Privacy

Updated 21.09.2026

Business details are not filled in yet: the service runs in a closed trial, by invitation. The owner’s name, address and email will appear here before sign-up opens to everyone.

In short

VintageStocks works out what vintage clothing sells for, from listings on public marketplaces. The numbers are open to anyone. An account exists only for the personal side: a portfolio of your purchases and saved searches.

What we hold about you

• Email and password. The password is stored as an irreversible scrypt hash — we neither know it nor can recover it.
• One session cookie (vpi_session). It is what keeps you signed in. There are no advertising or analytics cookies at all, which is why there is no consent banner.
• What you enter yourself: portfolio items, saved searches, and the link to our Telegram bot if you set one up.
• Search queries and server logs — address, time, page. Logs exist to stop password guessing and to diagnose faults.

Why we are allowed to

Your account, portfolio and saved searches: to provide what you signed up for — without that data the personal pages cannot work. Logs and rate limits: our legitimate interest in keeping the service standing.

Listing data

The index is built from public marketplace listings: title, price, size, condition, date. We do not collect or store anything about sellers — no names, no identifiers, no profile links. Until 20 September 2026 a seller identifier was kept so that one item listed three times would not count as three; we dropped that and erased what had been collected. Median accuracy is not worth holding other people's personal data.

Photographs are not stored either: a card points at the image on the marketplace's own servers, and your browser loads it from there.

Who else sees it

• Amazon Web Services — the server is in Frankfurt, Germany. Your data stays in the EU.
• Telegram — only if you link your account to our bot yourself.

No ad networks, no visitor counters, no third-party analytics.

How long

Account data lives as long as the account does. Delete it in your profile and the portfolio, saved searches and bot link go with it immediately. Nightly database backups are kept for 30 days — a person cannot be erased from a backup without breaking it — so the last traces disappear within a month. Server logs: up to 30 days.

Your rights

Download everything we hold about you, or delete your account outright, with the buttons in your profile — no correspondence with us required. You may also ask us to correct your data, restrict or object to its processing, and you may complain to the data-protection authority where you live.

During the trial the service runs by invitation, and questions go to the person who invited you. A contact address will appear here before sign-up opens to everyone.