Privacy Policy
Last updated: 14 September 2026
Draft. A Washington-licensed attorney should read this before it goes live.
This site exists to empty one condo. Everything it collects, it collects for that. When the stuff is gone, the site is deleted and so is your data.
Who runs this
Grayson Hay, an individual in Seattle, Washington, USA. Questions, or you want your data gone early: grayson@grayson.llc.
There is no company behind this, no marketing list, no analytics, no ad trackers, and nothing is sold to anyone.
What gets collected
| What | How | Why | How long |
|---|---|---|---|
| Your name, email address, and Google account ID | Google sign-in, when you choose to sign in | So a request has a real person attached and I can email the person I pick | Until the site shuts down |
| Your request: which item, your message, the price you offered | You typed it into the request form | To decide who gets the item | Until the site shuts down |
| The date you agreed to the Terms, and which version | The button you tapped the first time you signed in | So there is a record of what you agreed to, if it is ever in question | Until the site shuts down |
| A session cookie | Set when you sign in | To keep you signed in | 30 days for requesters, 90 days for the owner, rolling |
| A short-lived sign-in cookie | Set for the duration of the Google redirect | To stop someone else's sign-in being stitched onto your browser | Minutes |
| Server logs: IP address, browser user agent, the URL you asked for, the time | Automatically, by the web server | Running and debugging the site | Kept in the container log, gone when the deployment is |
That is the whole list. Browsing the public grid takes no sign-in and collects nothing but the server log line.
No advertising cookies. No third-party analytics. No tracking pixels. Nothing loads from a third-party CDN. The service worker the site registers is inert.
Who else sees it
- Google, because sign-in goes through Google. Google knows you signed in here. Their handling of your Google account is theirs, under Google's privacy policy.
- Resend, which delivers the handful of emails this site sends. They see your email address and the message body. Their handling of it is theirs, under Resend's privacy policy.
- Nobody else. The database and the photographs live on a server in my home, behind Traefik and TLS. There is no cloud host, no CRM, no support desk, no data broker.
The site uses the Anthropic API to draft descriptions and price guesses. It sends photographs of my furniture. It never sends your name, your email, or your message.
Email you will get
Transactional only. Your request was received, you got the item, the item is gone. No newsletter, no "we miss you," nothing to unsubscribe from, because there is nothing to be subscribed to.
What I will never publish
Your name, email address, and message go to me and stop there. Requests are not public. Other requesters do not see who else asked or what they offered.
Your rights
Ask and I will do it. Email grayson@grayson.llc and I will tell you what I hold about you, correct it, or delete it. No form, no verification theater. If you have a request open and ask for deletion, the request goes with it.
If you are in the EU or the UK, the GDPR gives you these rights formally, plus the right to complain to your data protection authority. This site is aimed at people who can drive to Seattle and carry a dresser, so EU users are not expected, but the rights stand if you are one.
California's CCPA and CPRA do not apply here. Those laws start at $25 million in annual revenue, 100,000 California consumers, or half of revenue coming from selling personal information. This is one person selling a couch. It meets none of them. Your data is not sold or shared for advertising in any case.
Children
Not for anyone under 18. Do not sign in if you are under 18. If I find out I am holding data from a child, I delete it.
Security, honestly stated
HTTPS everywhere, with certificates from Let's Encrypt. Session cookies
are HttpOnly, Secure, SameSite=Lax.
The session token in your cookie is stored only as a SHA-256 hash, so a
copy of the database does not hand anyone a live session. Signing out
deletes the session row immediately.
The database and the photographs are backed up nightly to storage off the server. Those backups contain your data until the shutdown described below.
It is a home server run by one person. It is reasonably locked down. It is not a bank.
The end, which is the point
When the condo closes, the archive I keep is a CSV of items, the photographs of my things, and a database dump with the user and request tables left out on purpose. Then the deployment is deleted.
Your name and email address came from you for one local transaction. They are not going to sit in a tarball on a NAS forever.
Target shutdown: [PLACEHOLDER: closing date].
Changes
If this changes, the date at the top changes and the new version replaces this one at the same URL. Given the site's lifespan, expect approximately zero changes.