Privacy Policy
Last updated: 15 September 2026 (privacy-2026-09-v1). This notice explains what WyCo Stashery ("Stashery", "we") collects about you, why, who else is involved, how long we keep it, and what you can ask us to do. Stashery is in closed beta; where a feature described here is not yet switched on (paid plans, push notifications), the section says so.
Who we are
WyCo Stashery is operated by Ben Coton, trading as WyCo Digital, a sole trader based in England. We are the "controller" of your personal data under UK data protection law. Our correspondence address is available on request from the privacy mailbox below. Privacy enquiries: privacy@wyco-digital.co.uk.
What data we collect
The categories below are the ones Stashery actually handles today.
Account details — the email address you sign in with, the one-time sign-in codes and links we send to it, a password if you set one (stored only as a hash), and technical details of each sign-in session (IP address, browser or app version). We also record which version of these terms you accepted and when.
Photos and video — the images and clips you upload of your items, together with anything visible in them. We ask you not to upload photos of people.
Inventory you enter — items, descriptions, costs, prices, notes, labels, job lots, repair records, and for collectors the "wants" you set up.
Linked eBay account data — if you connect eBay: your eBay username, the access tokens that let Stashery act on your behalf (stored encrypted), and the listings, sales, fees, traffic figures and business policies Stashery reads from your account.
Sales records — for each eBay sale: the item, price, fees, quantity and date. We are designed to store the sale, not the buyer: we do not store buyers' names, addresses or contact details.
Problem reports — if you report a problem from inside the app: what you wrote, an optional screenshot, and technical details (which screen, app version, recent errors).
Error reports — when something goes wrong, our error-monitoring service records the technical failure and the screen you were on.
Usage analytics — which screens are opened and which actions are used, tied to an anonymous device identifier and, once you sign in, to your account's internal ID (never your email address), so we can see which features are used. We do not use advertising trackers.
Payment details — not yet applicable. When paid plans open, our payment provider will handle your card details directly; Stashery will hold only your email, which plan you are on and the identifiers needed to manage it.
How we use it
Running the service for you (the legal basis is our contract with you): signing you in, storing your inventory and photos, syncing with eBay, publishing listings you compose, tracking your sales, sending you the emails the service needs (sign-in codes, and — if you set up wants — match digests).
AI photo identification: when you use the scan feature, the photos you chose and any notes you typed are sent to Anthropic's Claude API, which drafts the item record for you to review. This happens only when you press scan; nothing is analysed in the background. Anthropic's API terms do not permit it to train on your inputs.
Pricing research: to suggest a price we look up what the same model recently sold for on eBay. The only thing sent to that lookup is a search phrase (for example "hornby class 47"), never your data. The results are public listing data and are shared across all Stashery users so the same model is not looked up twice.
Keeping the service working (legitimate interests): diagnosing errors, fixing the problems you report, understanding which features are used. You can ask us to stop analytics for your account (see Your rights).
Support: Stashery is run by one person. To help you with a problem we may look at your data directly, or sign in to your account with your permission. We do not yet keep an automated record of such access; we will tell you when we do.
We do not use your data for advertising, we do not sell it, and no decisions with legal or similarly significant effects are made about you automatically. Suggested prices and "good buy?" verdicts are research aids for you to act on.
Who we share it with
We use the following companies to run Stashery. Each receives only what its job needs and is bound by a contract that includes the UK's approved terms for handling personal data: Neon (database hosting), Vercel (application hosting, London region), Cloudflare (photo and video storage), Resend (sending email), Anthropic (AI photo identification, only when you use it), Mux (converting listing videos to eBay's format), Apify (running the sold-price search — receives only the search phrase), Sentry (error monitoring), OpenPanel (usage analytics, hosted in the EU), GitHub (where problem reports you send us are stored, privately), and, when paid plans open, Stripe (payments). Some of these companies are in the United States; where data leaves the UK, the transfer is covered by the UK's approved safeguards (the UK Extension to the Data Privacy Framework or the UK Addendum to standard contractual clauses).
eBay is not our supplier: it is a separate service with its own privacy notice. When you connect your eBay account you allow Stashery to read from and write to it within the permissions you grant on eBay's consent screen, and eBay's terms continue to apply.
Google (Firebase) and Apple will be added to this list when push notifications are switched on; the notice will be updated first.
We do not sell personal data.
How long we keep it
While your account exists, we keep your account, inventory, photos, listings and sales records so the service works. When you delete your account, everything in it is deleted within 30 days (see Your rights), and Stashery's access to your eBay account ends: the access token we held is destroyed (you can also remove Stashery from your eBay account's app permissions on eBay). Buyer details from eBay orders, if any are held, are removed no later than 90 days after the sale. Error reports are kept for 30 days and usage analytics for 12 months. Problem reports are kept for 12 months after they are resolved. If you pay for a plan, billing records are kept for six years as tax law requires. Sold-price research data contains no personal data and is not tied to your account.
Your rights
Under UK GDPR you can ask to see the data we hold about you, have it corrected, have it deleted, receive a copy in a portable format, or object to a particular use of it.
Most of this you can do yourself: everything you entered can be edited in the app; you can disconnect eBay from Settings at any time; you can delete individual photos and items; and from Settings › Profile you can export everything in your account as a download, or delete your account entirely.
To object to usage analytics, email us and we will switch it off for your account.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.
Contact
Our correspondence address is available on request from the privacy mailbox below. Privacy mailbox: privacy@wyco-digital.co.uk. We will reply to rights requests within one month.