Privacy Policy

Weekend Sales Finder (“we”) is operated by All Spark Enterprises Ltd., Devlin, Ontario, Canada. This policy explains what personal information we collect, why, who we share it with, how long we keep it, and your rights. We are a Canadian company and follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) for everyone, including U.S. users; your information is stored in Canada and processed by the U.S. service providers listed below. We don't sell or share your personal information for advertising, ever. Questions or requests: support@weekendsalesfinder.com (our privacy officer).

What we collect and why

• Account: email address (to sign you in with one-time codes), name, and whether your account is personal or business.
• Phone number: verified by a texted code to keep fake accounts off the map. It is never shown publicly. If you switch on text alerts, we also text it when someone messages you (only that), from a number that can't read replies; text STOP or switch it off in Settings anytime.
• Home address and town (optional): to fill in your sales quickly and as your route starting point. Shown publicly only on a sale you post there.
• Sale listings: the sale address, date, times, description, item list and photos. These are public — that is the purpose of a listing.
• Business accounts: business name, contact details, staff emails, sale items and prices, and the sale-day records you choose to keep. Floor prices and sale records are visible only to your business and our team.
• Payments: handled by Stripe, a PCI DSS Level 1 certified processor: card details go straight to Stripe over an encrypted connection and are never sent to or stored on our servers; we keep a record of each payment (amount, date, receipt reference).
• Last Call items and messages: items you list after a sale (public) and messages between you and the other person about an item. Messages are private to the two of you; we don't read them unless one of you reports the conversation. They are kept 7 days after the last message (30 if either of you taps “Save”), then deleted. We email you when a new message arrives — and text you too, if you switched text alerts on. If you tap “I'm here” at a booked pickup, we use your phone's location once to work out how far you are from the address and keep only that distance, never the location itself.
• Help forum: questions and answers you post are public under your first name. Before a post appears it's checked automatically (a word filter and an AI review by Anthropic for language, manners, spam and personal details); posts that aren't published are kept 30 days, then deleted. If you delete your account, your published answers stay, marked “A former member”.
• Pickup ratings: after a Last Call pickup, each person can rate the other (went smoothly / no-show / problem). Others see only your totals. To stop people escaping a record by making a new account, ratings are linked to a one-way scrambled fingerprint of your verified phone number (not the number itself).
• “Bring it to my town” list: your email and town, used to send you one email when we open there. Remove yourself with the link in the confirmation email.
• Street and community sales: if an organizer adds your home, we store the address and email they gave us to send you one invitation. Your home isn't shown anywhere until you accept.
• The Saturday list (optional): if you sign up for the weekly email, we keep your email address and town. We only start sending after you confirm, and every email has a one-click unsubscribe. Unconfirmed and unsubscribed addresses are deleted after 30 days.
• If we post a sale for you at your request, we create your account from the email you gave us and email you once to confirm it's up and how to sign in.
• Referral credit: a record of credit you earned (which of your invitees' listings it came from) and spent (which of your listings it paid toward).
• Share leaderboard: your account has a share code that's added to links you share. If you sign up through someone's link, we record who invited you so they get credit. They and the public only see a count, never who you are. The leaderboard shows first names (or business names) and counts. You can hide your name. Prize winners' names and contact details are used only to deliver the prize.
• Sale ratings: when you rate a sale, the seller's page shows your stars, your comment and your first name only. If you scan a sale's QR sign and check in, we read your phone's location once, just to confirm you're at the sale, and keep only the distance. Check-ins are deleted after 30 days. Ratings of a seller stay tied to a one-way fingerprint of their phone number, so deleting an account doesn't erase them. They're removed 180 days after the account is deleted.
• Share links: we count how many times your sale's share link and sign QR code are opened. The count is anonymous: it doesn't record who clicked.
• Messages to organizers: when you message the organizer of a street or town-wide sale, we send your first name, your message and your email address to them so they can reply. We keep a copy to deal with misuse.
• Notification choices and interests: which emails you want, which item categories you hide, and when and where you chose them (that's our record of your consent). Change them anytime in Notifications & interests; every optional email has a one-click way to stop it.
• Routes, favorites, roadmap ideas, comments and testimonials you create.
• Reports, appeals and photos: if you report a sale, appeal a decision or add setup photos, we keep your explanation and photos. We read the location and time stored in the photo, and, if you allow it, your phone's location at that moment, only to check the photo was taken at the sale on the sale day.
• Technical: sign-in session cookies and basic server logs (IP address, browser) needed to run and secure the site. Our activity and admin logs are deleted after 12 months. We show no ads and use no advertising cookies.
• Site analytics (only if you say OK): Microsoft Clarity records how pages are used — clicks, scrolling and page views, with typed text masked — so we can fix what's confusing. It never records your messages, account, sign-in, profile, organizer or admin pages. It sets cookies (_clck, _clsk) and Microsoft processes the data in the US. Say no, or change your mind any time with “Cookie choices” at the bottom of every page (that also deletes the cookies).

How decisions about accounts are made

When a personal account is reported for running a business sale, we gather evidence (the listing, reports, sale history, photos and anonymous answers from shoppers who planned to visit) and an AI system prepares a recommendation. A person on our team makes every decision. If your account is put on hold you are told why, and you can pay the fee set out in our Terms or appeal with an explanation and photos for a human review.

Who we share it with

We do not sell personal information. We share it only with service providers that run the site for us, under contract, and only as needed:

• Supabase (database, sign-in and file storage — hosted in Canada, Montréal region)
• Vercel (web hosting), Resend (email), Twilio (text-message codes and, if you switch them on, message alerts), Stripe (payments), OpenFreeMap and OpenStreetMap (map tiles), Geoapify and Photon (address search and drive times), Cloudflare (bot check on sign-in), Microsoft Clarity (site analytics, only with your OK)
• Anthropic (automatic review of help-forum posts before they appear, and AI help reviewing reported sales: the post or listing content, photos and anonymous evidence — never your name, email or phone). Anthropic does not use this data to train its models.

Several of these providers store or process data in the United States, where it may be accessible to authorities under US law. We may also disclose information if the law requires it.

How long we keep it

• Account data: until you delete your account.
• Report and appeal photos and location checks: deleted 90 days after the case is closed.
• Free-listing and address-lock records: kept only as a one-way scrambled fingerprint of the address (not the address itself) — 30 days for free-listing limits, and until resolved (maximum 12 months) for locks.
• Last Call items and photos: taken down every Friday at midnight (photos deleted then). Messages about an item are kept 7 days after the last message, or 30 days if either person taps “Save”, then deleted. A reported conversation is copied for our team and deleted 90 days after the report is closed.
• Pickup ratings: 12 months. If you delete your account, ratings about you are kept (linked only to the phone fingerprint) for 180 days, then deleted.
• Unclaimed street/community-sale invitations: the email is deleted 30 days after the sale.
• Payment records: kept as long as tax law requires (currently up to 6 years in Canada), without your profile attached once your account is deleted.

Your rights

• Access and download: download a copy of your data from your account page, or email us.
• Correction: edit your profile at any time.
• Deletion: delete your account from your account page. Everything is removed except payment records, the scrambled address fingerprints, and ratings about you (kept up to 180 days, as described above).
• Withdraw consent for optional features (home address, phone location for photos) at any time.
• Complaints: email our privacy officer. If you are not satisfied you can contact the Office of the Privacy Commissioner of Canada or your state attorney general.

Security and breaches

Data is encrypted in transit, access is limited to our team, sensitive records are hidden from the public by database rules, and every admin action is logged. If a breach creates a real risk of significant harm, we will notify affected people and the Privacy Commissioner (and any U.S. state authority that must be told) as the law requires.

Age

Weekend Sales Finder is for people 18 and older. We do not knowingly collect information from minors.

For U.S. users

• Where your data is: our database is in Canada (Montréal). The service providers listed above, most of them U.S. companies, process data for us under contract.
• We don't sell or “share” personal information, as those words are used in U.S. state privacy laws, and we don't use it for targeted advertising.
• Do Not Track and Global Privacy Control: we don't track you across other websites and we don't run advertising cookies. We don't change our behavior in response to browser “Do Not Track” signals, because there's no tracking for them to switch off. Optional analytics (Microsoft Clarity) runs only if you say OK in the cookie bar, and you can withdraw that anytime with “Cookie choices.”
• Other companies' tracking: no third party collects information about your activity on our site for its own purposes over time and across other websites. Microsoft Clarity, if you say OK, collects usage data for us as our service provider.
• Your choices: you can see, download, correct and delete your information as described in “Your rights” above, wherever you live. Email us with any request; we'll answer within 30 days. If a state privacy law gives you additional rights, tell us which and we'll honor them.
• Text messages: we only text one-time codes you ask for and, if you switch them on, alerts that someone messaged you — never ads. Message and data rates may apply.

Changes

If we change this policy in a way that matters, we will post the new version here and tell account holders by email before it takes effect.