Privacy

Treasure Sleuth serves the United States only. We don't knowingly collect information from, or serve listings for, locations outside the US.

What we collect from a host: an email address, the sale's address, and any photos you upload. Before we'll review a first-time listing, we send a confirmation link to make sure the email address is really yours — a one-time step; later listings from the same address skip it. If you haven't confirmed within a day, we'll send one reminder; if we still haven't heard back within a week of your original submission, the listing is automatically closed out (you're welcome to resubmit any time). Photos are stripped of all metadata, including GPS location, before they're shown publicly — including metadata from inside the photo itself, not just what you typed.

Address disclosure. For yard and garage sales, we publish the full address while the listing is active — that's the point of the site. Once a sale ends, the page stops showing the address the same day, and the address itself is permanently deleted from our database within 24 hours after that. Flea market addresses are public business information and are never removed this way.

Reports. If you report a listing (no-show or content issue), we store a salted, non-reversible identifier derived from your IP address — not the address itself — to prevent abuse of the reporting tool.

If you sign up for email alerts, we store your email address and the search location and radius you asked to be notified about. Nothing sends until you confirm via the link we email you; every alert email includes a one-click unsubscribe that deletes your subscription immediately. A signup that's never confirmed is automatically deleted after 7 days.

Rate limiting. To prevent abuse, some actions (posting a listing, uploading photos, sending a site message) briefly record your IP address against the specific action you took, for up to 48 hours, purely to cap how often it can be repeated. This is separate from the reports described above, which never store your IP directly.

If you submit a listing, we also separately record the IP address and browser/device information (User-Agent) you submitted it from, kept for up to two weeks after the listing ends. This is solely so we can investigate a listing that turns out to be fraudulent or to use an address without the resident's permission — it's not shown publicly, and it's deleted automatically once that window passes. While a listing is awaiting review, we also do a rough, automated check of whether the submitting IP's general location is consistent with the address being claimed, to help flag listings that need a closer look.

How long we keep things. A host's email is tied to their host record, not any one listing — it isn't deleted when a listing expires or its address is purged, since it's how we notify you about that listing or let you manage others. An uploaded photo's original file is deleted as soon as it's processed; only the resized copy — with all metadata, including GPS, already stripped — is kept, for as long as the listing exists. The submission IP address described above is deleted two weeks after the listing ends, on its own separate schedule.

Who else touches this data. We use a small number of service providers to run the site, none of whom may use your data for their own purposes:

• Supabase hosts our database — listings, host and alert-subscriber emails, and the abuse-prevention data described above all live here.
• Cloudflare stores uploaded photos (R2) and runs the automated process that resizes them and strips metadata (Workers) — this process never touches any other data.
• Resend sends the emails described on this page and in our Terms on our behalf.
• Sentry receives error reports if something on the site breaks, which may include your IP address and the page or request that failed.
• The US Census Bureau's geocoding service converts a submitted address into map coordinates when you post a listing — free, keyless, and not shared by us for any other purpose.
• ip-api.com looks up the rough location of a listing's submission IP address while it's awaiting review, for the fraud-check described above — the IP address is the only thing sent to them.
• OpenStreetMap supplies map tiles for the pin-drop map shown on the rare occasion automatic address lookup fails.
• Vercel Web Analytics counts page views and searches on an aggregate basis — cookieless, and not used to track you individually across sites.

Questions about your data — contact us.