Privacy

Who is responsible for your data

The data controller is MadHaul, operated by Barnaby Everett, a sole trader established in the United Kingdom.

Registered with the ICO under data protection fee reference ZC257232.

No Data Protection Officer is appointed; one is not required at this scale.

What is stored on your device

Almost everything. The app uses your browser’s own storage on your phone, and this data never reaches us.

In localStorage:

• Your inventory — every item’s name, brand, category, size, colour, condition, notes, buyer notes, measurements, price paid, recommended, target and sold prices, status, dates, reference number, source, quantity, marketplace listing URLs, the platform it sold on, saved listing text and edit history.
• Your bundles — names, member items, prices, status, dates, notes and saved listings.
• Your sales log — a permanent record of each sale: item, brand, category, price sold, price paid, profit, date and platform.
• Your price check history — descriptions, price ranges, the AI’s reasoning, price paid and identified fields.
• Your activity log and its archive — status changes, sales, relists, price updates and so on.
• Your lists and settings — categories, conditions, display preferences and all app settings, including the Google Drive backup settings.

In IndexedDB: your photos, stored as image files, up to six per item. Items hold only a reference to each photo, not the photo itself. Photos are compressed when you take them and files over 20MB are rejected.

The app asks your browser for persistent storage at start-up, because some browsers will clear this kind of storage when the device runs low on space.

What we hold on our side

Only what is needed to sign you in, count your credits, and keep the free starter credits to one claim per email address. Specifically:

• Your email address, and your password stored as a one-way hash by our sign-in provider — the password itself never reaches MadHaul, and nobody can read it back, us included. Or your Google sign-in identity if you use that instead.
• Session tokens, so you stay signed in.
• Your credit balance.
• A one-way salted hash of your email address, recording that this address has had the free starter credits. It is the one thing that outlives your account — see what is kept after you delete your account.

That is the complete list. No inventory, sale, photo or listing data is ever written to our database. When the app makes an AI request, it sends your session token so we can tell who is asking and charge the right balance — the token is used to identify you and for nothing else.

What leaves your device, in full

There are exactly four destinations.

1. Our server, which passes the request to Google Gemini

We log token counts for each AI request — timestamp, which endpoint, which model, and how many tokens were used. We do not log the content of prompts or responses. Your item data and the generated text are not stored in our logs.

2. Google Drive — only if you set up backup

Your full backup file, which contains everything in your app storage including every photo. It goes to your own Google Drive, into a single file that is overwritten each time rather than accumulating copies. The permission we request is limited to the one file the app creates — it cannot browse, read or change anything else in your Drive.

3. Supabase — for sign-in only

Your email address and password, or your Google sign-in. No app data.

4. Assets loaded when the app opens

Web fonts from Google Fonts, the Supabase library from the jsDelivr CDN, and Google’s sign-in script. As with any request to any website, these receive your IP address and browser headers. They receive no app data.

Beyond these four, nothing. There is no analytics library, no tracking pixel, no error-reporting service and no telemetry anywhere in the app.

Processors

Every external service involved, and what each one receives.

What we do not use

No analytics. No tracking pixels. No session recording. No advertising SDKs. No crash or error reporting. No A/B testing tools. No chat widgets. This is not a policy statement about intent — none of these exist in the app or on this website.

Why we are allowed to process this

• Your account data — performance of a contract. The account is required to provide the service.
• AI processing — performance of a contract. You start each AI request yourself, and confirm it before it runs.
• The starter-credits hash — legitimate interests: keeping the free starter credits to one claim per email address. What it is, how long we keep it and how to object are under what is kept after you delete your account.

International transfers

Yes. Google (Gemini, Drive, Identity Services and Fonts) and Supabase process data outside the UK. Your account record, and the starter-credits hash, are held in the EU, inside the European Economic Area, which the UK recognises as providing an adequate level of data protection.

How long data is kept

• On your device — until you delete it, or until you clear your browser data. It is yours and it stays there.
• Account records — deleted when you delete your account. The account row, your email address and your credit balance are removed at that point, not held back for a grace period. One thing survives, and only one — the starter-credits hash, below. If the billing record can’t be removed in the same pass, your sign-in is gone immediately either way and the record is cleared separately.
• The starter-credits hash — five years from the last time that address was used to sign up, then deleted. See what is kept after you delete your account.
• AI requests — MadHaul keeps no copy. Google processes each request on its paid API tier, under which prompts and responses are not used to improve Google’s models. Google keeps them for 55 days for abuse monitoring and legal compliance, then deletes them.
• Emails you send us — deleted two years after your last message. Anything about a payment, a refund or a dispute is kept for six years, the usual time limit for bringing a claim about a purchase.
• Server logs — held by our hosting provider, Railway, for as long as its own logging keeps them.

What is kept after you delete your account

One thing. Your account row, your email address and your credit balance go. What stays is a one-way salted hash of your email address — a fixed string worked out from the address and stored in place of it. The address itself is never stored there.

It exists for one reason. The free starter credits are given once per email address, not once per account. Without the hash, the same address could delete and re-register for a fresh set of credits as often as it liked.

What it can and cannot do. Your email address cannot be read back out of it, by us or by anyone else. It can confirm whether an address we are handed has claimed before — that is how the check works, and it is why the hash is still personal data and still covered by this policy. Nothing else is attached to it: no name, no balance, no record of anything you did in the app, only the date it was recorded.

How long we keep it. Five years from the last time that address was used to sign up. After that it is deleted, and the address can claim the starter credits again.

Why we are allowed to keep it. Legitimate interests, as set out above. The interest is a plain one: the starter credits cost us real money, and this is the only thing stopping the same person taking them over and over.

It is not removed on request. This one value stays, an erasure request included, because removing it undoes the only thing it does. You can object to us keeping it and we will read what you tell us, but for this hash the answer will be that we keep it. If you think that is wrong, the Information Commissioner’s Office is open to you as it is for anything else on this page.

Your rights

Under UK GDPR you can ask for access to your data, correction of it, deletion of it, restriction of processing, or a copy of it in a portable form, and you can object to processing.

In practice, most of this you can do yourself and instantly: the data is on your device. A full export of everything — inventory, sales, bundles, categories, settings, activity log, price checks and every photo — is available at any time from Settings → Data & Backup, as a JSON or CSV file. Deleting an item, or resetting the app, removes that data from your device there and then.

For anything held on our side — your account record, email address and credit balance — write to privacy@madhaul.app and we will action it. There is one exception, and only one: the starter-credits hash is kept to stop the free credits being claimed over and over, and it is not removed on request, an erasure request included.

Account deletion: you can delete your account yourself, in the app, at Settings → Account. Deleting your account also erases every item, photo and record stored on this device, and it cannot be undone — export your data first if you want to keep it. Signing up again with the same address gives you an account, but not another set of starter credits. Clearing the app from your phone, on the other hand, does not remove the account.

There is one exception worth knowing. If the confirmation never reaches your phone — you lose connection, or the request times out at the wrong moment — the account can be deleted on our side while the data on your device stays where it is. The app cannot always tell that apart from a deletion that simply failed, so if you think it has happened, Settings → Reset App clears the device.

If you think we have handled your data badly, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first, at the address above, so we can put it right.

Children

MadHaul is not for children. You must be at least 16 to use it, as set out in the terms. We do not knowingly collect data from anyone under that age.

This website

This marketing site sets no cookies and runs no analytics or tracking of any kind. It does load fonts from Google Fonts, which receives your IP address and browser headers. The cookies page covers this in full.

Changes to this policy

If this policy changes in a way that affects you, the date at the top will change and the change will be described here.

Contact

• Data protection — any question, request or complaint: privacy@madhaul.app
• General enquiries — support@madhaul.app