Privacy
GrailTrakr helps collectors find the books they want on online marketplaces and see how each asking price compares with real sales. This policy explains what we collect, why, where it is kept and the choices you have. It covers the website at grailtrakr.com and the GrailTrakr Chrome extension.
The short version: your data belongs to your account and nobody else can see it. We never sell it. Your marketplace and price service logins never leave your browser.
Who we are
GrailTrakr is an independent service based in Alberta, Canada. Our Privacy Officer is responsible for how we handle personal information and can be reached at privacy@grailtrakr.com.
What we collect
Your account
Your email address, the name you choose to show, and your settings: search regions, default currency region, deal threshold and nightly run time. We also keep the access code you joined with, your plan, and when you signed up and last signed in.
Your grails
The books you add to your list: title, issue, year, format, minimum grade, maximum price, notes and any price guide link you save.
Listings the extension finds
When GrailTrakr finds a match it saves public listing details to your account: the book, grade, asking price and currency, the city and region shown on the listing, the listing link, when it was first and last seen, price changes and whether it sold. For eBay listings it also saves the shipping cost to Canada and whether the seller accepts offers. It does not save seller names, seller profiles, messages or photos.
Price data
Fair market values, recent sale prices and sale dates that the extension reads from price services you connect, such as GPA Analysis and GoCollect, kept with the date and the name of the service so we can show history and where each value came from. Your choice of which service leads your FMV is saved with your settings. We also store the daily USD to CAD exchange rate from the Bank of Canada.
Extension connection
When you connect the extension we create a private key that links it to your account. We store only a scrambled (hashed) copy, with a label for the browser and when it was last used.
Invite requests
If you ask for an invite we keep your email, and the city and note you choose to add.
What we do not collect
We never see or store your Facebook, GPA, GoCollect or other marketplace passwords, cookies or sessions. The extension does not read your browsing history, messages, friends or any page it did not open for a search. We do not use advertising trackers or sell data to anyone.
How the extension works
The extension runs in your own Chrome. At your nightly time, or when you click Run update, it opens marketplace searches for your grails in a background window using the logins already in your browser, reads the listing details on those pages, opens price service pages to value graded books, and sends the results to your GrailTrakr account. It never messages sellers, makes offers or buys anything.
GoCollect is optional. The extension can only open gocollect.com after you click Connect GoCollect in its popup and allow it in Chrome. You can turn it off there at any time, which removes that access.
How eBay searches work
eBay is searched by GrailTrakr's own servers through eBay's official Browse API, not by the extension, so it needs no eBay login. Once a day and when you click Run update, we send eBay the title and issue of each of your grails and save the matching Buy It Now listings to your account. We send eBay nothing about you: no name, email or account details. We do not connect to or store anything from your eBay account.
How we use your information
To run your searches, value what is found, show your results, send sign-in codes, invites and service emails, keep the service secure, and fix problems. We do not use your data for advertising, and we do not use it to build profiles about you.
Who we share it with
We use a small number of service providers to run GrailTrakr. They process data only on our behalf and under their own security commitments:
- Supabase stores the database and handles sign in.
- Vercel hosts the website and counts visits with Vercel Web Analytics: pages viewed, the site that sent you, and your country and device type. It uses no cookies, does not identify you, and does not follow you to other sites.
- Resend sends sign-in codes, invites and service emails.
- Google Workspace handles email you send to us.
- eBay receives the book searches we make for your grails (title and issue only) through its Browse API.
When billing starts, payments will be handled by a payment processor and we will update this policy first. We may disclose information if the law requires it. If GrailTrakr is ever sold or merged, your information would move with it under this policy, and we would tell you first.
Where your data is stored
Our providers store data in the United States, including our database in Oregon. That means it may be subject to US law, including lawful access by US authorities. By using GrailTrakr you understand your information is processed outside Canada.
How long we keep it
We keep your information while your account is open. Listings that sell or disappear stay in your history so you can see past prices. When you delete your account in Settings, your account, grails, listings, price history and extension connections are deleted straight away. Copies in our providers' backups expire on their normal schedule, typically within 30 days. Declined invite requests are deleted. Accepted ones are kept with the invite code we sent, as a record of who was invited.
Security
Data is encrypted in transit and at rest. Every table is locked so each account can only read its own rows. Sign in uses one-time email codes, so there is no password to steal. Admin access needs a second step with an authenticator app.
Your choices and rights
You can see and change your grails and settings any time in the app, and delete your account in Settings. You can also email privacy@grailtrakr.com to ask for a copy of your data, a correction or deletion. We reply within 30 days. Canadian residents have these rights under PIPEDA and Alberta's PIPA. Residents of some US states, including California, have similar rights, which we honour for everyone.
Cookies and local storage
We use only what the service needs: a sign-in cookie to keep you signed in, and a few small values in your browser, such as the access code you entered while signing up and an ID for the extension connection on that browser. No advertising or analytics cookies. Visit counts come from Vercel Web Analytics, which works without cookies.
Children
GrailTrakr is meant for adults. We do not knowingly collect information from anyone under 18.
Terms
Your use of GrailTrakr is also covered by our Terms of Use.
Other sites
Facebook, eBay, GPA Analysis, GoCollect and other marketplaces and price services have their own terms and privacy policies, which apply when you use them, including through the extension.
Changes
If we change this policy we will update the date above, and for meaningful changes we will email you before they take effect.