Plainly, what we store and where it goes.
We collect the least we can to make Pricesweep work, and we tell you exactly what that is. You can delete everything from the profile menu, instantly.
Who's responsible
Pricesweep is operated as a personal project by an individual based in the United Kingdom (not a registered company). If you have a privacy question or want to exercise your rights under UK GDPR, please use the contact form. You can also delete your account and all associated data instantly from the profile menu (see Your rights below).
What we collect and where it goes
We collect the minimum needed to identify items, return prices, and (if you're signed in) sync your saved list across devices. Photos are transient: we send them to OpenAI for identification and don't store them.
| What | Where it goes / how long |
|---|---|
| Photo you upload | Sent to OpenAI's vision API for identification, then discarded. Not stored by us. OpenAI's privacy policy applies in transit. |
| Identified item titles, categories, prices | Your browser sends the item title or barcode straight to CEX's public product search, the same one uk.webuy.com uses, so CEX sees that request come from your connection as it would any visit to its site. We receive CEX's results only to pick the matching item. |
| Lookup outcomes | For each price lookup we record whether it got a price, against a salted one-way hash of your network (the first part of your IP address), never the address itself. Kept for three days and used only to notice when CEX stops returning prices. |
| Google sign-in outcomes | Each time someone taps "Continue with Google" we add one to a monthly count of how it ended (signed in, cancelled, or the error), split by page and by whether it was a browser tab, the home-screen app or an app's built-in browser. Only the totals are kept: nothing about you, your account or your IP address. Used only to notice when sign-in fails on some phones. |
| Your email + account ID | Held by Firebase Authentication (Google) for the duration of your account. Used to sign you in, attach your saved list to you, and email you reset links. |
| Your saved items | Stored in our Firestore database, keyed by your user ID. Visible only to you (and to anyone signed into your account). |
| Free trial photos (not signed in) | So that clearing your browser doesn't reset the free trial, we also count trial photos on our server, against a salted one-way hash of your IP address, never the address itself. Each day's count is deleted after three days. |
| Free trial steps | The first time a device reaches each step of the free trial (a first photo, items found, a price shown, the trial used up, opening sign-in, making an account, coming back another day) we add one to that day's total. Only the totals are kept: nothing about you, your account or your IP address. Your browser remembers which steps it has already counted and the day you started, so each is counted once. Used only to see where the trial loses people. If you choose No thanks on the analytics banner, nothing is counted and your browser keeps no record of the steps. |
| Monthly scan counter | Stored in Firestore so we can enforce the free-tier 10/month and Pro 250/month caps. Counter doc auto-expires after six months. |
| Subscription / card details | If you upgrade to Pro or Power Seller, Stripe processes the payment. We see your Stripe customer ID and subscription status, never your card details. |
| Cookies / local storage | Firebase sets one auth cookie to keep you signed in. We use browser local storage for your saved list (offline), your trial photo counter, which trial steps have been counted, and your shop code if connected. No third-party tracking cookies. |
| Server logs | IP address + request path retained by Google Cloud Run for 30 days, used for debugging and rate-limiting. Never linked to your identity in a way that's queryable. |
| Error reports | If something crashes we send a stack trace to Sentry so we can fix it. We scrub IP addresses, auth tokens, and request bodies before it leaves your browser, so no personal data or photos go with the report. 90-day retention by Sentry. |
| Bulk barcode list (opt-in, Power Seller) | The bulk pricing page reads your spreadsheet in your browser — the file itself is never uploaded, and we only ever see batches of barcodes in flight. If you choose to save your list, we store the barcodes and their latest CEX prices against your account so you can re-price them later and see what's changed. It's opt-in, we ask before the first save, and "Delete list" on that page removes it from our servers for good. |
| Bad-match feedback (opt-in) | When you tap "Report a bad match", we ask permission before sending the photo and the wrong match details to our private storage bucket. You can decline and the row just disappears. If you share, we use it to improve the matcher and delete it after 180 days. |
| Analytics | If you accept the cookie banner we load Google Analytics 4 to count visits and see which pages get used. IPs are anonymised, ad-personalisation signals are disabled, and there's no cross-site tracking. Decline and nothing loads. You can change your mind anytime from the burger menu → Cookie settings. |
Your rights
Under UK GDPR you can ask us to access, export, correct, or delete any data we hold about you. The fastest path for delete:
Open the app → profile icon → Account settings → Delete account. You'll be asked to type your email to confirm. On submit we cancel any subscription, delete your saved list, your Firestore record, and your Firebase user, in that order. The whole flow takes seconds and can't be undone.
For access, export or correction, use the contact form or email hello@pricesweep.co.uk. The delete flow above gives you erasure immediately. You're entitled to lodge a complaint with the ICO if you're unhappy with how we've handled your data.
Children
Pricesweep isn't directed at people under 16 and we don't knowingly collect data from children. If a child's account is set up by mistake, the in-app delete flow removes all of its data immediately.
Changes to this notice
If we change what we collect or who we share it with, we'll update this page and, for anything material, notify signed-in users by email.