Last updated: 11 November 2026 · Version 2026-11-11
This policy explains what personal data DeClutter collects when you use our website (thedeclutterapp.com), our web app, our iPhone and Android apps (including the DeClutter keyboard), and our emails; why we collect it; who we share it with; where it is stored; how long we keep it; and the rights you have. Our Cookie Policy explains the cookies and similar technologies on the website.
DeClutter is operated by Duncan Bone, trading as Studio DB, a sole trader established in Malta (VAT number MT33251709). We are the "controller" of the personal data described in this policy, except where we say a partner is responsible for its own processing.
Contact: hello@thedeclutterapp.com. Our postal address is available on request at the same email address.
We are not required to appoint a Data Protection Officer, because our core activities do not involve large-scale monitoring of people or large-scale processing of special categories of data. Questions about privacy go to the email above and are answered by the founder.
"Contract" means the processing is necessary to provide the service you signed up for. "Legitimate interests" means we have a genuine business reason that does not override your rights; you can object to it at any time (see section 12). "Consent" means we only do it if you agree, and you can withdraw at any time.
| Data | Why we use it | Legal basis |
|---|---|---|
| Account details: name, surname, email address, password (stored only as a secure hash by Google Firebase), or your Google or Apple sign-in identity and profile picture | Create and secure your account, sign you in, contact you about your account | Contract |
| Country, city, app language and listing language | Show the right marketplaces and currency, write listings in your language, send emails at a sensible time of day | Contract |
| Profile photo (if you add one) | Show your avatar in the app | Contract |
| Item photos you take or upload, and the AI-enhanced versions we create | Identify the item, write the listing, price it, and create clean product images (see section 3) | Contract |
| Item and listing details: titles, descriptions, prices, condition, brand, notes, sale price, which marketplace | The core service: building, saving, syncing and posting your listings | Contract |
| Seller details you choose to add: address, business name, tax ID | Post to marketplaces that require an address (for example eBay, TradeMe) and print your sales statement | Contract |
| Marketplace connection tokens (eBay, Etsy, TradeMe, Marktplaats) | Post listings to your marketplace accounts when you ask us to | Contract |
| Subscription and payment status (plan, renewal, top-ups, Stripe customer ID, Apple or Google purchase records). We never see or store your full card number. | Give you the scans you paid for and manage your subscription | Contract; legal obligation for tax records |
| A random device identifier stored on your device (in the iOS Keychain, Android Keystore, or browser storage) | Make sure each device gets the 5 free scans only once, to prevent abuse of the free trial | Legitimate interests (preventing fraud and abuse) |
| IP address, turned into a one-way code (hash) on our servers | Rate limiting and abuse prevention on our servers | Legitimate interests (security) |
| Product usage events: for example signed up, opened the camera, completed a scan, saved or posted a listing, viewed a plan, started or completed checkout. These carry the date, platform, country, plan and marketplace, linked to a pseudonymous code derived from your account, never to the content of your listings, photos, name or email. | Understand where people get stuck and improve DeClutter | Legitimate interests (improving the service) |
| Where you came from: the campaign link (for example utm_source), referring website, invite code, and the page you first landed on | Know which channels bring people who find DeClutter useful, so we spend less on those that do not | Consent in the EU, EEA, UK and Switzerland (we only keep it if you allow analytics); legitimate interests elsewhere |
| Error reports: the error message, the screen, your plan, platform and device/browser type, and your account ID | Find and fix bugs | Legitimate interests (keeping the service working) |
| Sales data when you mark an item as sold: category, listed and sold price, country and days to sell | Improve price estimates for everyone. These figures are kept without your account ID once your account is deleted. | Legitimate interests (improving pricing) |
| Messages you send us, survey answers and email replies | Answer you and improve the product | Legitimate interests; consent for optional surveys |
| Website analytics and ad measurement (Google Analytics and the Meta Pixel) | See how the website is used and which ads bring visitors (see the Cookie Policy) | Consent in the EU, EEA, UK and Switzerland; elsewhere legitimate interests with an opt-out |
We do not collect your precise location, contacts, health data, or any other special category of personal data, and we do not ask for your age or gender. The iPhone and Android apps do not use Google Analytics, the Meta Pixel, advertising identifiers or cross-app tracking, and do not ask permission to track you.
When you scan an item, your photos and any notes you add are sent to Google's Gemini AI service, together with your country, city, currency and language, to recognise the item, write the listing, estimate a price and create enhanced product images. Some requests use Google Search to find comparable items. We use Google's paid API service, under terms that do not allow Google to use your photos or text to train its models. Your photos are stored in your account so you can reuse them in your listings.
Please photograph only the item you are selling. If a photo accidentally shows a person, a document or something private, delete it or retake it. You are responsible for having the right to upload the photos you use.
If you connect eBay, Etsy, TradeMe or Marktplaats, we store the access tokens those marketplaces give us and use them only to post and manage listings you ask us to post. We send the marketplace your listing text, photos, price and, where the marketplace requires it, your seller address. Each marketplace is responsible for its own use of the data under its own privacy policy. You can disconnect a marketplace in the app at any time and also revoke access in your marketplace account settings. For other marketplaces (for example Vinted, Depop, Poshmark, Facebook Marketplace), DeClutter only prepares the text and photos for you to paste or upload yourself; we send them nothing.
Payments on the web are processed by Stripe. In the iPhone and Android apps, purchases are processed by Apple or Google, and we use RevenueCat to confirm which plan you have. These companies receive the data needed to take payment and prevent fraud (for Stripe this includes your email and our account ID for you). Card details go directly to them and never reach us. Stripe, Apple and Google keep payment records for as long as tax and financial laws require them to.
We send emails that are part of the service (verification, password reset, account changes). We also send a small number of emails to help you get started and occasional messages if you have not used DeClutter for a while, at most a few per account. We send these to existing users on the basis of our legitimate interests in helping you use a service you signed up for. Every one of these has an unsubscribe link, and unsubscribing takes effect immediately. Our emails do not contain tracking pixels and links go straight to their destination. Emails are delivered by Resend.
The optional DeClutter keyboard lets you insert your listing text and save your listing photos to your photo library while you are in a marketplace app. It does not read, record or send anything you type. The listings it shows are copied from the DeClutter app to secure storage on your device. On iPhone it asks for "Full Access" only so that it can download your listing photos from our storage. It contains no analytics.
We do not sell your personal data for money. We share it only with the service providers below, who process it on our instructions (processors), or with partners who are independent controllers for their own processing, as stated.
| Recipient | What and why |
|---|---|
| Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Hosting) | Hosting, database, file storage, sign-in and our servers. Processor. |
| Google (Gemini API and Google Search grounding, Custom Search API) | AI recognition, listing text, pricing and images; finding comparable items. Processor. |
| Stripe | Web payments and billing. Processor for payments; independent controller for fraud prevention and legal records. |
| Apple and Google (App Store, Google Play, Sign in with Apple, Google Sign-In) | In-app purchases and sign-in. Independent controllers. |
| RevenueCat | Confirms in-app subscriptions. Processor. |
| Resend | Sends our emails. Processor. |
| eBay, Etsy, TradeMe, Marktplaats | Only if you connect them, to post your listings. Independent controllers. |
| Google Analytics (Google Ireland Ltd) | Website analytics, only as described in the Cookie Policy. Processor. |
| Meta (Meta Platforms Ireland Ltd) | Website ad measurement via the Meta Pixel, only as described in the Cookie Policy. Joint controller with us for the collection on our website; independent controller for its own use afterwards. |
| Frankfurter (exchange rates), Cloudflare cdnjs (a code library), DuckDuckGo (reference images, searched by our server with the item name only) | Technical services that receive your IP address when your browser or our server contacts them, but no account data. |
| Authorities, courts, advisers, or a buyer of the business | Only where the law requires it, to protect our rights, or if the business is sold, in which case this policy continues to apply. |
Your account and listing database (Cloud Firestore) is stored in the European Union. Our server functions and your photo storage run in Google data centres in the United States, and several of the providers above are based in or process data in the United States. When personal data from the EU, EEA, UK or Switzerland is transferred outside those areas, we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and on the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) in the providers' data processing terms. You can ask us for a copy of the relevant safeguards.
| Data | How long |
|---|---|
| Account, items, photos, connected marketplaces, subscription status, usage events linked to you | As long as your account exists. Deleted when you delete your account (see below). |
| Error reports | 180 days |
| Hashed IP addresses used for rate limiting | 30 days |
| Product usage events | Up to 26 months, then deleted. Deleted earlier if you delete your account. |
| Device identifier record for the free trial | Kept after account deletion, without any link to your account, so the 5 free scans cannot be claimed again on the same device |
| Sales statistics | Kept without your account ID after account deletion, to keep price estimates accurate |
| Your email unsubscribe choice | Kept as long as needed to respect it |
| Payment and tax records | Kept by Stripe, Apple and Google for as long as the law requires; our own invoices and tax records for the period required by Maltese tax law |
| Backups | Our database keeps a rolling 7-day recovery copy, so deleted data fully disappears from it within 7 days |
Deleting your account. You can delete your account at any time in the app (Settings) or on the web, or by emailing hello@thedeclutterapp.com (see also Delete your account). When you do, we delete your account, profile, items, photos, connected marketplace tokens, subscription record, error reports, email history and the usage events linked to you, and we delete your customer record at Stripe. RevenueCat keeps a record of in-app purchases under a random account code, with no name or email, as part of the purchase records Apple and Google require. Records that the law requires to be kept (for example payment and tax records held by Stripe, Apple or Google) are kept only for that purpose. Requests by email are completed within 30 days.
Data is encrypted in transit (HTTPS) and at rest by Google Cloud. Our database and photo storage are protected by security rules that limit access to your own signed-in account, and our servers check every request. Passwords are never stored in readable form. Administrative access to our systems is limited to the founder. Access to stored photos is logged. No system is perfectly secure; if a breach affects your personal data in a way that is likely to put you at risk, we will tell you and the relevant authority as the law requires.
You have the right to:
To use any of these rights, email hello@thedeclutterapp.com from the email address on your account. We reply within one month (extendable by two months for complex requests, in which case we will tell you why). It is free, unless a request is clearly unfounded or excessive. We may ask you to confirm your identity.
This section applies to residents of California and of other US states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others).
DeClutter is for people aged 18 and over, because it is used to sell items and to make payments. You confirm you are 18 or older when you create an account. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
Our AI suggests item names, descriptions, prices and images. These are suggestions you can edit before anything is posted. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
We will update this policy when our services or the law change. The date and version at the top show the latest update. If a change materially affects how we use your personal data, we will tell you in the app or by email before it applies, and, where the law requires, ask for your consent again.
For any question or request: hello@thedeclutterapp.com.
If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to a supervisory authority. Our lead authority is the Information and Data Protection Commissioner (IDPC), Malta (idpc.org.mt). You can also complain to the authority in the EU or EEA country where you live or work, to the UK Information Commissioner's Office (ico.org.uk) if you are in the UK, or to the Swiss Federal Data Protection and Information Commissioner if you are in Switzerland.