Privacy policy

The short version

• You can use the directory at /estate-sale-companies without giving us anything.
• If you upload photos and optional item notes for valuation, we send them to our AI providers - Google's Gemini (the primary model) or Anthropic's Claude(the backup model) - to identify the item and estimate its value. Under both providers' paid API terms, your photos are not used to train AI models, ours or anyone else's.
• If you give us your email, we use it to send you back to your list and (if you ask) to match you with a local estate sale company. We do not sell it. We do not bundle it into a newsletter you didn't sign up for.
• You can request account deletion in the iOS app under Account, or request deletion by emailing privacy@atticscout.com. We respond within 30 days.

Who we are

“Attic Scout” in this policy means the Attic Scout service available at atticscout.com and the Attic Scout iOS app. We are the data controller for personal data you share with us through either surface.

Questions, requests, or complaints: privacy@atticscout.com.

What we collect and why

Photos you upload

When you photograph an item for valuation - through the web tool at /startor the Attic Scout iOS app - we collect the image bytes and store them in Supabase Storage. Optional item notes you add are also sent with the photos. We send this content to an AI model - Google's Gemini (primary) or Anthropic's Claude (backup) - to identify the item and estimate a resale value range. We retain the photo so you can revisit the valuation later.

Why: identifying and valuing items is the core function of the tool. There is no version of this product without the photo.

Your email address

We collect your email when you save a valuation, sign in, or request to be matched with a local estate sale company. We use it to send you the one-tap sign-in link, recover your account, and (only if you specifically request a match) share it with the local pro we're connecting you with.

We do not send marketing emails. If we ever do, we will ask first, separately, and the opt-in will not be bundled with anything else.

Device and usage data

The web app logs basic technical information (IP address, browser type, pages viewed) for security and to understand which features get used. The iOS app records crashes and performance data through Apple's standard channels. We use PostHog for product analytics; PostHog only creates a person profile after you sign in, so anonymous visitors are never personally tracked.

Provider directory data

For estate sale companies listed in our directory, we collect publicly available business information (name, website, phone, service area, reviews). If you claim a provider listing, we also collect your name and the email address you verified ownership with.

How AI fits in

Attic Scout's valuation feature uses two AI providers: Google's Gemini is the primary model that reads your photos, and Anthropic's Claude is the backup model. Claude also writes the draft listing text if you use the listing feature. When you upload a photo:

1. The photos and optional item notes are sent to the model's API (Google or Anthropic) over an encrypted connection.
2. The model reads the photo, identifies the item, and returns a value range with its reasoning.
3. Neither provider uses our API data to train their models. Google states that paid Gemini API prompts and responses are not used to improve its products, and logs them only for a limited period to enforce its Prohibited Use Policy. Anthropic deletes API inputs and outputs within 30 days under its standard commercial terms (longer only for content flagged as violating its usage policy, or where the law requires).
4. We store the photo and the valuation in our own database so you can revisit them. You can request account deletion in the iOS app or request deletion of specific items by emailing us.

The value range is a good-faith estimate based on what the model can see and the comparable sales data we check against. It is not an appraisal. For high-value items or anything where the difference matters, get a second opinion from a local specialist.

You can read each provider's policies at ai.google.dev/gemini-api/terms and trust.anthropic.com.

Who else handles your data

We use a small number of service providers (“sub-processors”) to actually run the product. Each one only sees what it needs to do its job.

We do not sell your data. We do not share it with advertising networks. We do not use it for cross-context behavioral advertising.

Purchases and subscriptions

If you subscribe to Attic Scout Pro (or buy any pass we offer) in the iOS app, the purchase is processed by Apple through your App Store account. We never see your card number or billing details. We receive a purchase receipt and your subscription status through RevenueCat, tied to your Attic Scout account ID, so the app knows what you have paid for. You can manage or cancel the subscription any time in your App Store settings, and refunds are handled by Apple under App Store rules.

Estate sale companies that subscribe to a directory plan on the web are billed through Stripe. Stripe collects the payment details directly; we store only the subscription status and Stripe's reference IDs.

One promise that survives every billing state: anything you have already valued stays visible to you. Cancelling, letting a pass expire, or getting a refund never locks the valuations you already received.

How long we keep things

• Account records: until you delete your account. Erasure and backup cleanup may take up to 30 days. The iOS app shows the status of requests made there.
• Photos and valuations: while your account is active. Removed through account deletion, or earlier on request. Older scans may require a manual review to identify the records and avoid deleting someone else's data.
• Lead matches with providers: 24 months for support and dispute resolution.
• AI provider logs: Anthropic deletes API inputs and outputs within 30 days under its standard terms; Google logs paid Gemini API traffic only for a limited period to enforce its Prohibited Use Policy. Neither trains on our data.
• Server access logs: 30 days.
• Anonymous analytics: aggregated and retained indefinitely.

Your rights

You have the right to access, correct, delete, or export your personal data. You can ask us to stop processing it. You can object to specific uses. You can complain to your local data protection authority if you think we got it wrong.

Email privacy@atticscout.com from the address on file and tell us what you want. We respond within 30 days. We may need to verify your identity for destructive requests (delete, export) - usually that just means clicking a link in a confirmation email.

California (CCPA / CPRA)

California residents have the additional right to know the specific pieces of personal information we have collected and to opt out of any “sale” or “sharing” of that data. We do not sell or share personal information as those terms are defined under California law. There is nothing to opt out of, but the email above always works if you have questions. We do not use sensitive personal information for inferring characteristics.

EEA, UK, and Switzerland (GDPR / UK GDPR)

Our legal bases for processing are: (1) performance of a contract (running the service you signed up for), (2) legitimate interests (security, fraud prevention, basic product analytics), and (3) consent (any marketing communications we send, which we do not currently send). You have the right to access, rectify, erase, restrict, port, and object to processing of your data. Contact the email above to exercise any of these.

Security

Data in transit is encrypted with TLS 1.2 or higher. Data at rest is encrypted by Supabase using AES-256. Access to production systems is limited and logged. We use multi-factor authentication on every account that can touch user data. We patch security issues promptly. We are not perfect; no system is. If you discover a vulnerability, please email security@atticscout.com.

Children

Attic Scout is for adults. We do not knowingly collect personal data from anyone under 16. If we learn we have, we delete it. If you're a parent or guardian and want us to check, email privacy@atticscout.com.

International transfers

Attic Scout is operated from the United States. Our sub-processors (Google, Anthropic, Supabase, Vercel, PostHog, RevenueCat, Stripe, Resend) are also primarily based in the United States. If you use the service from outside the US, your data will be transferred to and processed in the US. We rely on Standard Contractual Clauses for transfers from the EEA, UK, and Switzerland.

Changes to this policy

When we make material changes, we update the effective date at the top and email anyone with an active account at least 14 days before the changes take effect. The history of past versions is available on request.

Contact

Privacy questions and requests: privacy@atticscout.com

Security disclosures: security@atticscout.com

Everything else: hello@atticscout.com