviews requests, verifies the requester and evaluates the authority, scope and applicable jurisdiction before disclosing information. We seek clarification or a narrower scope when appropriate, and obtain outside legal advice when needed to resolve legal questions or consider a formal challenge.

We disclose non-public user information only under valid, binding legal process; the user’s verified, specific authorization for information they are entitled to disclose; or a lawful emergency exception involving imminent danger of death or serious physical injury. Each disclosure requires a documented basis and operator approval. An informal request alone does not establish authority to receive private records.

We limit disclosure to relevant information justified by that basis, use a secure delivery method, and keep a restricted record of the decision. We do not grant requesters direct access to user accounts or our systems.

We notify affected users before disclosure unless notice is legally prohibited or a legally permitted delay is necessary to address an imminent risk of serious harm. We document any delay and reassess notice when the restriction or risk ends.

Where legally required, we preserve specified records for the applicable period. Preservation does not itself authorize disclosure and may delay deletion of those records. Requests directed to our service providers are handled under their own obligations and policies.

Our support inbox is not a continuously staffed emergency channel. Contact local emergency services for immediate help.

For access to your own information or account deletion, see keeping, exporting and removing records, or contact support.

Campaign labels and usage reporting

Optional launch measurement is off by default. If you allow it in this tab, a launch post or ad link can store a small set of campaign labels (where the link was posted, which post or ad, and the ad’s code) for up to 24 hours, including across sign-in. Signing out or choosing “Keep measurement off” clears those labels. They contain no email, artwork, photo or visitor identifier. This tab's choice is separate from account reporting.

With your tab's permission, we count a landing-page view and your first interaction that displays valid demo results, at most once each per loaded page. We send only the event category and any allowed campaign labels, not typed dimensions, URLs or account tokens. These are daily activity totals, not unique visitors. Refreshing may add another count; blocked, failed or offline requests may be absent. Counts are retained for the latest 90 UTC calendar days and removed by daily cleanup. Turning measurement off stops future reports; totals already combined without a visitor identifier cannot be individually removed.

With your account's separate opt-in, beta reporting links an eligible new verified signup and any allowed campaign labels to an internal account ID. Returning logins do not create more signups. We record the first saved artwork or frame after opting in, the first potential fit displayed in online matching, and the first reported app interaction between 24 hours and seven days after signup. Your collection works without reporting.

These are account-linked records, not anonymous statistics. They contain timestamps and fixed categories, not artwork titles, dimensions, notes, photos, typed text or clicked element labels. Browser-reported results do not prove a physical fit or a purchase. Offline and sample-demo use are excluded from these account events.

Only designated operators can read aggregate reports. The reporting records are removed when their account is deleted, or by daily cleanup after 90 days from creation. A scheduled cleanup can lag that threshold by its daily interval.

Change your account choice in household settings while connected. Turning it off removes retained marketing events; an unconfirmed or offline change has not updated your account. Your choice and decision timestamps remain until account deletion to honor that choice and prevent old events being rebuilt. Your partner makes their own choice. Reports count eligible consenting signups, not every signup.

These marketing measurements are separate from the authentication, collection storage and operational logs needed to run the app. No advertising pixels are installed.

Account reporting is a separate choice in household settings when that feature is available. Allowing launch measurement in this tab does not enable account reporting.

Questions about your information

Contact support@thriftcraft.io, or prepare a support message. Include only the information needed to explain your request; do not send passwords or sign-in codes.

This page describes the current beta. New features and their privacy choices are reviewed before they are enabled, and this page is updated when they change.