Privacy Policy

Last updated: July 2026

1. Who We Are

This Privacy Policy describes how Lug2Lug LLC (“we”, “us”) collects, uses, and protects your information when you use lug2lug (the “Service”), including our website at lug2lug.org and our iOS and Android apps. We aim to keep the data we collect proportionate to running and improving the Service.

2. Information We Collect

Account data.
You can create an account with Google, Apple (“Sign in with Apple”), or an email address and password. From social sign-in we receive your email address, display name, and (where provided) profile picture. If you use Apple’s private-relay option, we receive the relay email address rather than your personal one. Passwords are handled and stored in hashed form by our authentication provider; we never see or store your plaintext password.
User contributions.
Comments, forum threads, replies, edit suggestions, watch collections, favorites, custom lists, wrist shots and other images you upload, and any other text or images you submit to the Service.
Direct messages.
If you send direct messages to other users, we store the message content and participant identifiers so the conversation can be delivered and displayed to you and the recipient.
Social graph.
Who you follow, who follows you, and taste-based matching signals used by community features (such as “taste tribes”). Some of this may be visible to other users — see “What’s Public vs. Private” below.
Behavioral & analytics data.
The watches you view, compare, favorite, and interact with, and product-usage events (page and screen views, taps and clicks, scroll depth, sessions, referral source, and coarse device information). We use this to power our personalized discovery algorithm and taste profile and to understand and improve the Service. See Section 6 for the analytics tools involved.
Mobile device data.
If you use our apps, we may collect a device or installation identifier, app version, and — if you enable notifications — a push notification token (Apple Push Notification service or Firebase Cloud Messaging) so we can deliver alerts you’ve asked for.
Email you provide for updates.
If you subscribe to a newsletter or a waitlist, we collect the email address you provide for that purpose.
Payment information (donations).
If you choose to support us with a donation, payment is processed by our payment provider (Stripe). We receive confirmation of the transaction but do not collect or store your full card number or payment credentials.
AI assistant inputs.
If you use the in-product chat assistant, the messages you type are sent to our AI provider to generate a response. Please don’t include sensitive personal information in chat messages.
Preferences.
Settings stored on your device (price source, recommendation weights, dismissed watches, recently viewed) to personalize your experience.
Basic request & diagnostic data.
Standard server logs including IP address, browser or device type, and pages visited, plus crash and error reports, retained for security, debugging, and operational purposes.

3. How We Use Information

  • Operate, maintain, and refine the personalized recommendation engine
  • Measure and improve how the Service performs and is used (product analytics)
  • Display your public content (profile, public collections, forum posts) to other users
  • Deliver direct messages, follows, and other social features you use
  • Send notifications, price-drop alerts, and transactional email you’ve requested
  • Maintain and moderate the community discussion forums
  • Detect and prevent abuse, fraud, or security issues
  • Communicate with you regarding account updates, platform changes, or the launch of proprietary Lug2Lug LLC products, merchandise, and services
  • Respond to questions or requests you send us

4. What's Public vs. Private

Public by default:
Your display name, profile picture, forum threads and replies, comments on watch pages, edit suggestions, wrist shots you post publicly, your follower/following relationships, and collections explicitly marked as public.
Private by default:
Your email address, direct messages, favorites, recently viewed watches, private collections, device-stored preferences, and the raw behavioral/analytics data tied to your account.
Community matching features (such as taste tribes) may show other users that you share tastes with them; they do not expose your private browsing history, messages, or email.

5. Service Providers We Use

We rely on the following third-party providers to operate the Service. Each receives only the data needed for its function, and each is bound by its own privacy terms.

Supabase:
Our database, authentication, and file-storage provider. Account data, contributions, and uploads are stored on Supabase’s infrastructure.
Google & Apple:
Sign-in providers. Subject to Google’s and Apple’s privacy policies.
PostHog:
Our product-analytics provider (see Section 6). Receives usage events and, for signed-in users, an account identifier and email.
Vercel & Cloudflare:
Website hosting, content delivery, and security. They process standard request data such as IP address as part of serving and protecting the site.
Sentry:
Error and crash monitoring, used to diagnose bugs. May receive diagnostic context including IP address. We do not use session replay.
Resend & Beehiiv:
Transactional email (Resend) and newsletter email (Beehiiv). Receive the email address you provide for those messages.
Stripe:
Payment processing for optional donations. Subject to Stripe’s Privacy Policy.
Anthropic:
Powers the in-product AI chat assistant. Messages you type into the assistant are sent to Anthropic to generate a reply.
Pricing data sources:
We aggregate publicly available listings from sources such as eBay and Chrono24 (in part via third-party data-collection tooling). This is about watch listings, not you — we do not share your personal information with these services.

6. Cookies, Local Storage, Analytics & Affiliate Tracking

We use cookies and on-device storage to keep you signed in (session tokens), to remember your preferences, and for the product analytics described below. These are first-party and essential-or-functional to running the Service.

Product analytics. We use PostHog to understand how the Service is used and to improve it. PostHog records product-usage events (page and screen views, clicks and taps, scroll depth, sessions) along with your IP address and an analytics identifier stored on your device. When you are signed in, these events are associated with your account identifier and email so we can measure logged-in behavior and power personalization. We do not use third-party advertising cookies, cross-site advertising trackers, device fingerprinting, or session-replay recording, and we do not use these analytics for advertising. You can limit analytics by using your browser or device privacy controls, or by contacting us at contact@lug2lug.org.

eBay Partner Network. Lug2Lug is a participant in the eBay Partner Network affiliate program. When you click an eBay link on our site, we may earn a commission on any resulting purchase at no additional cost to you. This does not influence which listings we display or the prices we show — we aggregate publicly available data from eBay regardless of whether you click an affiliate link. You can recognize affiliate links by the campid query parameter when you navigate to eBay. These affiliate tags do not uniquely identify you. See our Disclosures for the full affiliate notice.

7. Data Sharing — The “No Selling” Promise

Lug2Lug LLC does not sell your personal data to third-party data brokers or marketing agencies, and we do not share it with advertisers for advertising purposes.

Data is shared only with the service providers listed in Section 5, strictly to operate, secure, and improve the platform. We may also disclose information when legally required (subpoena, court order), or to protect the rights, property, or safety of Lug2Lug LLC, our users, or the public.

8. Your Rights & Choices

You have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data (via your profile settings)
  • Delete your account and associated data
  • Export your data in a portable format
  • Opt out of non-essential data processing, including product analytics

In our iOS and Android apps, you can delete your account and its data directly from Settings. On the web, or to exercise any other right, contact us at contact@lug2lug.org and we will action your request.

9. Data Retention

We retain your account data as long as your account is active. When you delete your account — immediately via the apps, or on request for web accounts — we remove your personal data within 30 days, though anonymized aggregate data (e.g., total thread counts) may be retained for operational purposes.

10. Security

We use industry-standard security measures including HTTPS, encrypted database storage, and access controls. No system is perfectly secure; we cannot guarantee absolute protection against unauthorized access.

11. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have such information, we will delete it.

12. International Users (GDPR / CCPA)

The Service is operated from the United States. By using the Service, users outside the U.S. consent to their information being transferred to and processed in the United States and other countries where our service providers operate.

EU/UK residents (GDPR): You have rights to access, rectification, erasure, restriction, portability, and objection regarding your personal data. Our legal bases for processing are your consent (account creation, content posting), performance of our agreement with you (operating the Service), and our legitimate interests (improving and securing the Service, and product analytics). You may object to processing based on legitimate interests, including analytics, at any time.

California residents (CCPA/CPRA): You have the right to know what personal information we collect, request deletion or correction, and opt out of any sale or sharing of personal information. As stated above, we do not sell your personal information or share it for cross-context behavioral advertising. To exercise any of these rights, contact us at contact@lug2lug.org.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date. Continued use after changes constitutes acceptance.

14. Contact

For privacy questions or requests, contact us at:

Lug2Lug LLC
502 W 7th St, Ste 100
Erie, PA 16502
United States
contact@lug2lug.org