Upcyclist is operated by Touring605 LLC ("we," "us," or "our"), a U.S. company. When this policy refers to "Upcyclist" or the "Service," it means the Upcyclist App website, mobile applications, and any related services.
Questions about this policy? Email us at support@turing605.com.
When you create an account we collect your email address and a hashed password. You may optionally provide a business name, profile handle, and location.
All inventory items, sales records, expenses, buyers, and settings you enter in the app are stored in our database and associated with your account.
If you add photos to inventory items, those images are uploaded to and stored on our cloud storage provider.
We collect limited diagnostic data to keep the app stable. If the app crashes, a report containing the error message, JavaScript stack trace, component trace, and platform (iOS/Android/web) is sent to our internal monitoring system. We do not use behavioral analytics or session-recording tools. Our marketing website and sign-up/checkout flow use Google Ads conversion tracking as described in Section 7.
We do not store full payment card details. Stripe processes payments on our behalf and provides us with a non-sensitive token and subscription status only.
We use the data we collect to:
We retain your account and business data for as long as your account is active. When you permanently delete your account (Settings → Data & Export → Delete Account), all associated records — inventory, sales, buyers, expenses, categories, photos, and sessions — are deleted immediately. Anonymized audit-log entries (recording the action type and timestamp, with no user identifier) may be retained for security and compliance purposes.
We may retain anonymized or aggregated data that cannot identify you.
You may request a full export of your data at any time from the app's Settings → Data & Export screen. You may also permanently delete your account and all associated data from the same screen.
We do not sell or rent your personal data. We share data only in these circumstances:
We use the following third-party services to operate Upcyclist. Each subprocessor is contractually bound to protect your data.
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Replit | Hosting & infrastructure | All app data at rest and in transit | United States |
| Stripe | Payment processing (web subscriptions) | Email, billing details, subscription status | United States |
| Apple App Store | iOS in-app purchase verification | Transaction ID, receipt | United States |
| Google Play | Android in-app purchase verification | Purchase token, order ID | United States |
| Klaviyo | Marketing email (lead-capture opt-in only) | Email address | United States |
| Gmail (Google) | Transactional email (verification, password reset) | Email address, message content | United States |
| Cloudflare R2 | Photo storage | Inventory item photos and profile avatar | United States |
| OAuth sign-in (optional) | Google account ID, email address | United States | |
| Google Ads | Conversion tracking on the marketing website (sign-up & checkout) | Conversion event, referring ad campaign, cookies — no account or financial data | United States |
| Open Food Facts / Open Beauty Facts / UPC Item DB | Barcode product lookup | Barcode string only (no account required) | Public API |
Web app: We do not use cookies for authentication. Authentication on the web is handled via JWT tokens sent in HTTP Authorization headers — not stored in cookies.
Mobile app: The app stores data locally on your device using encrypted on-device storage. This includes your authentication token, app preferences, and a local cache of your business data for offline use. This storage is accessible only to the app and is never shared with advertisers.
Marketing website & Google Ads conversion tracking: Our public marketing website (this page and the sign-up page) uses Google Ads conversion tracking (Google's "gtag.js" tag) to measure whether visitors who arrive from a Google Ads campaign go on to create an account or start a paid subscription. This tag may set first- and third-party cookies in your browser and can share limited, non-identifying signals (such as the fact that a conversion occurred and which ad campaign referred you) with Google. We do not send Google your name, email address, or any inventory, sales, or financial data. This tracking is scoped to the marketing website and sign-up/checkout flow only — it is not present anywhere else in the app. See Google's own Advertising Privacy & Terms for how Google handles this data. We do not use session-recording tools or any other third-party advertising or analytics technologies beyond what is described here.
Regardless of where you live, you can:
We do not sell or share your personal information. You have the right to know what personal information we collect, request deletion, and opt out of sale — which we do not engage in.
Our legal bases for processing are: performance of a contract (operating the Service you signed up for), legitimate interests (security, fraud prevention, crash monitoring), and consent (marketing emails). You have rights of access, rectification, erasure, restriction, portability, and objection. To exercise them, email support@turing605.com. If you believe we have not addressed your concern, you may lodge a complaint with your local data protection supervisory authority.
To export or delete your account data, use Settings → Data & Export inside the app. For other requests, email us at support@turing605.com.
We protect your data with:
No system is perfectly secure. If you discover a vulnerability, please report it to security@turing605.com. See also our security.txt.
The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If we learn that an account was created by a child under 13, we will delete the account and its data promptly. If you believe a child has provided us personal information, contact support@turing605.com.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (sent to the address on your account) and/or by an in-app notice at least 14 days before the change takes effect. The updated effective date will appear at the top of this page. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.
Questions about this Privacy Policy? Email us at support@turing605.com.