Legal
Privacy
The phone apps keep your desk keys on the device and scan from there. The website scans on our server, so it sends the keys you saved with each scan. Sign-in is optional.
What Stays on the Phone
API keys you paste into the Android or iPhone app are stored in the device keystore (Android EncryptedSharedPreferences, iOS Keychain). Those apps scan eBay, Mercari and your paid desks from the phone itself. Scanning never sends a key — the scan endpoint refuses one outright. The only time a key leaves the phone is if you tap Push Phone Keys to Account yourself, which stores an encrypted copy so another device can restore it. If the phone cannot reach a marketplace it falls back to this website's free-desk book, which uses no key of yours.
The website works differently and it is worth being clear about it. Keys you paste at /settings are held in your browser, but a scan runs on our server, so the keys you have saved are sent with each scan request in order to query those desks. They are used for that request and are not stored unless you choose the account backup below. If you would rather no key ever left your device, use the phone apps.
Optional Account
If you sign in, DealDex stores your email and any keys you choose to back up so you can restore them on another device. Backed-up keys are encrypted at rest. You can use the apps without an account.
Website Analytics
The DealDex website uses Vercel Web Analytics to count visits and page views, and Vercel Speed Insights to measure Core Web Vitals (paint, layout, and interaction timing). Those products do not use cookies and do not identify you. The website also sends logs, traces, and Real User Monitoring to Datadog on the existing fleet account so errors and slow requests stay visible. Datadog Session Replay is off. Scan hops (eBay, Mercari, match, enrich, and cache hit or miss) are timed with Sentry Performance so a slow marketplace step is visible without extra Datadog APM child spans. Those traces do not include listing titles, search queries, or desk keys. Native apps do not send those web events.
Notifications
The iPhone app may ask to send local alerts when a listing matches a rule you set. You can decline. DealDex does not send marketing push.
Contact
Questions: use the email on the App Store or Play listing. This page is the privacy policy for the DealDex website and the native apps.