Privacy notice
Updated October 5, 2026. This notice describes the current GusList service.
Information stored
GusList sign-in supplies an account identifier, email, and an optional display name. We associate your listings, saved items, searches, reports, and conversations with your account identifier. Listings store the title, description, category, price, contact method, photos, city and state, optional rounded map pin, and posting dates. Messages store the conversation, sender, text, and time.
What other people can see
Active listings and their photos are visible to visitors who can access the site. The contact information you put in a listing can be revealed by visitors. An optional rounded map pin is visible with the listing. Saved items and searches belong to your account. In-app conversations are available to their participants through the app; they are stored by the service and should not contain sensitive financial or identity information.
Location and outside services
Use my location requests location only when you press it and permit browser access. Uploaded photos are resized, compressed, and re-encoded to strip embedded location metadata. We keep aggregate upload, reserved storage-byte, and monthly photo-transfer counters to control service usage. The app rounds coordinates before saving; it does not store the original GPS reading. Map tiles come from OpenStreetMap, which receives ordinary requests such as your IP address and requested map area. When automatic moderation is enabled, listing titles, descriptions, and photos are sent to OpenAI for content screening. Contact details and in-app messages are not included in those screening requests. We store review reasons and a content fingerprint for moderation. Supabase handles customer sign-in, the database, and photo storage. Vercel hosts the website. Account confirmation and password-reset emails are delivered through Resend. When message email alerts are enabled, Resend receives the recipient’s verified email address and a generic notification; private message text and sender contact details are not included. You can turn message alerts off in My account → Email alerts. We retain alert preferences and delivery-limit counters to operate this feature. Google or phone sign-in may be offered when those providers are configured. If payment checkout is enabled, Stripe handles payment details; GusList stores payment references, amounts, and confirmation status rather than card numbers.
Cookies, operational records, and access
Authentication uses cookies to keep you signed in. We record the terms version and server time when a verified account explicitly accepts the terms. Hosting and authentication providers may process IP addresses, browser details, and technical logs for security and service operation. Authorized operators and service providers may access stored information where needed for support, moderation, maintenance, security, or legal obligations. In-app messages are not end-to-end encrypted. We may disclose information when legally required or where necessary to investigate abuse or protect users, subject to applicable law.
Use and retention
We use stored information to operate listings, messages, saved searches, moderation, and posting payments. This app does not currently send marketing messages. Vercel Web Analytics collects aggregate traffic information on public pages, including page views, referring websites, approximate country, and browser and device type. It uses no tracking cookies. Admin, sign-in, and account pages are excluded, and URL queries and fragments are removed before collection. We do not send account emails or private messages to analytics. Expiration or removing a listing hides it from normal browsing; it does not automatically erase the stored listing, photos, reports, or messages. After 5 days following removal, or a further 30 days following expiration or sale, automatic cleanup during site activity removes eligible listing photos and erases the title, description, contact details, and location. A minimal listing reference remains for account and conversation continuity; this is not full account deletion. Reported listings are excluded pending review. Cleanup can be delayed by inactivity, processing limits, or retries. Existing listings without a recorded change date use the date recorded when cleanup tracking was activated. Some records may need to be retained for legal obligations, disputes, or abuse prevention; provider logs and backups may follow separate retention schedules.
Your choices
You can edit a listing, remove it from browsing, remove photos from a listing, delete saved searches, and unsave items. Unattached uploaded photo files have a 7-day grace period before automatic cleanup during site activity. Photos referenced by stored listings follow the listing retention rules above. Cleanup may be delayed by processing limits or retries. To request account-data deletion or ask a privacy question, email gustarraf@gmail.com from the email used to sign in. We may ask you to verify account ownership. Do not send your password. Sign-in and hosting providers manage their own records under their own policies.