ThriftSmith ThriftSmith ← Home

Privacy Policy

Effective date: October 11, 2026

This privacy policy describes how ThriftSmith: Profit Scanner AI (the "App"), provided by Marcana B.V. (the "Developer"), collects, uses, and shares information when you use the App.

1. What information do we collect?

Photos you scan

To identify an item, the App needs a photo of it. You can take the photo with your camera, which the App asks permission to use, or pick one from your photo library. Only the photo you take or pick leaves your device.

When you scan an item, the App sends the photo to the Developer's server, which runs on Google Cloud Functions for Firebase. The server sends the photo to OpenAI, whose AI model identifies the item and writes its name, brand, description, condition, resale estimate, and resale tips. The server also stores a copy of the photo in Google Firebase Cloud Storage, so that SerpAPI, a search service, can look up similar items for sale online through Google Lens. To let Google Lens load it, the stored copy is public at a long, random web address. Anyone with that address could open the photo until it is deleted. The server sends the address only to SerpAPI, for Google Lens, and writes it to the server log. Google Cloud Storage deletes each stored copy automatically once it is 30 days old.

The server also asks SerpAPI to search eBay for current listings of the item. That search uses a short search phrase the AI writes from the item's name and brand, not your photo. Together with the photo, the App sends the language, region, and currency set on your device, so that the resale estimate uses your currency and the similar items come from your region. eBay listings always come from eBay's US site, in US dollars.

The photo is stored under a random file name. The Developer does not attach your name, an account, or a device identifier to it. OpenAI processes the photo under its own privacy policy.

Server logs. To find and fix problems, the server writes a log of each scan with the language and region, the photo's web address, the item name and brand the AI returned, and the eBay search with its first results. Like most web servers, Google Cloud also records technical details of each request, such as the IP address it came from. Google Cloud deletes these logs after 30 days.

Your finds

The items you save, your collections, your notes, and the prices you type in to get a verdict are stored only on your device. They are not uploaded to the Developer, and deleting the App deletes them.

Personal information you disclose to us

The App does not require you to create an account or provide any personal details to use it. If you contact support by email, we receive the information you choose to share, such as your name and email address. The support email the App prepares for you puts the app version, your subscription user ID, and your region in its subject line, so that we can look up your purchase.

Payment data. Purchases and subscriptions are processed through Apple's App Store. Payment details are handled and stored by Apple, not by the Developer. The Developer uses RevenueCat, a subscription management service, to process your subscription status. This involves receipt information and device identifiers, not your payment details.

Information automatically collected

The App uses analytics services (Amplitude and Google Firebase Analytics) to understand how the App is used and to improve it. These services automatically collect usage and diagnostic information such as device model, operating system version, language, app version, session information, and approximate region derived from IP address. They also receive in-app events, for example whether a scan succeeded, that you opened or shared a saved item (together with the item name the AI gave it), or that you bought a subscription, and they record how many scans you have made and whether you have a subscription or a free trial.

Crash reports. Google Firebase Crashlytics records crash reports and related diagnostic information, such as the device model, operating system version, and the state of the App when it crashed. These reports do not include your photos or your saved finds.

Tracking and ad measurement

The Developer advertises the App with Google Ads. To learn which ads bring people to the App, Google uses events that Firebase Analytics records, among them the first time you open the App and each subscription you buy, with its product, price, and currency.

Shortly after you first open the App, iOS asks whether the App may track your activity across other companies' apps and websites. If you allow it, Firebase Analytics collects your device's advertising identifier (IDFA), and RevenueCat receives it with your subscription records. Google can then match your first open and your purchases to the Developer's ads you saw or tapped, for example on Google Search, YouTube, or in other apps. If you decline, the App does not collect the advertising identifier, and Google receives the first open and purchase events without it. Section 8 explains how to change your answer later.

The Developer may also advertise the App on the App Store with Apple Ads. The App asks Apple for an attribution token and sends it to RevenueCat with your subscription records. RevenueCat sends the token to Apple, which answers whether you installed the App after seeing or tapping one of the Developer's Apple Ads, and if so, which campaign. This token does not contain the advertising identifier, and the App does not need your tracking permission to send it.

2. How do we use your information?

The Developer processes information based on legitimate business interests, contract fulfillment, legal obligations, vital interests, and user consent.

The App does not show ads and does not send marketing emails. It tracks you across other companies' apps and websites only if you allow it, and the Developer uses that tracking to measure its own ads and for nothing else.

3. Will your information be shared with anyone?

The Developer shares information only with service providers needed to operate and advertise the App, for legal compliance, rights protection, or business obligations.

Service providers. The following third parties process data on the Developer's behalf:

Legal bases for processing:

Business transfers. Information may be shared during mergers, asset sales, financing, or business acquisitions.

Personal data sales. The Developer does not sell personal information to third parties.

4. What is our stance on third-party websites?

The similar items and eBay listings the App shows link to third-party shops and marketplaces. The App is not responsible for the safety or privacy practices of these websites, and the Developer does not track your activity on them. Check each shop's own privacy policy.

5. How long do we keep your information?

Stored copies of your scan photos are deleted automatically 30 days after the scan. Other information is retained only as long as necessary for the purposes described in this policy or as required by law. When no legitimate business need exists, information is deleted, anonymized, or securely isolated from further processing.

6. How do we keep your information safe?

The Developer implements technical and organizational security measures to protect information. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, and you use the App at your own risk.

7. What are your privacy rights?

Regional rights

If you live in the European Economic Area or the United Kingdom, you have rights that include accessing, correcting and erasing your personal information, restricting its processing, and receiving it in a portable format. You may withdraw your consent at any time, and you may complain to your data protection supervisory authority.

If you live in Switzerland, you can contact the Federal Data Protection and Information Commissioner.

Exercising your rights

The App does not use accounts, so there is no account to manage or delete. To request access to or deletion of analytics data associated with your device, contact contact@marcana.app. Requests are handled within 30 days, though legal requirements may necessitate retention of some records.

8. Controls for do-not-track features

The App asks for permission to track through Apple's App Tracking Transparency prompt, and it collects the advertising identifier only if you allow it (see section 1). You can change your answer at any time in the iOS Settings app under Privacy & Security, then Tracking.

9. Do California residents have specific privacy rights?

Shine the Light law

If you live in California, you may ask once a year which categories of personal information the Developer disclosed to third parties for their direct marketing, and the names and addresses of those third parties. The Developer does not disclose personal information to third parties for their direct marketing purposes.

CCPA privacy notice

Resident definition. California residents are people who are in California for other than a temporary or transitory purpose, and people domiciled in California who are outside the state for a temporary or transitory purpose.

Collected personal information categories:

Data usage and sharing. Information collection and sharing practices are detailed throughout this privacy notice.

Service provider disclosures. The Developer may disclose information to service providers through written contracts for processing on behalf of the business.

Personal data sales. The Developer does not sell personal information for money. The App sends your first open and your subscription purchases to Google, which uses them to measure the Developer's ads (section 1). If you allow tracking, the App also shares your advertising identifier with Google, so it can link these events to the ads you saw or tapped. California law may treat this as sharing personal information. Turning tracking off in the iOS Settings app (section 8) stops the advertising identifier from being shared. The first open and purchase events are still sent, without it.

Consumer rights

10. Do we make updates to this notice?

The privacy notice may be updated periodically to maintain legal compliance. Material changes are announced on this page and, where possible, in the App.

11. How can you contact us about this notice?

Email: contact@marcana.app

12. How can you review, update, or delete the data we collect from you?

You may request access, modification, or deletion of information by emailing contact@marcana.app.