Privacy policy
Last updated 10 October 2026
Foragic helps UK eBay resellers identify items, find matching listings, check trade-in prices and prepare listing drafts. This policy explains what personal data we collect, why, who helps us, how long we keep it and your rights.
Who we are
Foragic is run by a sole trader in the United Kingdom, trading as Foragic. We are the controller responsible for the personal data described here under UK data protection law, including the UK GDPR and the Data Protection Act 2018. Contact us at [email protected] with privacy questions or requests.
What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Account details: username, email address and a password hash (we store a bcrypt hash, never the password itself). | To create and manage your account, confirm your email and let you sign in. | Contract (including steps you ask for before it starts). |
| Connected eBay accounts: your seller account details and the listing information needed for the features you use. We use eBay's own sign-in and never receive your eBay password. eBay's long-lived sign-in token is stored encrypted; the short-lived access token (valid for about two hours) is kept on our server so we can act on your requests. | To show your listings and orders and create drafts when you ask. | Contract. |
| Your buyers' details: when you use Orders, we fetch your orders from eBay, including the buyer's name or username and what they bought, to show you what to post. | To show your orders. We handle this on your behalf (you're responsible for your buyers' data); we don't keep buyers' details, only order numbers and your packing marks. | Your instructions as the seller. |
| Scans and saved content: photos, barcodes, item titles, prices, notes and drafts. | To identify items, find matches and prepare listings. | Contract. |
| Usage records: which features ran, when, and what they cost us. | To run plan allowances, prevent abuse and keep costs under control. | Legitimate interests in running a secure, sustainable service and applying limits fairly. |
| Payment records: your plan, payment dates, amounts and invoice details. Card details stay with the payment provider; we never receive your full card number or security code. | To manage subscriptions and keep accounts. | Contract, and legal obligation for financial records. |
| Technical and support information: IP address, browser or app version, error reports, feedback and support messages. | To keep the service secure, fix faults and reply to you. | Legitimate interests in protecting the service and solving problems; contract where it's needed for account support. |
| Location and eligibility information: the location checks and charity-work confirmation described below. | To decide whether sign-up and scanning are available to you. | Legitimate interests (see below). |
Photos can contain hidden details such as where they were taken, and things in the picture itself (faces, addresses). We don't use those details; turning off location tagging in your camera, and keeping unnecessary personal details out of shot, avoids sending them.
We don't sell your personal data, use it for advertising or show third-party adverts. We do earn commission from some eBay links, as explained below.
Location and eligibility checks
Foragic isn't available in some areas (exclusion zones), or to people who work or volunteer for charity shops, charity warehouses or reuse hubs. To check, we use:
- The postcode you can give in the app the first time you sign in (you can skip it). We send it to postcodes.io to find its approximate position. We keep only the first half (the district, for example "LS6"); the full postcode is held in server memory for up to 24 hours and isn't saved.
- Your internet connection's approximate location (roughly which town), which Cloudflare works out from your IP address. It isn't saved.
- Your browser's location when you sign up on the website, if you allow it.
- Your phone's or browser's approximate location when you scan. Accounts made through sign-up need to allow approximate location to scan; your device rounds it to about 100 metres before sending it. The server keeps the most recent one in memory for up to 30 minutes and doesn't save it.
- The item-location postcodes on your eBay seller account, checked once when you connect eBay.
- Your confirmation at sign-up that you don't work or volunteer for a charity shop, charity warehouse or reuse hub, and checks of email addresses and eBay seller names that clearly belong to one. We don't store the confirmation separately: creating an account records that you gave it.
Our account record keeps your postcode district and whether your account can scan (and why not, if it can't). We don't build a location history, track you in the background, use location for advertising, or show it to anyone.
Lawful basis: our legitimate interest in deciding where and to whom we offer Foragic — keeping it out of a few local areas and away from charity-shop staff, so the service stays fair and useful for the independent resellers it's built for. We keep the checks light (approximate locations, nothing saved but your postcode district) and you can ask for a review.
Automatic decisions: sign-up refusals and scanning blocks from these checks are made automatically. If you think one is wrong, email [email protected]; a person will review it and can correct it.
You can refuse or turn off location access in your device or browser settings at any time. If we can't check your location, scanning won't be available.
Who helps us run Foragic
We send each provider only what the feature needs. Some act for us under our instructions; others (eBay, payment providers) also act for their own purposes under their own privacy notices.
- Hetzner (Germany) — the server where Foragic and its database run.
- Cloudflare — network and security services, approximate IP location, the "I'm not a robot" check (Turnstile), and storage for our encrypted nightly backups.
- eBay — searches, and the requests you authorise for your connected seller accounts, listings, drafts and orders.
- Google (Gemini) — recognises the items in photos you scan. Only the photo or crop is sent, not your account details. This is the only AI service we use; Coach and listing descriptions don't send your data to any AI provider.
- postcodes.io — looks up the postcode you give in the app (only the postcode is sent).
- Item lookups, which receive only an item's barcode, title or picture: CeX (trade-in prices), Brickognize (LEGO), AI Card Vault and the trading card databases TCGdex (Pokémon), Scryfall (Magic), YGOPRODeck (Yu-Gi-Oh!) and Lorcana API, and Open Library (books).
- Resend — sends our emails, such as confirming your email address.
- Google AdMob — where ads are enabled, free accounts only, in the Android and iOS apps: shows ads (one small banner on some screens, and short videos you choose to watch for more scans) and tells us when a video you chose was watched. Google may use your device's advertising ID, where available, and IP address to show and measure ads; in the UK and EU it asks for your choice first, and you can change it any time in the app (More > Ad privacy choices). Paid plans have no ads.
- Stripe and Onelink, LLC — process checkout, subscriptions, payments and tax. Onelink (Stripe's reseller) is the seller for most plan purchases; see our terms.
- Apple — processes subscriptions bought through the iOS App Store. We send a randomly generated account token to link the purchase to your Foragic account, and receive transaction identifiers, the purchased plan, renewal, expiry and refund status. Apple handles your payment details; we use the signed purchase information to verify your plan. See Apple's privacy policy.
We may also disclose information to courts, regulators or law enforcement where the law requires it, limited to what's required.
International transfers
Some providers process data outside the UK, including in Germany (Hetzner), which the UK recognises as giving adequate protection, and in the United States (for example Google, Cloudflare, Stripe and Resend). For US providers we rely on the UK–US data bridge where the provider is certified to it, or on the UK's international data transfer safeguards in the provider's data processing terms. Email [email protected] for details of the safeguards for a particular provider.
How long we keep it
- Account details and saved content: while your account is open. When you delete your account (or ask us to), it's removed from our live systems within 30 days — usually 7 — apart from records we must keep for the reasons below.
- Shelf-scan photos and crops: deleted automatically after 14 days. Other photos stay with your drafts until you or your account deletion removes them.
- Backups: encrypted nightly backups are kept for 7 days, so deleted information can remain in a backup for up to 7 more days. Backups are only used to recover the service.
- Payment and accounting records: as long as UK tax law requires — for a sole trader, at least 5 years after the 31 January filing deadline for the tax year, longer if there's an enquiry.
- Usage records and app feedback: up to 24 months.
- Server logs (which include IP addresses): up to 30 days.
- Support emails: as long as needed to deal with your request, and no more than 24 months afterwards.
- Location checks: as described above.
Closing your account doesn't require us to erase records the law requires us to keep; anything kept is used only for that purpose. Our providers may keep data under their own legal obligations.
Cookies and device storage
- Login cookie ("session") — keeps you signed in; lasts up to 14 days.
- Appearance setting — your browser remembers light or dark mode (until you clear it).
- Partner-link setting — remembered for the current browser tab only.
- Cloudflare — security cookies (for example __cf_bm, about 30 minutes) and the Turnstile robot check.
- Checkout — Stripe and Onelink pages set their own cookies on their own sites.
- The app stores your settings and sign-in on your phone.
These are all needed for the service, so they don't need consent. The website has no advertising cookies or cross-site trackers. In the Android and iOS apps, free accounts may see Google ads where enabled: Google asks for your choice first and you can change your mind (see Google AdMob above).
eBay links
Some links to eBay are eBay Partner Network links. If you follow one and make a qualifying purchase, eBay may pay Foragic a commission. It doesn't change the price you pay or what the seller receives. eBay handles your visit and the commission tracking under its own privacy and cookie notices.
Your rights
Depending on the circumstances, you can ask to see your data, correct it, get a portable copy, delete it or restrict its use. You can object to processing based on our legitimate interests; we'll stop unless we have a lawful reason to continue. Where we rely on consent, you can withdraw it at any time. Device permissions can be changed in your device or browser settings.
Email [email protected] to use your rights. We normally reply within one month (we'll explain if a complex request needs longer) and may ask you to confirm who you are. Account deletion: Delete your data.
If you're unhappy with how we've handled your data, tell us and we'll look into it. You can also complain to the Information Commissioner's Office: ico.org.uk.
Children
Foragic is for people aged 18 and over. If you think a child has made an account, tell us and we'll deal with it.
Changes to this policy
We'll update this policy when how we handle data changes. For important changes, we'll tell you in the app or by email before they apply, and ask for consent where it's needed. The date at the top shows the latest version.