Treasure Scout

Privacy Policy

Last updated 23 September 2026

Treasure Scout helps people find and post local garage sales, curbside pickups, giveaways and estate sales. This policy explains exactly what the app collects, why, and what you can do about it. It is written to be read, not to be impressive.

The short version. We store the account details you type in and the locations of listings you post. Your location is used on your device to show nearby sales and is not stored unless you post a listing. We do not sell your data, we do not run ads, and there are no third-party analytics or tracking SDKs in this app.

1. Who we are

Treasure Scout is operated by an individual developer based in California, USA. For any privacy question or request, email privacy@azzalinko.tech.

2. What we collect

Data	Why	Required?
Email address	To identify your account, let you sign in, and send password resets. Also used to send you new-listing alerts only if you switch them on — they are off by default, and you can turn them off at any time under Account > Alerts	Yes
Username	Shown as the author of listings you post	Yes
Password	Stored only as a bcrypt hash — never in readable form	Yes
Display name, bio, phone, location text	Optional profile details you choose to add	No
Profile photo	Optional avatar. Re-encoded on upload, which strips EXIF and any embedded GPS data	No
Listing coordinates	The location of a sale you post, so others can find it	Only if you post
Device location	Used on your device to centre the map and sort results by distance	No
Alert area	Only if you turn on new-listing alerts: a single coordinate pair and a radius you choose, stored so we can work out which new listings are near you. The point comes from your device when you tap “Use my current location”; if you haven’t, we use the centre of the town you entered in your profile, looked up with OpenStreetMap’s Nominatim service (only the town name is sent). It is a fixed point, not continuous tracking — we do not follow your device. Deleted when you turn alerts off or delete your account	No
Two-factor secret	Only if you enable 2FA	No
IP address	Recorded in our server request log (see Server logs below) and held briefly in rate-limit counters, to prevent abuse and diagnose problems. Separately, the IP address and time of your most recent successful sign-in are stored on your account and visible only to an administrator, to help detect unauthorised access; each new sign-in overwrites the previous one	Automatic
Activity dates	So we can see how many people use the app, we record the date on which your account was active (one row per account per day) and the time you were last seen. This table records only when, with no IP address and no record of what you looked at. It is visible only to an administrator as a total count, and rows are deleted after 180 days	Automatic

Your device location

When you open the app it asks permission to read your location. That coordinate is used in your browser or on your phone to centre the map and to sort sales by how close they are. It is not written to our database. If you decline, the app falls back to a default map centre and everything still works.

The one exception: when you deliberately post a listing, the coordinates you choose for that listing are saved — that is the entire point of the listing, and those coordinates are visible to other users.

3. What we do not do

We do not sell or rent your personal data to anyone.
We do not show advertising.
We do not embed third-party analytics, advertising or tracking SDKs.
We do not build advertising profiles or track you across other apps or websites.
We do not use your data to train machine-learning models.

4. Third parties that necessarily see some data

Because the app renders a map, your device requests map tiles from OpenStreetMap (basemap imagery). Those requests come from your device and therefore expose your IP address and the map area you are viewing to the OpenStreetMap Foundation, under their privacy policy. We send them nothing about your account.

No other third-party service receives your data. The application and its database run on hardware operated by us.

5. Where data is stored and how it is protected

All traffic is encrypted in transit with HTTPS/TLS.
Passwords are hashed with bcrypt and are not recoverable, by us or anyone.
Optional two-factor authentication (TOTP) is available on every account.
Uploaded images are re-encoded server-side, which removes EXIF metadata including any GPS coordinates your camera embedded.
Administrative access is restricted to specific network addresses in addition to requiring an administrator account.
Data is stored on servers located in the United States.

6. How long we keep it

Account data — until you delete your account.
Listings — until you delete them, or your account.
Server logs — a request log recording the time, IP address, account (if signed in), the page or API address requested, the result and your app/browser version. It never contains passwords, search terms, listing text or anything you type. Kept for 30 days and then deleted automatically; used only for security and fixing problems, never for profiling or advertising.

Deleting your account removes your profile, your listings and your avatar. That action is immediate and cannot be undone.

7. Your rights and controls

Inside the app, under Account, you can at any time:

See and edit everything on your profile
Change your password or enable two-factor authentication
Remove your profile photo
Delete individual listings
Delete your account entirely, with all associated data

Depending on where you live you may also have rights to access, correct, export or erase your data, and to object to processing — including under the GDPR (EEA/UK) and the CCPA/CPRA (California). Email privacy@azzalinko.tech and we will respond within 30 days. We do not discriminate against anyone for exercising these rights.

California residents: we have not sold or shared personal information for cross-context behavioural advertising, and we have no "Do Not Sell" flow because there is nothing to opt out of.

8. Children

Treasure Scout is not directed at children and is not intended for anyone under 13 (or under 16 in the EEA/UK). We do not knowingly collect data from children. If you believe a child has created an account, email us and we will delete it.

9. Public information — please read

Anything you put in a listing is public: its title, description, address, coordinates and the username that posted it. Do not enter an address you are not willing to publish. If you would rather not pinpoint your home, place the marker at a nearby cross-street instead.

10. Changes to this policy

If this policy changes materially we will update the date at the top and, where the change is significant, notify you in the app. Continuing to use Treasure Scout after a change means you accept the updated policy.

11. Contact

Privacy questions, data requests or complaints: privacy@azzalinko.tech.