Privacy Policy

Account information. Your email address, an optional company or display name, and your subscription plan and status. If you sign up with a password, we store only a bcrypt hash of it, never the password itself. If you sign in with Google, we receive your email address, its verification status and your name from Google; we do not receive your Google password.

Marketplace and source credentials. API keys, access tokens and similar credentials you connect (for example Shopify, ComicBase, HipComic, Mascot, eBay or Etsy). These are encrypted before they are written to our database and are decrypted only when needed to talk to that service on your behalf.

Inventory data. The comic records you upload or sync (ComicBase, CLZ, CSV and similar exports, or records pulled from a connected source): titles, issues, publishers, condition and grade, prices, quantities, notes, locations, tags and image references, plus the files you upload while they are being processed.

Images. Cover images you upload for your own items. Photos you take with the scanner are sent to our recognition provider to identify the book; we do not keep a copy of the scan photo itself.

Data returned by connected services. We keep the full responses that paid and marketplace APIs return for your account — for example scan-identification results and price data, barcode lookups, and listing, sale and webhook records returned by your marketplaces. These are stored against your account only. Sale and order records can include details of the transaction as the marketplace reported it.

Listings and activity logs. Which items are listed on which channel, their listing state and identifiers, and a log of sync, publish and webhook activity on your account.

Billing. Payments are handled by Stripe. We store your Stripe customer and subscription identifiers; we never see or store your full card number.

Beta applications. If you apply to the beta program, the information you enter in that form.

Technical data. IP address and request details (used for security, rate limiting and operational logs), and error reports when something breaks.

• To run the service: import, store, price and enrich your inventory, and list, update and delist it on the channels you connect.
• To keep your inventory consistent across channels, including reacting to sales reported by your marketplaces and writing them back to your source where you have set that up.
• To authenticate you, secure your account and prevent abuse.
• To bill your subscription and enforce plan limits.
• To send transactional email: account verification, password resets, welcome and onboarding messages, sync notices, trial and payment notices, and beta program updates. We do not send marketing email.
• To diagnose errors and keep the service running.

We do not sell your data. We share it only with the services needed to run LongboxSync, and with the services you choose to connect:

• Marketplaces you connect — Shopify, eBay, Etsy, HipComic and Mascot receive the listing data (titles, descriptions, prices, quantities, images) for items you publish to them, and we read listing and sale data back from them.
• Sources you connect — HipComic and ComicBase, to read your inventory and, where enabled, to record sales back to ComicBase.
• Ximilar — receives the photos you scan in order to identify the comic.
• PriceCharting — receives identifying details such as titles and barcodes to look up market pricing.
• Stripe — payment processing and subscription billing.
• Google — only if you choose “Sign in with Google”.
• Resend — delivers our transactional email, so it receives your email address and the message.
• Sentry — error reporting from our servers and your browser, configured not to send default personal data.
• Vercel — hosts the website and app front end and provides Vercel Web Analytics. Where enabled, we also use Plausible for privacy-friendly page analytics.
• Railway — hosts our API, background workers and database.
• Cloudflare R2 — where configured, stores uploaded item images.

We may also disclose information if required by law or to protect the rights and safety of our users or the service.

Item images you upload are served at unguessable links so that your marketplaces (for example Shopify) can fetch them for your listings. Anyone who has one of those links can view that image without signing in. Images that appear in a published listing are public on that marketplace in any case.

• Account activity and sync logs are deleted automatically after 90 days.
• Uploaded import files are deleted after they are processed successfully. If processing fails, the file is kept so it can be retried and is deleted automatically after 30 days.
• Your inventory, listings, connected credentials, stored API responses and images are kept while your account exists. Cancelling your subscription does not delete them.
• You can remove a connected credential at any time from Settings.
• When a Shopify store uninstalls the LongboxSync app, we deactivate that store's credential.

You can view and edit your inventory and connections in the app. To request a copy of your data, correction, or deletion of your account and its data, email support@longboxsync.com from the address on your account. Account deletion is handled on request; there is no self-serve delete button yet.

Data you have already published to a marketplace is also held by that marketplace under its own policies; remove it there as well if you want it gone.

• Your sign-in session token is kept in your browser's local storage.
• When you use “Sign in with Google”, a short-lived, HttpOnly cookie protects that sign-in from cross-site request forgery.
• Session storage remembers where to return you after connecting Shopify.
• Local storage and IndexedDB remember scanner camera preferences and, if you grant access, the image folder you chose for matching cover art. These stay on your device.
• Vercel Web Analytics (and Plausible, where enabled) measure page visits without advertising cookies. We do not use advertising or cross-site tracking cookies.

Connected-service credentials are encrypted at rest, passwords are hashed, and data is scoped to your account. No system is perfectly secure, and we cannot guarantee absolute security; please use a strong, unique password and tell us promptly at support@longboxsync.com if you suspect your account has been compromised.

LongboxSync is a business tool for sellers and is not directed at children under 13. We do not knowingly collect their information.

We will update this page when our practices change and revise the “Last updated” date above. For material changes we may also notify account holders by email.

Questions about this policy or your data: support@longboxsync.com. LongboxSync is operated by Long Street Comics. See also our Terms of Service.