Who operates Second Hand
Second Hand is operated by Contorta Development. Contorta Development determines how information submitted to Second Hand is used for the purposes described in this policy.
Intended users
Second Hand is a business inventory application intended only for adults age 18 or older acting for a store or organization. It is not designed or directed to children.
Information we process
We process account identifiers and contact details; store and team membership information; donor or customer names, contact details, and addresses entered by a store; donation, purchase, sale, gift, inventory, valuation, and reporting records; item descriptions, photos, and barcode data; printer configuration; subscription status and purchase history; app interactions; and support feedback.
Second Hand is available as a web app and as apps for Android and iOS (iPhone and iPad). The mobile apps use the camera only when you choose to scan a barcode or take an item photo, and on iOS they open your photo library only when you choose an existing photo. They may use Bluetooth or the local network when you set up a printer. On iOS, each of these permissions is requested separately and can be changed at any time in the Settings app. Second Hand does not collect your address book, precise GPS location, payment-card number, CVV, or bank-account credentials.
Signing in
You can sign in with an email address and password, with Google, or with Sign in with Apple. Authentication is handled by Base44. When you use Google or Apple, that provider confirms your identity and shares your name and email address with Second Hand; Second Hand does not receive your Google or Apple password.
With Sign in with Apple you can choose to hide your email address. Apple then gives Second Hand a private relay address that forwards to your real address, and Second Hand uses that relay address for account email. You can stop using Sign in with Apple for Second Hand in your Apple Account settings.
AI-assisted valuation
AI-assisted valuation is enabled by default and a store owner can turn it off in Settings. When enabled, Second Hand sends the item description, condition, category, barcode or SKU information, and uploaded item or barcode photos to Base44's AI integration. Base44 may route the request to third-party AI providers. For stores that sell items, the same information is used to recommend a sale price; stores that only give items away do not request one. Donor or customer contact information is not intentionally included in these requests.
Each estimate and recommended price is decision support, not a professional appraisal, and store staff must review it. Base44's applicable terms permit customer data and generated output to be processed to provide, maintain, and improve its services, including training software tools, unless an applicable contractual or workspace-level opt-out governs that processing. Do not upload sensitive personal information in item photos or descriptions.
Diagnostics and feedback
When you choose Send Feedback, Second Hand prepares an editable email containing the current screen and diagnostic details: platform, operating-system version, hardware manufacturer and model when available, app version and build, and browser or WebView information. You can review or remove this information before sending it.
Automatic crash reporting is optional and disabled unless you opt in. A report includes the exception message and stack trace, screen path, timestamp, operating system, device manufacturer and model, app/build version, and browser or WebView information. It does not intentionally include donor, inventory, or payment records. You can withdraw consent in Settings. Second Hand does not include a device serial number, Android ID, Apple identifier for vendors, advertising ID (including Apple's IDFA), IMEI, or another unique device identifier in these custom reports.
Weekly "found a new home" emails to donors
A store owner can turn on weekly emails that tell donors when items they donated have been given to someone in need. This is off unless the store turns it on. When it is on, Second Hand uses the donor's name and email address, as entered by the store, to send one email a week listing the name and photo of each donated item that was given away. The email never identifies the person who received an item, the date it was given, or any receipt details.
These emails are sent through Cloudflare. Each email has a "Stop these emails" link that turns the emails off for that donor at that store, and the store can also turn them off for a donor. Second Hand keeps a record of which items were included in an email and whether the donor unsubscribed, so items are reported only once and an unsubscribed donor is not emailed again. Donors who chose to give anonymously, or who have no email address on file, are never emailed.
How information is used
We use information for app functionality; account and store management; authentication and security; inventory, donation, receipt, reporting, donor notification email, subscription, AI-valuation, and printing features; customer support and developer communications; diagnostics and service improvement; fraud prevention; advertising on the free tier; and compliance with legal obligations.
Service providers and disclosures
Base44 provides application hosting, database storage, authentication, file storage, backend functions, and AI integrations. Google and Apple authenticate users who choose to sign in with them. Cloudflare processes transactional-email delivery information, including receipts and donor notification emails. Stripe processes website subscriptions and connected-payment services. Google Play processes Android subscription purchases, and Apple processes iOS subscription purchases through the App Store. Google Firebase Analytics (mobile apps, only with your consent) processes app-usage and device data for analytics. Google AdMob (Android and iOS apps) and Adsterra (web app), together with their advertising partners, process data needed to request, deliver, measure, secure, and personalize or limit advertising, depending on consent and regional settings.
We do not sell store, donor, customer, or inventory records. We disclose information to the providers above to operate Second Hand, when a store user directs us to do so, and when required for legal, security, or fraud-prevention purposes. Providers process information under their own terms and privacy policies.
Advertising
Free-tier users see banner ads: Adsterra on the web app — a banner ad and a full-screen ad shown once per day before the web app becomes usable — and Google AdMob in the Android and iOS apps. These services and their partners may process an advertising ID (Android advertising ID or Apple IDFA), cookies or similar identifiers, IP-derived approximate location, device and diagnostic information, and ad interactions for advertising, measurement, analytics, and fraud prevention. On iOS, Second Hand asks for permission through Apple's App Tracking Transparency prompt before the first ad is shown; Premium stores, which never see ads, are never asked. If you allow tracking, ads may be personalized. If you do not allow it, or later turn off "Allow Apps to Request to Track" or Second Hand's tracking permission in the iOS Settings app, Second Hand does not access your IDFA, ads are still shown but are not personalized, and Firebase Analytics is told not to use your data for ad personalization. In both mobile apps, Google may show a consent form where the law requires it (for example in the European Economic Area, the United Kingdom, and Switzerland), and an Ad Privacy Options control appears in Settings when Google reports that it is required. Second Hand does not currently show a separate ad-consent prompt on the web app; Adsterra and its partners may still set cookies or similar identifiers there regardless of region. Premium stores do not receive ads on either platform.
Analytics
The Android and iOS apps can use Google Firebase Analytics to understand how the app is used and to improve it. Analytics is off by default and is turned on only if the consent choice presented in the app allows it; it applies to every store, including Premium. When enabled, Firebase Analytics may collect app interactions such as screens viewed and sessions, device and app information, approximate location derived from IP address, and an app-instance identifier, plus an advertising identifier only where your consent and, on iOS, your tracking permission allow it. It does not receive donor, customer, inventory, or payment records. You can withdraw consent at any time through Ad Privacy Options in Settings when it is offered, and analytics collection is switched back off.
Subscriptions and payments
Google Play, Apple, or Stripe processes payment credentials; Second Hand never receives your card or bank details. Second Hand receives and stores purchase or subscription status, product and provider identifiers, expiration information, and a protected representation of the Google Play purchase token or App Store transaction identifier. For iOS purchases, Second Hand attaches a random identifier to the purchase so it can be matched to the right store, checks the purchase with Apple's servers, and receives notifications from Apple when a subscription renews, is canceled, expires, or is refunded. We use that information to grant Premium access, restore purchases, prevent a purchase from being assigned to multiple stores, and respond to cancellations, refunds, and expiration. Subscriptions bought in the iOS app are managed and canceled in your Apple Account subscription settings, and refunds for them are requested from Apple.
Retention and deletion
Operational information is retained while the account or store is active. User-controlled records remain until a permitted user deletes them or the account owner completes account deletion. Optional crash reports and support correspondence are retained only as long as reasonably needed to investigate, secure, and document the reported issue.
Account deletion removes the user record, owned stores and their operational records, memberships, invitations, feedback records, and references linking the user to records in stores owned by others. Store-only deletion preserves the account, store identity, team membership, invitations, and subscription records so the store remains usable. Uploaded-file references are removed with their associated records; hosted copies and backups may remain for a limited period under provider deletion and backup cycles.
We may retain limited subscription, transaction, security, fraud-prevention, dispute, or legal records until the applicable purpose or legal obligation ends. Deletion is blocked while a Google Play or Stripe subscription may still renew, so the user can cancel it first. An App Store subscription does not block deletion from the iOS app, but deleting the account does not cancel it; cancel it in your Apple Account subscription settings to stop being charged. See the account deletion page for instructions.
Your choices
You can review or correct many records in the app, disable AI-assisted valuation, withdraw optional crash-reporting consent, use available Ad Privacy Options (which also control analytics in the mobile apps), allow or deny tracking on iOS, change camera, photo, Bluetooth, and local network permissions in your device settings, delete store operational data, or delete your account. A store controls the donor, customer, and inventory information its authorized users enter and should handle requests concerning those business records. Donors can stop weekly "found a new home" emails with the link in any of those emails.
Security
We use reasonable administrative and technical safeguards, including authenticated access and encrypted network connections, but no online service can guarantee absolute security.
Contact
For privacy questions or data requests, contact Contorta Development at tester.feedback@contorta.dev. You may also use the public support page.