Privacy Policy
Effective date: August 27, 2026
The Bali Bay ("we," "us," "our") provides an AI-assisted tool that helps independent eBay sellers draft and publish listings. This Privacy Policy explains what information we collect through the service (the "Service"), how we use it, and who we share it with.
1. Information We Collect
- Account information: your email address and a securely hashed password. We never store or see your password in plain text.
- Session data: a signed, HttpOnly session cookie used only to keep you signed in. We don't use tracking or advertising cookies.
- eBay connection data: when you connect your eBay seller account through eBay's own OAuth authorization flow, we store an encrypted eBay refresh token (encrypted at rest), the permission scopes you granted, and the eBay business policy identifiers (shipping, payment, returns, warehouse location) you choose to link. We never see or store your eBay password.
- Listing content: the photos and notes you upload about an item, and the AI-drafted title, description, price range, condition, category, and item specifics generated from them.
- Technical data: your IP address, used only to enforce login and signup rate limits so accounts can't be brute-forced. It isn't stored long-term or linked to your account for any other purpose.
2. How We Use Information
- To create and secure your account (authentication and session management).
- To generate draft listings, by sending your photos and notes to an AI provider (see below).
- To publish listings to eBay through your own authorized eBay connection, only when you explicitly ask us to.
- To prevent abuse, such as repeated failed login or signup attempts.
We do not use your data for advertising, and we do not sell your personal information to anyone.
3. Third-Party Service Providers
We rely on the following providers to operate the Service. Each receives only the data needed to do its job:
- eBay Inc. — receives listing content (photos, titles, descriptions, pricing, specifics) and acts on your behalf strictly within the permissions you granted, to create, update, and publish listings on your own eBay seller account.
- AI providers (currently an NVIDIA-hosted model, with Anthropic's Claude as a fallback option) — receive the photos and notes you upload, in order to identify the item and draft listing content.
- Cloudflare (R2 object storage) — hosts your uploaded listing photos at a public URL, which eBay's own systems require in order to fetch images directly.
- Our hosting provider — runs the application and database on a persistent server.
We do not share your information with any other third party, and we do not sell your personal data.
4. Data Storage & Security
- Passwords are hashed with a per-account random salt — never stored or logged in plain text.
- Session identifiers are hashed before storage; the session cookie is HttpOnly and, in production, marked Secure, so it's never readable by page scripts.
- Your eBay refresh token is encrypted at rest using a key kept separate from the database.
No method of storage or transmission is perfectly secure, and we can't guarantee absolute security — but we apply reasonable, industry-standard safeguards appropriate to a service of this size.
5. Data Retention
We keep your account, listing, and eBay connection data for as long as your account stays active. You can request deletion of your account and associated data at any time (see Contact below), and we'll delete or anonymize it within a reasonable time, except where we're required to keep records by law.
6. Your Rights & Choices
You can ask us to access, correct, export, or delete your personal data, or to disconnect your eBay account, at any time by emailing us. You can also disconnect your own eBay account yourself, at any time, from the app's Settings menu — that immediately stops any future access to your eBay account.
7. Cookies
We use a single strictly-necessary session cookie to keep you signed in. We don't use analytics, advertising, or third-party tracking cookies.
8. Children's Privacy
The Service is intended for business use by adult sellers and isn't directed at children under 16. We don't knowingly collect personal information from children.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We'll update the effective date above when we do. Continuing to use the Service after a change means you accept the updated policy.
10. Contact Us
Questions about this Privacy Policy or your data? Email murtayabali@gmail.com.