Privacy policy
This policy explains what eBay data the service reads, how it creates your estimate, and how the connection is retained.
What the service accesses
When you connect, you sign in directly with eBay and authorize this service to read account data. We do not receive your eBay password. To create the report, we retrieve your basic account identity and registration marketplace, seller-standards profile, the previous 90 days of financial transactions and billing activity, and the previous 90 days of return requests and return details. We use those responses to identify eligible final value fees and credits, Top Rated discount activity, buyer-remorse returns, and return-label payer and cost. eBay's responses may contain additional account, transaction, order, and return fields that are not used in the calculation.
Read-only access
The service makes read-only requests for account data. It cannot edit listings or return policies, approve or deny returns, issue refunds, send messages, purchase labels, change payout settings, or move money.
How the data is used
The data is used only to build the savings report you request, protect the connection, diagnose failures, and operate the service. We do not sell eBay account data or use it for advertising.
Storage and retention
Raw eBay responses are processed in memory and are not written to a seller database. The completed aggregate report is held in the current browser page and may also be encrypted with AES-256-GCM and cached for up to 10 minutes; it is not retained as report history. Refresh and short-lived access tokens are encrypted with AES-256-GCM before being stored in Upstash Redis. The server enforces an absolute connected session lifetime of no more than one hour.
The browser receives only a random, opaque, host-only session identifier in an HttpOnly, SameSite cookie. In production the cookie is also Secure and uses the __Host- prefix. The service uses pseudonymous session and IP-derived identifiers for throttling connection and analysis requests. Single-use OAuth connection state expires after 10 minutes. Vercel, the service's hosting provider, and Upstash, the Redis server-store provider currently used on its Free plan, may retain limited request, security, or operational metadata under their respective policies and settings.
Disconnecting and deletion
Selecting Disconnect first deletes the encrypted server-side session and cached analysis, then asks eBay to revoke the refresh token and clears the browser session cookie. You can also remove the app from your eBay third-party application permissions. Because the app does not persist raw seller data or report history, there is no saved report archive to delete.
The service also receives eBay Marketplace Account Deletion notifications at a dedicated endpoint and validates eBay's digital signature before acknowledging them. A verified notification deletes every linked active session and cached analysis for the identified eBay account. The deletion is safe to repeat if eBay retries the notification.
Sharing and service providers
Account data is sent to eBay to complete authorized API requests and may be processed by Vercel as the infrastructure provider that hosts the service and by Upstash as the encrypted session and short-lived aggregate-cache provider. It is not shared with unrelated third parties except when required by law or necessary to protect the service and its users.
Service operator and contact
This service is operated by Joe, who publishes as Profit First Reseller on YouTube. For privacy questions, support, or data requests, email profitfirstreseller@gmail.com.
Changes
This policy may change as the service adds production infrastructure or saved features. Material changes will be reflected by a new effective date and, when appropriate, an in-product notice.