Privacy Policy

// UPDATED: 12 JULY 2026

Plug Radar ("we", "us", "the service") respects your privacy. This policy explains what we collect, why, and what you control.

Who we are

Plug Radar is a reseller research tool operated by MrReptastic (a sole trader based in Thailand serving UK/EU users). For contact: hello@plugradar.online.

What we collect

Your email address — if you sign up via founder slot or through Shopify. Used to log you in and send account-related messages.
Telegram identity — if you log in via Telegram: your Telegram user ID, first name, username, and profile photo URL. Used to verify group membership and personalise the dashboard.
Your custom tracker terms — the product searches you save. Used to run scrapes and show you sold data.
Hashed IP address — SHA-256 of your IP, used to rate-limit the founder-signup form. We do NOT store your raw IP.
Session cookie — one HTTP-only cookie to keep you logged in.

What we do NOT collect

Payment card details — Shopify handles all payment processing separately
Third-party ad tracking / Facebook Pixel / Google Analytics
Your browsing history outside Plug Radar
Precise location data

How we use your data

Only for the operation of Plug Radar:

Authenticating you (Telegram bot verification, email magic links, session cookies)
Running your custom tracker searches on Vinted
Preventing abuse (rate limits on signup form)
Occasional service-related emails (magic links, important account changes)

We do NOT sell, rent, or share your personal data with third parties for marketing.

Third parties we rely on

Telegram Bot API — for login and group membership checks
Resend — for sending magic-link emails
Vinted's public API — the source of trending data (we scrape publicly available listings, not your personal data)
Our VPS provider — hosts the service; data stored in EU datacentres

Your rights (GDPR / UK GDPR)

You have the right to:

Access — request a copy of your data
Rectification — correct wrong info
Erasure — delete your account and all data ("right to be forgotten")
Object — opt out of processing
Portability — request data in machine-readable format

To exercise any right, email hello@plugradar.online. We respond within 30 days.

Data retention

User accounts + trackers — kept while your account is active. Deleted within 30 days of account closure.
Magic link tokens — expire after 30 minutes, deleted after 24 hours regardless.
Vinted item snapshots (public data, not personal) — kept for up to 90 days for trending calculations.
IP hashes — rolling 2-hour window, then deleted.

Cookies

We use ONE essential session cookie (`session`) to keep you logged in. It's HTTP-only and expires when you clear browser cookies or click Logout. No tracking cookies, no third-party cookies. Full details in our cookie notice.

Security

Data stored in encrypted-at-rest SQLite on EU VPS. All web traffic served over HTTPS. Bot tokens and webhook secrets stored as environment variables (never in code). Sessions signed with a rotating secret.

Changes to this policy

If we make material changes, we'll update the "Updated" date above and notify active users via email or in-app banner.

Complaints

If you believe we've mishandled your data, contact us first at hello@plugradar.online. UK users can also complain to the ICO at ico.org.uk.

MRREPTASTIC · PLUG RADAR · Terms · Cookies