What ArcList does
ArcList helps you list clothing across resale marketplaces (eBay, Depop, Grailed, Poshmark) and tracks your sales. To do that, it stores the data you put into it and talks to the marketplaces on your behalf.
Data we store
- Account data. Your email address and a hashed password. If you sign in with Google, we receive your email address and Google account ID, and nothing else.
- Listing data. Photos, titles, descriptions, prices, measurements, and sale records you create. Photos are stored on our cloud storage so they can be published to marketplaces.
- Marketplace connections. Tokens that let ArcList publish and delist on your behalf. These are encrypted at rest. ArcList never uses your marketplace passwords.
- Billing. Payments run through Stripe. We store your subscription status, never your card number.
- Diagnostics. Error reports (message, stack trace, app version) so we can fix bugs. When a publish or delist step fails on a marketplace page, the Chrome extension also uploads a pruned copy of that page’s HTML (capped at 180 KB, with attribute and text values truncated), along with the extension’s console output for that run, so we can see which field or button it could not find. Those snapshots come from the marketplace listing pages the extension was working on, not from unrelated browsing. No advertising identifiers, no third-party analytics, no ad networks.
How ArcList knows something sold
Through each marketplace: eBay’s own API for eBay, and the ArcList Chrome extension reading your own signed-in seller pages on the others. ArcList does not read your email and requests no mail permissions from any provider. Sale detection on the extension-driven marketplaces runs in your own browser, while it is open, not on our servers.
What the Chrome extension reads in your browser
The extension works inside your own signed-in sessions on Depop, Grailed and Poshmark. It fills and submits those marketplaces’ own listing forms, delists items there, and reads your own seller pages to notice sales. It acts on listings you have told ArcList to publish or delist, and it takes no action on a marketplace until you ask it to.
Two of those marketplaces need a token sent as a request header rather than as an ambient cookie, so the extension reads exactly two cookie values from your browser: your Depop access token and your Grailed CSRF token. Each is used only to authenticate that same request back to Depop or Grailed. We do not send your marketplace cookies to ArcList servers. The extension reads no cookies on any other site.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Camera, photos, and AR
The iOS app uses your camera to photograph items, scan pairing and label QR codes, and measure garments in AR. Photos you take are uploaded to your account. AR measurements are processed on-device; only the resulting numbers are uploaded. Nothing from your camera is collected in the background.
Who else processes your data
ArcList uses these providers to run the service. Each receives only what its job needs, and none of them is permitted to use your data for their own purposes.
- Vercel (United States) hosts the web app and API, and processes every request you make.
- Turso hosts the database that holds your account, listings, and sale records.
- Cloudflare stores your listing photos (R2) and provides DNS and email routing for arclist.ai.
- Anthropic drafts listing details from your item photos. Under the terms we operate on, Anthropic does not use photos sent for this purpose to train models.
- SerpApi runs the optional Google Lens price lookup. When you ask for comparable prices on a photo, that photo is sent to SerpApi. If you never use the lookup, no photo goes there.
- Stripe takes payment and holds your card details. We never see your card number.
- Resend delivers account email, such as password resets, payment notices, delist-failure alerts and messages from arclist.store buyers. It receives your email address and the message.
- Sentry receives crash and error reports, which can include your account ID and the request that failed.
- Google is used only if you sign in with Google, and only for sign-in. ArcList requests the
openidandemailscopes and no others.
The marketplaces you connect (eBay, Depop, Grailed, Poshmark) receive the listings you choose to publish. They are your accounts, governed by their own privacy policies.
Where your data lives
ArcList is operated from the United States and the providers above store and process data in the United States. If you use ArcList from outside the US, your data is transferred there.
What we don’t do
- We don’t sell your data.
- We don’t run ads or share data with ad networks.
- We don’t track you across other apps or sites.
- We don’t read your email.
Deleting your data, and getting a copy
Deleting a listing removes its photos and records. To delete your account and everything in it, or to request a copy of your data, email lucca.walls@arclist.ai and we’ll complete it within 30 days. Deletion covers your listings, photos, marketplace tokens, and account record; it does not retract listings already published to a marketplace at your direction, which you delist or sell through that marketplace.
Contact
Questions about this policy: lucca.walls@arclist.ai. Our Terms of Service cover the rest of the agreement.