Privacy notice

Who is responsible for your data

The data controller is Federico Ragusa, who builds NotDone. For any question about this notice or your data, write to hello@notdone.app.

The waitlist

When you leave your email on the site we keep three things: the address, the language you were reading in, and which part of the page you signed up from. We use them for one purpose: to write to you, in your language, when NotDone opens in your country.

The legal basis is your request: you asked us to let you know. We do not send a confirmation email and do not verify the address, so if you receive a message from us you did not ask for, reply and we remove it.

We keep the address until we have let you know and for six months after that, then we delete it. To leave earlier, write to hello@notdone.app from the same address: we remove it within a few days.

The address is stored on our own server in Finland, in the European Union. We do not pass it on to anyone and do not use it for advertising.

Technical data on the site

The site is served through Vercel. Like every site, it records technical data about visits: IP address, page requested, time, type of browser. They keep the site up and defend it from abuse. Vercel is a US company and may process this data outside the European Union, under the safeguards the European regulation provides.

Visit count. To know how many people reach the site, which page they land on and where they come from, we use Vercel Web Analytics. It sets no cookie and stores nothing on your device: it tells one visit from another by a code worked out from the request, which deletes itself after 24 hours, and it collects the page seen (without what you type in a search), the site you came from, the country, and the type of browser, operating system and device. It does not tell us who you are and does not follow your visits from one day to the next. We do this on legitimate interest, knowing whether the site is of use to anyone, which is why we do not ask for your consent. Clicks out to shops are counted the same way: when you open an offer, your browser sends us only the shop's name and the place on the page you opened it from, nothing about you, and the link takes you straight to the seller.

Errors. When something breaks, on the site or on our servers that answer the site and the app, we send a report to Sentry (Functional Software, Inc.) so we notice and fix it: the error message, the place in the program where it happened, the page (without what you type in the search), the type of browser and system, and the version of the site. We do not send your IP address, cookies or anything from your account, and we do not record what you do on the page. Reports from your browser pass through our own site, so Sentry never sees your address. Sentry keeps them on servers in Germany for 30 days. We do this on legitimate interest, keeping the site and the app working, and so we do not ask for your consent.

The waitlist form goes through our own server, which keeps a technical log of requests with the IP address for a limited time, and in any case no longer than ninety days.

Traffic analytics. If you consent, the site uses Firebase Analytics, by Google, to know which parts of the page are read, in which language, and how many sign-ups arrive. With your yes, Google Analytics sets its cookies (the ones starting with _ga), which recognise your browser on later visits for at most two years; the IP address is not stored and none of this is used for advertising. Until you answer, nothing of Google's is loaded and the site sets no cookie; your answer stays in your browser. You can change it any time at the bottom of the page: with a no we remove the cookies and stop collecting.

Proof of your answer. When you answer the panel we record on our server what you allowed, the date, the language you were reading in and the version of this notice, together with a code your browser generates at random. There is no name, no email address and we do not keep your IP address: that code does not identify you and is tied to no account. It serves one purpose, which the law asks of us: being able to show the question was put and what you answered. We keep it for five years. A no is recorded the same way, because a no has to be respected and shown too.

The typefaces are served by us, not by Google.

When you look at an offer from Vinted or Wallapop, its photo comes from their servers: your browser contacts them and they receive your IP address, just as when you visit their site.

If you write to us

Emails to hello@notdone.app are read by us and kept for as long as it takes to answer you and keep track of the conversation. The mail is hosted by IONOS, in Europe.

The NotDone app, once it is available

The app is not public yet. This part describes how it will treat data, as it is built today; we will update it before opening if anything changes.

Account. To use the app you create an account with email and password, or with Google or Apple. Sign-in goes through Firebase Authentication, a Google service. Of you we keep the account identifier, the email, whether it is verified, and the sign-in dates. The password is kept only in encrypted form.

The items you add. Photos, barcode or ISBN, title, description, condition and price stay on our server in Finland. They give you the reading, the price band and the ready listing. Photos are stripped of the data the phone embeds, such as where they were taken, before they are stored.

Searches. When you search for an item, the text of the search (title, code) is sent to the sources we take offers from: eBay, AbeBooks, booklooker, Google Books, Open Library, Discogs, Maremagnum, Vinted, Wallapop. They receive the search, not your identity.

What you do in the app. We record which offer you open, save or mark as yours, to improve the order of results and understand what works. This data stays on our server.

The marketplaces you connect. If you connect your eBay account, you authorise it with eBay and we keep the access key encrypted, to publish and update your listings when you ask. You can revoke it from the app or from eBay. If you close your eBay account, eBay tells us and we delete what came from there.

Where we walk you. When we take you to another site (Subito, Vinted, Wallapop, Amazon and the others) we open their page: from there on their rules and their notice apply. If you reach an eBay or Amazon offer through one of our links, eBay or Amazon may pay us a commission: the link carries a programme code, not your data.

The map. The map is by Mapbox: when you open it, Mapbox receives your IP address to serve the map tiles. We use your location only if you grant it to the phone, to show what is near you, and we do not store it.

Usage analytics. The app uses Firebase Analytics, by Google, to know which screens are used. We turn it on only with your consent, which you can give and withdraw in the settings.

Photo recognition. Automatic recognition of items from photos is not active. When we turn it on, this notice will say which provider receives the photos and for how long it keeps them.

Deleting the account. You can do it from the app or by writing to us. We delete everything about you within thirty days, except what the law requires us to keep.

Personal suggestions

If you turn on “Remember what you like” in the app or “Remember what you look at” on the site, we put offers like the ones you care about first. In the app it stays off until you turn it on; on the site it is on, and you can turn it off any time from the choices panel at the bottom of the page.

What we keep: the categories you pick and, for the offers we show you, which ones stayed on screen for at least a second, which you opened, which you looked at for a few seconds and which you opened at the shop, with the time. We do not keep what you type in search, we infer nothing about health, opinions or other sensitive matters, and we use none of it for advertising.

In the app we do this with your consent. On the site we do it for our legitimate interest in showing you first what you are looking for, and you can object any time by turning it off. With an account, it is tied to your account. Without one, it is tied to a random code: in the app it sits in the phone’s protected storage, on the site in a technical cookie (nd_rec) that the page’s scripts cannot read. In the app the code exists only after you say yes; on the site the cookie goes when you turn it off.

How long: without an account, the data goes after 30 days without using NotDone and in any case after 180 days; with an account, each action is forgotten after 180 days.

You can start over, turn it off (we then delete what we learned) or get a copy of your data: in the app under My things › Privacy, on the site from the choices panel at the bottom of the page. With an account you can also write to hello@notdone.app.

The listings we read on Vinted and Wallapop

To show you what the same item costs elsewhere, NotDone reads some public listings on Vinted and Wallapop, only for items with a specific model, such as phones, tablets, laptops, cameras, consoles, headphones, watches, trading cards, records and building-brick sets. If you sell on those sites, this part is about you.

From each listing we keep the title, the price, the item's condition, whether you ship and what shipping costs, the town when the site shows it, and the link to the listing and its photos. We don't keep your name, your username, your profile picture, the item description or your reviews. We don't copy the photos: when you see them on NotDone, they load straight from the listing's site.

We do this on the basis of a legitimate interest, ours and the buyer's: comparing offers for the same item and sending anyone interested to your listing, where the sale happens. We sell nothing on your behalf, we don't contact you, and we use this data for nothing else. These prices serve today's comparison and never enter the price history we keep over time.

A listing stays with us while we see it for sale. Once it disappears, or we stop seeing it, we delete it within thirty days.

If you don't want a listing of yours to appear on NotDone, email hello@notdone.app with the link: we remove it within three working days and it will not come back. You also have the other rights described below.

The program that reads these listings is described at notdone.app/en/crawler.

Who sees your data

We work with few providers, each for one thing: Vercel for the site and the visit count, Sentry to notice errors, Hetzner for our server in Finland, IONOS for mail, Google for sign-in to the app and, with your consent, usage analytics of the app and the site, Apple for Sign in with Apple, Mapbox for the map, Vinted and Wallapop for the photos of their offers that we show, and the sources of offers listed above. None of them receives more than its task needs. We do not sell data and do not run advertising.

Google, Apple, Mapbox, Vercel and Sentry are US companies: transfers rest on the safeguards of the European regulation, that is the standard contractual clauses and, where they take part, the EU-US Data Privacy Framework.

Your rights

You can ask us what data we hold about you, have it corrected or deleted, restrict its use, receive it in a readable format, or object to a processing. An email to hello@notdone.app is enough: we answer within a month. If you think we are getting it wrong, you can turn to the Italian data protection authority (garanteprivacy.it) or to the authority of your country.

Age

NotDone is for people aged eighteen or over. If we find data about someone younger, we delete it.

Changes

If we change this notice substantially, we say so at the top with the date and, if you have an account, we tell you in the app.