Privacy policy

Slowcart is a wishlist that watches prices. It is run by one person. For anything in this policy — including a request to see or delete what we hold — get in touch here.

Because you gave it to us: your email address, optionally your name, your timezone and currency, your alert preferences, and the lists and links you add.

Because using the product creates it:the prices we read for the things you’re watching, with a timestamp on each; a record of which alerts fired and which were sent; and, if you share a list, the claims viewers make on it.

Because security requires it:a hash of each sign-in link and each signed-in browser, and the network address that requested a sign-in link. We store hashes, not the links or tokens themselves, so a copy of our database doesn’t let anyone sign in as you.

We don’t collect: payment details (nothing here costs money), location, contacts, or anything from an advertising or analytics network. There is no tracking pixel and no third-party script on any page of this site.

Most of it because you asked for a service that can’t work without it: we can’t email you a price alert without your email address, and we can’t tell you a price has dropped without a record of what it used to be. That’s performance of the thing you signed up for.

The sign-in and rate-limiting records are a legitimate interest in not being overrun — keeping someone from requesting ten thousand sign-in links to your address is also protecting you.

The weekly digest is on by default and off in one click in settings, along with everything else we might send you.

Three service providers, each doing one job: Vercel hosts the site, Neon stores the database, and Resend delivers email. They process this data on our instructions and for nothing else.

Nobody else. We do not sell personal data, we do not share it for advertising, and we take no affiliate commission on anything you buy — which means no retailer is paying us for a link to you.

We’d hand something over if a court ordered it. If that ever happens and we’re permitted to tell you, we will.

The check runs from our servers, not your browser. A retailer sees a request from Slowcart identifying itself honestly, and nothing that identifies you. Product images are fetched the same way and served from this site rather than linked from theirs, so rendering a list doesn’t send your address to every retailer on it. We respect robots.txt; where a retailer asks not to be crawled, we don’t crawl them and we say so on the item rather than showing you a price we can’t stand behind.

When you share a list, a viewer can mark an item as claimed. That record is visible to other viewers of the same link and is nevervisible to the list’s owner — not the rows, not a count, not an indirect hint.

This is enforced in the database and in the build, not by policy. It is the one place where a person’s data is deliberately withheld from the person the list belongs to, and it is the point of the feature.

A viewer with no account is identified by a random value in a cookie in their own browser. We store only a hash of it, so it tells us “this is the same person as last time” and nothing more.

Your account and everything hanging off it: until you delete it. Price history lives as long as the item does.

A sign-in link stops working after 15 minutes, and its record — including the address that requested it — is deleted a month after that. The month isn’t arbitrary: while the record exists, clicking an old link out of your inbox gets told “that link has already been used” instead of “we didn’t recognise that link”. A signed-in browser expires after 30 days and its record is deleted once it does. Both are swept daily.

Deleting your account deletes it: the account, the lists, the items, their price history, the sessions, and any claims made on your items. Feedback you sent us survives with your account detached from it.

A copy of what we hold, a correction, or deletion. Deletion you can do yourself in settings, immediately, without asking. For the other two, ask and we’ll do it — there is no form and no verification theatre beyond checking you can receive mail at the address on the account.

Depending on where you live you may also have the right to object to processing or to complain to a data protection authority. Please tell us first; we’d rather fix it.

Slowcart isn’t intended for children under 13, and we don’t knowingly keep accounts for them. If one exists, tell us and it goes.

The date at the top of this page moves when the text does. If a change would mean doing something with your data that this page currently says we don’t do, we’ll email you before it takes effect — finding out by re-reading a policy is not notice.