Privacy policy

Who we are

SNYPD is a web service that watches the Vinted searches you save and alerts you when new matching listings appear. The operator named below decides why and how your personal data is used (the "controller" under the GDPR).

SNYPD is independent and not affiliated with or endorsed by Vinted.

What we collect

ACCOUNT

• Your email address and a password, which our database provider stores only in hashed form. We never see it.
• If you sign in with Google: the name, email address and profile picture link Google shares with us.
• The plan you picked before signing up, and the partner code if you arrived through a partner link and allowed marketing cookies.
• Your founding-member number, if you are one of the first 100 accounts.
• If you arrived through a link with campaign tags in the address (for example one of our ads): those tags, which name the source, campaign and ad, not you. They come from the link only; nothing is stored on your device for this.

WHAT YOU DO IN SNYPD

• The Vinted search links you save, their names and whether they are paused.
• Listings you mark as bought or sold, with the prices you enter.
• Points, streaks and ranks, including how many seconds per day your dashboard is open (this decides streaks).
• Your alert settings, such as quiet hours.
• While your dashboard is open it tells our server every 30 seconds that you are online, so monitoring runs for you.

ALERTS

If you turn on alerts, the push address your browser creates, its encryption keys and your browser's user-agent string.

PAYMENTS

Payments are handled by Whop. We never see your card details. Whop tells us your membership and plan, its status, the renewal date and the email address used at checkout, so we can give your account the right plan.

TECHNICAL

• Our server's access logs: IP address, time, the address requested and browser details.
• Our database provider's sign-in records, which include the IP address of each sign-in.
• When someone opens a partner link: the partner code and the page they came from. No identifier of the visitor is stored with it.

ONLY WITH YOUR CONSENT

Google Analytics, the Whop pixel and the Meta Pixel. See the cookie policy for exactly what they store.

WHEN YOU CONTACT US

What you write to us by email or in our Discord server, and your contact details.

Why, and the legal basis

• To run the service you signed up for: your account, searches, alerts, dashboard, plan and payments. Legal basis: the contract with you (GDPR article 6(1)(b)).
• To keep SNYPD secure and working: server logs, sign-in records, preventing abuse and fixing faults. Legal basis: our legitimate interest in a secure, working service (article 6(1)(f)).
• To see which ads and links bring sign-ups, using the campaign tags above. Legal basis: our legitimate interest in knowing which marketing works (article 6(1)(f)).
• To credit partners who send you to SNYPD, and to count partner-link visits. Legal basis: our legitimate interest in running the partner programme, and your consent for anything stored on your device.
• Analytics and ad measurement. Legal basis: your consent (article 6(1)(a)), which you can withdraw at any time in the cookie settings.
• Invoices and tax: keeping payment records the law requires. Legal basis: legal obligation (article 6(1)(c)).
• Replying to you when you contact us. Legal basis: our legitimate interest in answering, or the contract if it concerns your account.

We do not sell your data, and we make no decisions about you by automated means that have legal or similarly significant effects.

Data from Vinted

To find listings and build price estimates, SNYPD reads public Vinted search results: titles, prices, brands, sizes, condition, photos and links. These can include the seller's public Vinted username and account number. We use them only to show matching listings and to calculate market prices, never to follow or profile a specific seller. SNYPD rejects saved searches that point at a seller's profile instead of a catalogue search. Market-price data is deleted after 14 days. Legal basis: our legitimate interest in providing the service. If you are a Vinted seller and want to object or ask what we hold, email us.

Who helps us

These providers process personal data for us, each only for the purpose listed:

• Supabase: database and sign-in. Our database runs in the EU (Paris).
• IONOS: the server that runs monitoring and alerts, in Frankfurt, Germany.
• Vercel: hosts this website and delivers it through its global network.
• Whop: checkout, payments and subscriptions. Its checkout, which loads only when you open one, also runs Whop's own measurement script. The Whop pixel on the rest of the site runs only with your consent.
• Meta: the Meta Pixel, only with your consent. It tells Meta which SNYPD pages you visit and that a sign-up happened, so we can see which Facebook or Instagram ads work.
• Google: sign in with Google, Google Analytics (only with consent) and, in Chrome, delivery of alerts. Other browsers deliver alerts through their maker's push service, such as Apple, Mozilla or Microsoft.
• jsDelivr: delivers the sign-in library to your browser.
• Discord: only if you join our Discord server.
• Gmail (Google): if you email us.

We may also disclose data if the law requires it, or to protect our rights in a dispute.

Outside the EU

Several of these providers are based in the United States or use servers outside the European Economic Area. Where data leaves the EEA, the transfer relies on the safeguards the provider offers, such as certification under the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep it

• Account and everything in it: while your account exists. When you ask us to delete it, we delete it within 30 days.
• Listings shown in your feed: removed automatically within an hour.
• Market-price data: 14 days after a listing was last seen.
• Push address: until you turn alerts off, or your browser tells us the address no longer works.
• Server logs, including access logs: emptied automatically on the 1st of every month, so they are never more than about a month old.
• Payment records: as long as tax law requires, which in Belgium is up to 10 years.
• Emails and support messages: as long as needed to help you, then up to one year.

Your rights

You can ask us to show you the data we hold about you, correct it, delete it, limit how we use it, or give it to you in a portable format. You can object to uses based on our legitimate interest, and withdraw consent at any time without affecting what happened before. Email snypd@gmail.com from the address on your account. We answer within one month.

If you think we handle your data wrongly, you can complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or the authority where you live.

Security

Traffic to SNYPD is encrypted, passwords are stored only in hashed form, and database rules make sure each account can only read its own data. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authority as the law requires.

Age

SNYPD is for people aged 16 and over. If you believe a younger child has given us personal data, email us and we will delete it.

Changes

When this policy changes, the date at the top changes too. If a change matters for how we use your data, we will tell you by email or in the dashboard before it takes effect.