Legal
Privacy policy
Who we are
CrossOff ("we", "us") is an inventory and auto-delisting service for resellers, operated from British Columbia, Canada. Questions about this policy go to the contact address at the bottom of this page.
What we collect
| What | Why |
|---|---|
| Account: your email address and a password (stored only as a secure hash by our login provider) | To sign you in and send account emails like password resets |
| Inventory: item titles, descriptions, prices, costs, photos, storage spots, quantities, brands, sizes, conditions, notes, which platforms each item is on, listing links and dates | This is the service: showing your stock and knowing what to remove when something sells |
| Sales: sale price, fees, platform, date, and any note you add | Profit reports and CSV export |
| Lots: lot names, what you paid, notes, and for consignment the client's name, their share and what you've paid them | Profit per lot, and what you owe a consignment client |
| Templates and AI usage: your listing templates, and how many AI listings you've used this month | To fill in new items, and to keep to your plan's monthly AI allowance |
| Inbox: for each conversation from a marketplace, the sender's name as the marketplace shows it, the kind (offer, question, comment, message), a preview of the latest message, which item it's about, a link to the chat, and the reply you sent from CrossOff. Kept for 30 days. | So you see every marketplace's messages in one place and can answer them |
| Notifications, if you turn them on: an address your browser gives us for sending notifications to that device | To tell you about new messages and sales |
| Activity log: posting, removal and import jobs and their results (kept for a limited time) | So you can see what happened and retry anything that failed |
| Billing: your plan and a Stripe customer reference | To give you the plan you paid for. Card details go straight to Stripe; we never see or store them. |
| eBay connection, if you connect eBay: access tokens issued by eBay | To read your active eBay listings and end them when an item sells elsewhere, post listings you ask it to, and show buyers' questions and send your answers. We never see your eBay password. |
| Etsy connection, if you connect Etsy: access tokens issued by Etsy, and your shop's ID and name | To read your active Etsy listings and deactivate them when an item sells elsewhere. We never see your Etsy password. |
| Connection code: stored only as a one-way hash | So the Chrome extension can act for your account (each computer gets its own code) |
We don't use analytics trackers or advertising cookies. The app keeps you signed in using your browser's local storage.
The Chrome extension
The CrossOff extension only works on Facebook Marketplace, Poshmark, Mercari, Depop, Grailed and VarageSale pages, in your own logged-in Chrome, and on CrossOff's own site (to connect to your account). It reads your own listings on those marketplaces (title, price, link, listed date and whether it's sold) to import them into CrossOff, and when you've made a sale it opens the matching listing and removes it. When you press Start posting, it opens each site's sell page and fills in your item's title, description, price, brand and photos; you finish and post it yourself. On Facebook Marketplace you can turn on Publish for me: then it also picks the category and condition and presses Next and Publish for you, but only when everything is filled in. Either way it sends the new listing's link back to your CrossOff account.
Inbox. For the marketplaces you choose in Inbox settings (Facebook Marketplace, Depop, Grailed), it opens your messages page in a background tab every few minutes, and reads it while you have it open, and sends each conversation's latest preview, the sender's name and the chat's link to your CrossOff account. It never sends a message. When you reply from CrossOff on your computer, it opens that chat and types your reply into the box; you press Send yourself.
It does not read other people's listings, your browsing history or any other website. It never sees or stores your marketplace passwords. Your connection code is saved only inside Chrome on your computer.
AI listings and price checks
When you tap Write the listing from the photos, that item's photos (as links to them) and the title you typed are sent to Anthropic, which makes the Claude AI, to write the listing. Under Anthropic's commercial terms, it doesn't use this to train its models. Nothing is sent until you tap the button.
When you tap Suggest a reply in the Inbox, that message and the item's title, price, condition and description are sent to Anthropic to draft an answer, which you can edit before sending. Nothing is sent until you tap it.
When you tap Check eBay prices, the item's title is sent to eBay to search for similar listings. That search isn't linked to your eBay account.
Sale alerts by email
CrossOff is never given access to your inbox. If you choose, you forward the marketplaces' sale emails to your own private CrossOff address, with a Gmail filter or a rule in your email app that only matches the marketplaces CrossOff works with (eBay, Poshmark, Mercari, Etsy, Depop, Grailed, Vestiaire Collective, Whatnot and Shopify). Our email provider, Resend, receives those emails for us. We check each one for a sale, mark the matching item sold, and then discard the email: we don't keep the email itself, only when the last one arrived, which marketplace it was from, and the title of the last item it sold. If the email is about an offer, a comment or a message instead, we keep the short Inbox entry described above (who, what kind, a preview and a link) and discard the rest. Promotional emails are ignored. When you set up Gmail forwarding, Gmail's confirmation code is kept so Setup can show it to you. Deleting the filter or rule stops it completely. (Accounts set up before this used a small Gmail script that sends the same emails to CrossOff; it's handled the same way.)
If you connect eBay or Etsy, CrossOff also checks your recent sales there every 15 minutes, through their official APIs, to catch sales without email.
Notifications
If you turn on notifications on a phone or computer, CrossOff sends alerts about new messages, offers and sales through that browser's push service (Google for Chrome and Android, Apple for iPhone and Safari, Mozilla for Firefox). The contents are encrypted so the push service can't read them. You can choose what you're notified about in Inbox settings, or turn notifications off in your browser or phone settings at any time.
Who handles your data
We use these providers to run CrossOff, and only for that:
- Supabase: database, sign-in and photo storage
- Netlify: hosts the website and runs the server code
- Stripe: payments and subscriptions
- eBay: only if you connect your eBay account
- Etsy: only if you connect your Etsy shop
- Anthropic: writes AI listings from your photos and suggested replies to messages, only when you ask it to
- Resend: receives the sale emails you forward to CrossOff (kept by Resend for a limited time under its own policy)
- Your browser's push service (Google, Apple or Mozilla): delivers the notifications you turn on, encrypted
- Our email provider: sends account emails such as sign-up confirmations and password resets
- Google Fonts: the public pages load fonts from Google, which receives your IP address
Some of these providers store or process data outside Canada, including in the United States, where it may be accessible to authorities under local law. Each is bound by its own privacy and security commitments.
We don't sell, rent or trade your information, and we don't share it for advertising. We'd only disclose it if the law requires us to.
How long we keep it
Your data stays while you have an account. Removal and import logs are cleared automatically over time. Inbox messages are deleted automatically after 30 days. If you cancel a paid plan, your account drops to Free and your items stay. If you ask us to delete your account, we delete your items, photos, sales, messages, logs and marketplace tokens within 30 days. Payment records Stripe must keep for tax and accounting stay with Stripe.
Security
Everything travels over encrypted connections (HTTPS). Each account can only reach its own data. Connection codes are stored as one-way hashes. No system is perfectly secure, but if a breach ever affects your information we'll tell you and the relevant authorities as Canadian law requires.
Your rights
You can see and change almost everything in the app, and export your sales to CSV. You can also ask us for a copy of your information, to correct it, or to delete your account, by emailing us from the address on your account. We'll reply within 30 days. If you're not satisfied, you can contact the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.
Children
CrossOff is for people running a business or selling their own things, and isn't meant for anyone under 16.
Changes
If we change this policy in a way that matters, we'll update the date above and tell account holders by email or in the app before it takes effect.
Contact
Email us about anything on this page.