Privacy Policy

This policy explains what Soldcurve ("we", "us") observes from public livestreams, what we collect from you, where it lives and what you can ask us to do with it. It covers two groups of people: members and visitors of soldcurve.com, and sellers and buyers who appear in the livestreams we watch.

1. Who we are

Soldcurve runs soldcurve.com, a subscription that publishes observed closing prices from public livestream auctions. We are the controller of the data described here. Contact: support@soldcurve.com.

2. Data we observe from public livestreams

We watch public livestream auction rooms with our own devices, around the clock. We record only the close of each lot: the final hammer price, the currency, the time, the identity of the product on the block (recognised by an AI vision model, because lot titles are usually generic) and a screenshot of the screen at the moment of the close, used for verification. Product names may be grouped into one product-family record. Model and condition may be uncertain; a shared record does not establish an exact match.

We publish, per product: name, category and brand; median, floor and ceiling; 25th and 75th percentile; counts of closes and of distinct rooms; momentum (7 days against the prior 7 days); the busiest slots; price history by pooled session; and individual closes as prices under pooled time labels. Bundles are excluded from every published figure, and products with fewer than 5 eligible observed closes are shown without prices. The minimum sample counts only single-item closes with a known USD price.

We never publish or show to members the name, handle, avatar or any other identity of a seller or a buyer. Times are published only as a day plus a part of day (night, morning, afternoon or evening) in New York time; prices inside a slot are sorted rather than chronological, and no minute timestamps are published, so that a particular stream cannot be picked out from our data.

Internally, our capture system keeps technical identifiers of the room and of the seller account as seen on the platform: the platform id, the room id, the room title and the stream URL. We keep them to de-duplicate observations and to pool them. They are never published, never shown to members and never attached to a published frame.

3. Frames

At every close the capture device takes a full-screen capture. Raw captures are stored only on our private capture system, not on the website and not in the cloud database. They are used for verification and for producing the published frame. Raw captures are kept privately for verification and are deleted automatically 12 days after capture; they are never published.

To publish a frame, the capture is cropped to the product band and then screened automatically by a vision model for three things: a readable username, handle or person's name; a recognisable live human face (a face printed on packaging does not count); and whether the product is visible. Frames that fail are rejected and deleted from the publication pipeline. Frames that pass automated or operator review are published under unguessable file names and shown as "Observed on stream" frames to subscribers entitled to them (Pro, and Starter during the launch offer). No room, title, link, seller or buyer is kept with a published frame.

4. Data you give us

Account. Your email address, a hash of your password (never the password itself), an optional display name, an optional seller handle you typed at sign-up (used only to recognise your account; it grants no authority), a flag recording whether your email is verified, your role (subscriber, promoter or operator), your subscription status and plan, your Stripe customer and subscription ids, the time your free trial was used, the referral code that referred you, and timestamps.

Google sign-in. If you choose to sign in with Google, we receive your email address, your name and your avatar URL from Google and store them on your account.

Sessions. Signing in sets a signed session cookie. Sessions expire after a set period; an expired session row is removed the next time it is presented.

Watchlist. The product names you choose to watch are stored on your account so you can return to them and read the on-site watchlist summary. You can unwatch any product at any time. We do not currently send a scheduled weekly digest email.

Sourcing requests. The product name, your email address, an optional message and any quantity or target price you include. These are shared with our sourcing desk. When we contact a supplier, we share the product and the quantity with that supplier, not your identity, unless you ask us to connect you.

Support. Your email address and the message threads you exchange with us.

Waitlist. The email address you enter on the early-access form of our launch page. We keep it so that we can invite you, and for nothing else.

Referrals. Visiting a link of the form /r/CODE sets an httpOnly cookie named sc_ref for 30 days. If you create an account and open your account page within 48 hours while that cookie is present, the account is linked to the promoter who owns the code. Promoters see the sign-ups and the revenue that came from their code, with email addresses masked.

5. Payments

Stripe processes payments. Card numbers never reach our servers. We store your Stripe customer id and subscription id, your plan and your subscription status, plus invoice identifiers, currency, amounts and payment timestamps. Stripe's own privacy policy applies to the payment data it holds.

6. Cookies and analytics

We set two persistent cookies: the session cookie that keeps you signed in, and the sc_ref referral cookie described above, which lasts 30 days. Signing in with Google sets a short-lived cookie for the duration of the redirect. Your browser's local storage holds your theme choice, your catalog compare list and the token that identifies your support thread; the first two never leave your browser, and the token is sent only to us.

Our analytics are first-party only. Browser session storage holds a random visit identifier and limited campaign labels. A visit expires after 30 minutes of inactivity; closing the tab clears its stored visit. We record page and product views, product-search activity, signup and checkout entry, together with a broad referral source or the campaign labels supplied in the link. Full referrer URLs, URL query strings, passwords and raw IP addresses are not stored in these events. Signed-in activity can be linked to an internal account id so we can measure the customer journey and exclude our own test accounts. Actual account creation and successful payments are recorded by our servers. Browser analytics respects Do Not Track and Global Privacy Control.

Earlier page-view records contain a daily salted network hash, path, product and sign-in flag. These hashes are not a count of people. We use no third-party analytics, advertising cookies or fingerprinting. Web fonts load from Google Fonts, listed below.

Rate limiting keeps IP addresses in memory only, briefly, to slow abuse of our forms and endpoints.

7. Processors and where data lives

We use these providers to run the service, each only for the purpose listed:

• Vercel: web hosting (United States)
• Supabase: Postgres database (United States, East)
• Stripe: payments
• Resend: transactional email (verification, password reset, trial and receipt notices, support replies)
• Google: optional sign-in
• Google Fonts: web fonts served from fonts.googleapis.com and fonts.gstatic.com; the request carries your IP address and browser details, no cookies
• Cloudflare: DNS

The capture system runs on our own hardware. Your data may be processed in the United States. We do not sell personal data, and we share it only with the processors above and as described in this policy.

The site is served over HTTPS only with security headers set. Passwords are stored hashed. Operator screens are restricted to the operator role.

8. Retention and deletion

You can delete your account by emailing support@soldcurve.com from the address on the account. We remove your personal data within 30 days, except billing records that we must keep for tax and accounting. Your watchlist and your support threads are deleted with the account. Daily hashes remain pseudonymous records; their rotation limits cross-day linkage. Account-linked conversion events are deleted with the account. Expired session rows are removed as described in section 4. A waitlist entry is deleted on request from the address that was entered. Raw captures are deleted 12 days after capture, as described in section 3.

9. Your rights

On request from the address on your account you can obtain a copy of your account data, correct it, export it or have it deleted. We do not sell personal data, and we make no automated decisions with legal effect about you. If you live in California or the European Union, these same practical rights are available to you in the same way; write to support@soldcurve.com.

10. Removal requests

Sellers, buyers and anyone else who believes a published frame or record identifies them can email support@soldcurve.com with a link to the record. We review the request within 7 business days and remove frames that fail our rules.

11. Children

The service is for people 18 or older. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete it.

12. Changes

We may update this policy. Material changes are announced by email to the address on your account at least 30 days before they take effect; other changes take effect when posted here, with the date at the top updated.

13. Contact

support@soldcurve.com