Privacy Policy

Second Step stores the following, and nothing beyond it:

• Account information: your email address, an optional display name, country and currency preference.
• Footwear sizes you choose to save (gender, size system, size value, label, default flag).
• Search preferences: preferred brands, categories, conditions, marketplaces, price range and notification settings.
• Searches you run: the text, style number, brand, category, gender, size, condition, price range, sort order, search type and the storage path of any photo you upload.
• Search results: which marketplace listings were returned, their rank, match score, match reasoning and the price recorded at the time of the search.
• Saved searches, favorites, alerts and recorded purchases you create.
• Subscription records, including plan and status, and identifiers issued by our payment processor when billing is enabled.
• Usage events: an event type, quantity and related metadata.

Our hosting and infrastructure providers may log standard technical request information, such as IP address and browser user agent, for security and reliability. We do not use that information to build profiles about you.

Information is used to operate the service: authenticating you, running searches against connected marketplace APIs, ranking and matching results against what you asked for, showing your history and saved searches, and managing your plan.

We do not sell your personal information. We do not use your searches, photos or account data to train machine-learning models, and we do not send marketing email unless you ask us to.

Every search you run while signed in is stored against your account, together with the results returned for it. Saved searches store the criteria you chose, an optional name, a target price and your notification preferences. These records are visible only to you; access is enforced at the database level.

If you upload a photograph to search by image, the file is stored in a private storage bucket scoped to your account and the search record keeps the file path. Photo-based matching is not yet active in the product.

Listings shown in Second Step come from third-party marketplaces. They are not our inventory. For each listing returned to you we store a normalized copy: the marketplace, the marketplace's listing identifier, title, listing URL, image URL, price, currency, shipping cost, estimated total, condition, brand, model, style number, size, size system, gender, listing status, listing creation date, the first and last time we saw it, and the seller's marketplace username and rating where the marketplace provides them. We do not store the raw marketplace API payload.

Our first marketplace connector uses official eBay APIs — the Browse API for searches, the getItem API to enrich a small number of top-ranked results with details such as brand, model, style code and size, and the Taxonomy API to resolve categories and item aspects. We do not scrape eBay. Responses are cached on our servers for a limited period to reduce repeated calls.

Listing links take you to eBay. Once you follow such a link, eBay's own privacy policy and terms apply to your activity there.

Second Step receives eBay marketplace account deletion and closure notifications at a dedicated endpoint. When a notification is verified, we remove the associated seller username and seller rating from the listing records we hold.

Second Step does not currently participate in any affiliate or referral program, and outbound marketplace links do not carry affiliate tracking parameters. If that changes we will update this policy and disclose it in the interface.

Signing in stores a session in your browser so you remain authenticated. This is strictly necessary for the service to work. We record usage events tied to your account for service operation, such as counting searches against your plan.

We also keep our own anonymous usage statistics to improve Second Step: pages visited, campaign tags on the link you arrived from, the referring website's name, a rough device type (phone, tablet or computer), searches performed (including a shortened copy of the footwear search text, with email addresses, web links and phone numbers removed), result counts, filter choices and which marketplace listing you clicked through to. These statistics use a random per-visit identifier and a simple "visited before" flag stored in your browser; they are not linked to your name or email and never include passwords, payment details or uploaded photos. If your browser sends a Do Not Track signal, none of this is recorded.

We do not run third-party advertising tags, and we do not use third-party analytics or cross-site tracking cookies.

Our retention policy is:

• Search history and the results recorded with it: 3 months.
• Uploaded photos: 30 days.
• Marketplace listing records: 1 year from the last time we saw the listing.
• Usage records: 1 year.
• Account information, saved searches, saved sizes, favorites and alerts: kept while your account is open, then removed after an account deletion request.

To be transparent about how this works today: these periods are our policy, and deletion beyond those periods is currently performed manually rather than by an automated scheduled job. Automated enforcement is planned. You can delete your saved searches and saved sizes yourself from within the app at any time. Server-side caches of marketplace responses expire on their own within hours and hold no personal account data.

There is no self-service account deletion flow in the product yet. To delete your account, email secondstepsearch@gmail.com from the address on your account. We will confirm the request and erase your account record, saved sizes, preferences, saved searches, favorites, alerts, search history, search results and uploaded photos, normally within 30 days.

Marketplace listing records are not personal to you and are retained under the schedule above. We may retain a minimal record of the deletion request, and any billing records we are required to keep, for legal and accounting purposes.

Second Step relies on third parties to operate: Lovable (application hosting) and Supabase (database, authentication and file storage) for infrastructure, eBay for marketplace listing data, and Stripe as payment processor for paid plans when billing is enabled. These providers process data in the United States and, for some infrastructure, in other regions where they operate.

You can view and edit your profile, sizes and preferences in the app, delete saved searches and sizes yourself, and request a copy or deletion of your data by emailing secondstepsearch@gmail.com. Depending on where you live you may have additional rights over your personal information; we honor those requests through the same address.

Accounts are authenticated, per-user records are isolated by row-level security policies in the database, uploaded photos live in a private bucket scoped to the uploading account, and marketplace API credentials are held only on the server and are never sent to the browser. No system is perfectly secure; if a breach affects your personal information we will notify you at your account email address as required by applicable law.

Second Step is not intended for anyone under 16. We do not knowingly collect information from children under 16. If you believe a child has created an account, email secondstepsearch@gmail.com and we will delete it.

We may update this policy as the service changes. The effective date at the top will be updated, and material changes will be announced in the app and by email to registered users at least 14 days before they take effect. Continuing to use Second Step after that date means you accept the updated policy.

Second Step is operated by Jasan Rodriguez. For privacy questions, data requests or account deletion, email secondstepsearch@gmail.com.

See also our Terms of Service and Contact page.