Privacy

The short version: no ads, no tracking across sites. We count visits with Cloudflare Web Analytics, in Europe only if you say yes. We store what you post so the app works, and an email address only if you add one.

Who's responsible

Wu GangAm Molkenbrunnen 2164287 DarmstadtGermanyhello@shouldicop.com

Visiting the site

The site is hosted by Vercel Inc. (USA). To deliver pages, Vercel processes your IP address, the page you ask for, the time and your browser's user agent, and keeps them in server logs for a short time. We need this to run the site and keep it secure (Art. 6(1)(f) GDPR, our legitimate interest in a working, secure site).

Visitor statistics

We use Cloudflare Web Analytics by Cloudflare, Inc. (USA) to count visits and see how fast pages load. A script from Cloudflare sends it the page you're on (without anything after a “?”), the page you came from, your browser, operating system and type of device, and load times. Cloudflare uses your IP address to receive this and to tell which country you're in. It sets no cookies, stores nothing in your browser and doesn't follow you to other sites. We only see totals, never individual visitors.

In the EU, the EEA, the UK and Switzerland the script only loads once you say yes on the banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Elsewhere it loads unless you say no. You can change your answer at any time under “Analytics” at the bottom of every page; saying no later doesn't affect what was sent before.

Posting and voting

The first time you post an item or vote, your browser gets an anonymous account from Supabase Pte. Ltd. (Singapore), which hosts our database, sign-in and photos on servers in the USA. The account has a random ID, not your name. We store what you enter: the item's name, price, reasons, alternative, link and photo, your cooldown and what you decided and, later, whether it was worth it; and your votes (buy or wait, with an optional reason). We also store the language you use the site in, so emails reach you in it. Supabase also logs the IP address of sign-ins to limit abuse. Without this the app can't work (Art. 6(1)(b) GDPR).

Photos are resized in your browser before upload, which removes hidden metadata such as the location.

Who sees what

• Anyone with the link to an item's vote page sees the item, photo included.
• Votes never show who voted. The item's owner, and people who have voted on it, see the votes and their reasons.
• If you leave “Let strangers vote too” on and we approve the item, it shows up on the homepage, and its vote page can appear in search engines such as Google. You can take it off the homepage on your item's page at any time; search engines then drop it.

Your email address

Adding an email is optional. It lets you get your list back on another device, and we send you two reminders: when your cooldown is over and, for things costing 20 or more, 14 days after you buy, to ask whether it was worth it. Sign-in codes are sent through Supabase, reminders through Resend (USA). No newsletters, no marketing (Art. 6(1)(b) GDPR). Don't want the reminders? Email us.

Cookies

We only use the cookies that keep you signed in. They're set when you first post or vote, or when you sign in, and the app can't remember your items or votes without them, so they don't need your consent (§ 25(2) No. 2 TDDDG). If you switch the language, one more cookie remembers your choice, for the same reason. So does a cookie that keeps your answer on the analytics banner for a year, so we don't ask again, and one that visitors outside Europe get until they close the browser, so the banner doesn't ask them at all. No analytics, advertising or tracking cookies.

Emailing us

If you write to us, we use your message and address to answer you (Art. 6(1)(f) GDPR). Mail to hello@shouldicop.com is forwarded by Cloudflare, Inc. (USA) to our Gmail inbox (Google).

Service providers outside the EU

Supabase, Resend and Cloudflare process data for us under data processing agreements. Vercel, Resend and Cloudflare are based in the USA, Supabase in Singapore, and our servers and database are in the USA. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 45 and 46 GDPR).

How long we keep it

Your items, votes and account stay until you ask us to delete them. Server logs are deleted automatically after a short time. Emails to us are deleted once dealt with, unless the law makes us keep them.

Your rights

You can ask for a copy of your data, and to have it corrected, deleted or restricted, or handed over in a machine-readable format (Art. 15–18 and 20 GDPR). You can object to processing based on our legitimate interest (Art. 21 GDPR). Email hello@shouldicop.com; if you never added an email, include the link to your item so we can find your data. You can also complain to a data protection authority (Art. 77 GDPR).

You don't have to give us any data: you can look around without posting. To post or vote, the app needs the data above. We don't make automated decisions about you or build profiles.