←BackPrivacy Policy

Last Updated: November 13, 2026

Treasures.Today (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information when you use our website at treasures.today.

1. Information We Collect

1.1 Information You Provide

When you create an account or use our services, you may provide:

  • Email address — used for account creation, authentication (magic link), and transactional communications
  • Name — optionally provided via Apple Sign In or your profile
  • ZIP code and home address — used to personalize your location-based search; your home address is kept private and is never displayed publicly
  • Sale address — the address you submit when creating a garage, yard, estate, or other sale listing
  • GPS verification data — coordinates captured at the time of listing creation to verify that you are physically at the sale location
  • Photos — images you upload to accompany a sale listing or business profile
  • Sale and listing details — dates, times, descriptions, and categories you enter when creating a listing
  • Business information — store name, address, phone number, hours, website, and category for business owners who register on the platform
  • Phone number — collected only when verifying ownership of an existing business listing via one-time passcode (OTP); not stored for general account use

1.2 Information Collected Automatically

When you use the platform, we automatically collect:

  • Device and browser information — browser type, operating system, and device identifiers used for session management and spam prevention
  • City-level location — derived from your IP address or provided by you to show nearby listings; precise GPS is only collected when you explicitly use location-based features
  • Search queries — keywords and filters you enter to find sales or stores
  • Usage events — anonymized counters for listing views, direction clicks, shares, and saves; these are stored internally and are not shared with third-party analytics services
  • Session cookies — a secure, HTTP-only session token stored in a cookie to keep you signed in; it contains no personal information

1.3 Information from Third-Party Sign In

If you sign in with Apple, we receive your email address and, if you choose to share it, your name, from Apple. We do not receive your Apple ID password or any financial information.

2. Information We Do NOT Collect

We do not collect:

  • Payment or credit card information — we do not process payments
  • Social Security numbers or government identification
  • Sensitive demographic data (race, ethnicity, religion, health information)
  • Contacts, messages, or communications between buyers and sellers
  • Third-party advertising identifiers or cross-site tracking data

3. How We Use Your Information

We use the information we collect to:

  • Operate the platform — create and display sale listings, run location-based search, and show the store directory
  • Authenticate you — verify your identity via magic link email or Apple Sign In and maintain your session
  • Verify sale locations — GPS data is used solely to confirm that a listing is associated with the stated address; it is not stored long-term for tracking purposes
  • Send transactional emails — sign-in links, listing confirmations, and notification alerts you opt into
  • Enable notifications — if you subscribe to address-unlock alerts, we use your email to send you relevant sale notifications; you can unsubscribe at any time
  • Prevent abuse — detect spam, duplicate listings, and policy violations using automated and manual review
  • Improve the service — aggregate, non-identifiable usage data helps us understand how the platform is used and where to focus improvements

We do not sell, rent, or trade your personal information to any third party.

4. How We Share Your Information

We use the following third-party service providers to operate the platform. Each provider processes only the data necessary to deliver their service and operates under its own privacy policy:

  • Cloudflare — website hosting, edge infrastructure, and database storage (Cloudflare Workers, Pages, D1, and R2)
  • Resend — transactional email delivery (sign-in links, notifications)
  • Mapbox — interactive maps and geocoding for location-based features
  • Apple — optional Sign In with Apple authentication
  • Cloudflare Turnstile — anti-bot verification used on certain forms to prevent spam; this does not place advertising cookies

Beyond these providers, we do not share your data with advertisers, data brokers, or any other third parties except as required by law.

5. Publicly Visible Information

When you post a sale listing, the following information is visible to all visitors:

  • Sale type, dates, and times
  • General neighborhood or intersection (we do not display the exact street address until a registered user requests it)
  • Photos you upload
  • Sale description and categories

Your email address and home address are never displayed publicly. Business listings display only the information you submit for public business use (name, address, phone, hours, website).

6. Cookies and Local Storage

We use a minimal number of cookies:

  • Session cookie (tt_session) — a secure, HTTP-only cookie that keeps you signed in; expires automatically
  • Short-lived state cookies — used only during the Apple Sign In flow and discarded immediately after authentication

We do not use advertising cookies, tracking pixels, or any cross-site behavioral tracking. No third-party advertising networks have access to your browsing on this site.

7. Data Retention

  • Account and profile data — retained while your account is active and deleted upon request or after account closure
  • Listings — expired listings are periodically cleaned up; deleted listings are removed from public view immediately
  • Photos — stored in Cloudflare R2 and removed when the associated listing or business profile is deleted
  • Session tokens — only the SHA-256 hash of your session token is stored; raw tokens are never persisted
  • Email tokens (magic links) — one-time login links expire after 15 minutes and are invalidated upon use
  • Notification subscriptions — retained until you unsubscribe or delete your account

8. Your Rights and Choices

You have the following rights regarding your personal data:

  • Access — you may request a copy of the data we hold about you
  • Download — you can download your data directly from your account profile page at any time
  • Correction — you may update your profile information at any time from your account settings
  • Deletion — you may request deletion of your account and all associated data by contacting us at privacy@treasures.today
  • Notification opt-out — you can unsubscribe from address-unlock notifications at any time from your account settings or by following the unsubscribe link in any notification email

To exercise any of these rights, contact us at privacy@treasures.today. We will respond within a reasonable timeframe and in accordance with applicable law.

9. Children's Privacy

Treasures.Today is not directed to children under the age of 13. We do not knowingly collect personal information from anyone under 13. If we learn that we have inadvertently collected data from a child under 13, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@treasures.today.

10. Data Security

We use industry-standard technical and organizational measures to protect your information, including:

  • HTTPS encryption for all data in transit
  • Hashed session tokens — only the SHA-256 hash of your token is stored in the database
  • HTTP-only, secure cookies that cannot be accessed by JavaScript
  • Rate limiting and anti-abuse controls on all sensitive endpoints

No system is completely secure. If you believe your account has been compromised, contact us immediately at privacy@treasures.today.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date at the top of this page. Material changes will be communicated via email or a prominent notice on the site. Continued use of the platform after a change takes effect constitutes your acceptance of the updated policy.

12. Contact

For privacy-related questions, data requests, or concerns, contact us at: privacy@treasures.today

Treasures.Today is based in Deerfield, Illinois, United States.