This policy explains what personal data HorologyRadar collects, why, and what your rights are. It covers two groups of people: visitors and account holders who use the site, and sellers whose public listings on other websites appear in our index. Vega LLC is the data controller.
1. Who we are
Vega LLC is an independent software company in the New York City area. Contact for anything in this policy: dmitri@vegalending.com, or by post at the address on request from that email.
2. Data we collect from visitors and account holders
| Data | When | Why | Basis |
|---|---|---|---|
| Email address, and the identifier your sign-in provider (Google or Apple) gives us; we store no passwords | When you create an account | To sign you in and deliver alerts | Contract |
| Saved searches and their notification settings, alert matches, starred listings, the browsers you enabled notifications on, webhook addresses you added, display preferences | As you use them | To provide the features you asked for | Contract |
| Payment status and subscription tier | If you subscribe to a paid tier | To grant access and bill you. Card details go to our payment processor and never reach us. | Contract |
| Server logs: IP address, browser, pages requested, timestamps | Every request | Security, abuse prevention, debugging. Kept 30 days. | Legitimate interest |
| Aggregate usage analytics | As you browse | To understand which features are used. No cross-site tracking, no advertising identifiers. | Legitimate interest |
| Messages you send us | When you email us | To reply | Legitimate interest |
Alert emails carry no tracking pixels or tracked links, so we do not record whether you open or click them. We do record when an email to you bounces or is marked as spam, so we can stop sending to an address that cannot receive it.
We do not sell personal data. We do not use it for advertising. We do not build profiles beyond the preferences you set yourself.
3. Data in indexed listings
HorologyRadar indexes for-sale posts that people publish on public forums, subreddits, and marketplaces. Those posts contain personal data of the seller: a username or handle, sometimes a first name, a location, and the text and images they chose to publish. We process this data to run a search engine over listings that are already public, under the lawful basis of legitimate interest. In weighing that interest we rely on these limits:
- We index only what is public and only from for-sale sections. Nothing behind a login, no profiles, no private messages.
- We show the handle and post count as they appear on the source site, and link every listing back to it. We do not merge handles across sites into a single identity profile without a public signal that they are the same seller.
- When a source post is deleted, we remove the listing within 24 hours.
- Any seller can ask for their listings to be removed or for their handle to be excluded from the index, by emailing dmitri@vegalending.com. We act within two business days and do not ask for a reason.
- Images are stored at reduced size for thumbnails and are removed with the listing.
- We respect each source site's robots.txt and terms, and our crawler identifies itself. Site owners can read the full policy on the page for site owners.
Where a source has its own rules for data we obtain through its API, such as Reddit's requirement that deleted content be removed, we follow them.
4. Where data is processed
Servers are in the United States. Our processors, each bound by a data processing agreement, are: a hosting provider for the application and database, an email delivery provider for alerts and account emails, a payment processor for paid tiers, and an error-tracking service. We also send data to recipients you choose or use: Google or Apple when you sign in with them, your browser vendor's push service when you turn on notifications, and the webhook addresses you add (Slack, Discord, or your own server), which receive the matches you asked for. We list the current providers on request. If you are in the European Economic Area, United Kingdom, or Switzerland, transfers rely on standard contractual clauses.
5. Retention
- Account data: until you delete your account, then 30 days in backups.
- Server logs: 30 days.
- Indexed listings: as long as the source post exists, plus the sold or withdrawn record as price history. Removed on request or when the source deletes it.
- Messages to us: two years.
6. Cookies
We use a session cookie to keep you signed in and a preference cookie for display settings. Neither is used for tracking across sites, and neither requires consent under the ePrivacy rules because both are strictly necessary for the service you asked for. We set no third-party advertising cookies.
7. Your rights
Depending on where you live, you have the right to access, correct, delete, or export your personal data, to object to or restrict processing, and to withdraw consent where consent is the basis. This applies to account holders and to sellers whose listings we index. Email dmitri@vegalending.com. We respond within 30 days. If you are in the EEA or UK you may also complain to your supervisory authority. If you are a California resident, the rights above cover those in the CCPA; we do not sell or share personal information as defined there.
8. Children
HorologyRadar is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has created an account, email us and we will delete it.
9. Security
Data is encrypted in transit. There are no passwords: sign-in links expire in 15 minutes and work once. Access to production systems is limited to the people who operate them. No system is perfectly secure, and if a breach affects you we will tell you without undue delay.
10. Changes
We will post changes here with a new effective date, and email account holders about any change that reduces their rights.