Privacy Policy

Effective September 25, 2026. FiveRowBox is operated by FiveRowBox LLC (“we”, “us”).

FiveRowBox is a desktop application and hosted service for cataloguing sports and trading cards and listing them on eBay. This policy describes what the service collects, why it holds it, who else sees it, and how to have it removed. It covers the desktop app, the API it talks to, and this website.

Two kinds of information pass through the service and they are treated differently throughout this document: your information, as the person using FiveRowBox, and information about eBay members who buy from you, which reaches us from eBay only because you connected your eBay account and only so that your orders can be fulfilled.

1. Information you give us directly

Account

Signing in is handled by Clerk, an identity provider. We store your email address, the identifier Clerk assigns you, your plan and account status, and the date the account was created. We never receive or store your password — Clerk holds authentication credentials, not us.

Device tokens

The desktop app and the command-line tool authenticate with a device token you create. We store only a SHA-256 hash of it, the first sixteen characters as a label so you can recognise it in a list, the name you gave it, and when it was created and last used. The token itself is shown once, at creation, and there is no field in the database it could be read back out of.

Your inventory

The card records you create: attributes, condition, prices, storage locations, notes, photographs, and the edit history that lets a change be rolled back. Card images are stored in object storage (see §4). This is your data; it is not shared with anyone except as described in §4, and it is not used to train anyone’s models.

2. Information we receive from eBay

If you connect an eBay account, we receive and store:

• eBay authorisation credentials for your seller account, so the service can list, revise and end listings and read your orders on your instruction. These are encrypted at rest.
• Your listings — item identifiers, titles, prices, quantities and the listing images, which are copied into our object storage so the app can display them.
• Your orders, including the buyer’s eBay username, the shipping name and postal address, the items purchased, order totals, shipping service and tracking number.
• A verbatim copy of eBay’s order payload. We keep eBay’s full response for each order so that sales reporting can be recomputed later. Beyond the fields listed above, that copy contains the buyer’s email address, first and last name, and telephone number. We state this explicitly because it is not visible from the shape of the rest of this section, and because it is the widest form of buyer information the service holds.

This information is used to fulfil and support your orders — producing pick lists, tracking shipments and refunds, and reporting on sales. We do not use it to market to buyers on our own behalf, we do not build profiles of buyers across sellers, we do not sell it, and we do not disclose it to anyone except as described in §4.

3. Information generated by using the service

• Operational logs. The service writes job and error logs to diagnose failures. An eBay buyer’s username can appear in these logs, and in error text returned by eBay. Logs are not part of the reporting data and are not shared.
• Usage counters for AI features — a per-day count of calls made, with the model used and the token counts, so that daily limits can be enforced and cost tracked. These records describe calls, not people.
• Cookies. This website sets only the cookies Clerk needs to keep you signed in. Nothing here sets an advertising or cross-site tracking cookie.
• Error reports and product usage events (PostHog). Our API sends two kinds of data to PostHog, a service hosted in the United States, so that we can keep the service reliable and improve the product. Error reports contain a scrubbed error message, an error code, where the error arose (the server, the app or this website), request and job identifiers, and your internal numeric account ID. Usage events record that something happened — a card was created, scanned or priced; a lot was created or published; an eBay listing was published or ended; a re-price completed or was applied; an eBay sync completed; an order was picked; a device was linked; or AI credits ran out — with counts, flags, prices and price changes, an eBay item or category ID when an auction is published, and the theme name of a lot. Events are keyed by your internal account ID (account:<id>), never by your email address or name, and neither is sent. We strip email addresses, access tokens and recognised buyer fields from error messages before they leave our servers, but that cannot catch everything: an error message can occasionally still contain text from your inventory, such as a card title, or a buyer’s username written in ordinary prose. Buyer names, addresses and message contents are never sent deliberately. Events already sent to PostHog are not removed when you delete your account.
• Web application analytics (PostHog). When you use the web application at /app, we measure pageviews, user interface clicks, and client-side error reports using PostHog to understand how features are used and diagnose client issues. Events are keyed by your internal numeric account ID (account:<id>) and carry your plan tier, but never your email address or name. Inputs displaying buyer names or addresses are excluded from autocapture, and session replay is strictly disabled.
• Website analytics. This website — only this website, not the desktop app and not the API — is measured with Plausible Analytics, so that we can see how many people visit and which link brought them. It records the page address, the site you arrived from, any campaign tags on that link (the utm_… parameters that record which channel sent you), an approximate country derived from your IP address, and your browser and device type. It also records one event of our own: that a waitlist signup was completed on this page, so that we can tell how many of the people who arrive go on to sign up. That event carries the fact and nothing else — the email address you type into the signup form goes to Beehiiv and is never sent to our analytics. It sets no cookies and stores no identifier for you: returning visits within a day are counted from a hash that is thrown away and regenerated daily, and your IP address is not retained. We receive counts, never a visitor. No account information, no inventory and no buyer information is sent to it. It is not loaded at all on the signed-in pages— everything under /account is left unmeasured — so the page addresses it receives are public marketing pages only.

4. Who else sees this information

We use a small number of service providers. Each receives only what the specific feature requires.

• Clerk — authentication. Receives your sign-in identity and email address.
• Cloudflare R2 — object storage. Holds your card images and the images copied from your own eBay listings. It holds no order information.
• PostHog — error reporting and product usage telemetry, and web application analytics, as described in §3. Hosted in the United States. Receives error reports, usage events, pageviews, and clicks keyed by your internal numeric account ID, with session replay disabled. It receives no email address, name or deliberate buyer data.
• Plausible Analytics — website measurement, as described in §3. Receives the page addresses visited on this website, the referrer and campaign tags that led here, and the fact that a waitlist signup was completed — never the address it was made with. It receives no account information, no inventory and no buyer information, and it is not present in the desktop app or the API.
• Google AI Studio and OpenRouter — the AI identification and pricing features. These receive card images, card attributes, and the summary price figures computed for repricing. No buyer information is ever sent to an AI provider — not a username, not a name, not an address, not an order. This is a property of how the features are built rather than a policy we apply by hand: the AI features load the card record, and no order or buyer field is a parameter of any AI request.
• A card-identification service we host ourselves — used for trading-card-game scans. It receives card images only, and runs on our own infrastructure rather than a third party’s.
• eBay — we send eBay the listing and order actions you ask for, under your own eBay authorisation.

That is the complete list. We do not sell personal information, we do not share it with advertisers or data brokers, and we do not transfer it for anyone else’s independent use. We may disclose information if we are legally required to, or to protect the service or its users from harm.

5. How it is protected

• Traffic between the app, this website and our API is encrypted in transit.
• Your eBay authorisation credentials are encrypted at rest with AES-256-GCM under a key held outside the database.
• Every account’s rows are isolated inside the database itself by row-level security, not by a filter the application has to remember to apply. Card images are stored under a per-account key prefix the request cannot influence.
• Device tokens are stored only as hashes. Image URLs carry short-lived credentials.

FiveRowBox staff can view account data read-only for support and debugging. Every access is logged internally, and buyer details are masked unless they are needed.

No system is perfectly secure, and we do not claim otherwise.

6. How long it is kept

We run a retention pass that applies the following periods to order data. Each one is measured from the last date we have for the record, and the pass runs weekly, so removal happens shortly after a period elapses rather than at the instant it does.

• Completed and shipped orders — 180 days. Measured from the latest delivery-side date the record carries: the delivery date, the dispatch date or the latest estimated delivery date, falling back to when the order was last synchronised from eBay. At that point the buyer’s eBay username is deleted from the record, and our stored copy of eBay’s order payload is rebuilt to contain only the order, item, money and delivery fields sales reporting reads — which removes the buyer’s email address, first and last name, telephone number and shipping address from it. The 180 days is the outer bound of the windows in which a claim about the shipment can still be raised: eBay’s money-back-guarantee window and, further out, the card networks’ 120-day chargeback window. Past it, no dispute that could be answered by knowing who bought the card can still be opened.
• Cross-sell recommendations — 90 days. Measured from when the message was sent, or from when the record was created if it never was. The buyer’s username is replaced with a placeholder, and the message text and any error text are deleted. The record that a recommendation happened — its status, its dates and the listings it named — is kept.
• The working copy of orders awaiting shipment — 30 days. This one is deleted outright, buyer information and all. It is not an archive: it is a transient copy of your open orders that is discarded and rebuilt from eBay every five minutes, and a row that has gone thirty days without being refreshed is one eBay has stopped returning. The lasting record of the same order is the shipped order above.

Two limits on that, stated rather than implied. A record that carries no usable date at all is never expired by this pass — a missing date is deliberately treated as recent, because guessing “old” would destroy a record irrecoverably. And each pass works through a bounded number of records per table, so clearing a long backlog takes several weekly runs.

Account information is kept for as long as the account exists. Inventory records are kept until you delete them or delete your account. Operational logs are kept for troubleshooting and are cleared periodically.

7. Deletion

eBay account deletion notifications

eBay notifies us when one of its members closes their account. On receiving such a notification we remove that person’s personal information from order records across every account on the service, not only the account that happened to receive the notification: the buyer username, shipping name and address, and the stored copy of eBay’s order payload, which is rebuilt to contain only the order and item fields needed for sales reporting and none of the buyer’s details. If the closing member is a seller who had connected their eBay account here, their stored eBay credentials are cleared at the same time.

That removal is durable. Order records are continually re-read from eBay — automatically for orders still open, and on request when you sync shipments — so we keep a record of which orders have been scrubbed and re-apply the removal to each of them as it is written. An order whose buyer has closed their eBay account is therefore stored with the buyer already removed from it, on every path that writes it, rather than being restored by the next synchronisation.

We retain the shipping tracking number for a scrubbed order. It is the seller’s evidence of despatch in a delivery dispute, and we are not aware of guidance requiring carrier references to be removed. If that changes, this will.

Your own data

You can delete cards, lots and listings from the app at any time. Disconnecting eBay from the app clears the stored eBay credentials immediately. To request a copy of the information we hold about you, to have it corrected, or to have your account and its data deleted, write to us at the address in §10. Depending on where you live you may have further rights over your information, and we will honour them.

8. eBay data specifically

Information obtained through eBay’s APIs is used only to provide the features you asked for, and only for you. We do not aggregate it across sellers, sell it, or transfer it for another party’s independent use.

Two of those features send eBay-derived information to the AI provider that performs them (Google AI Studio or OpenRouter, as listed in §4):

• Repricing sends the summary figures we compute from comparable public listings — the lowest, highest and median asking price, and how many listings were found. The individual listings are not sent, and the sellers behind them are not identified.
• Card identification and pricing send the card’s photographs. Where you imported a card from one of your own eBay listings, that photograph is the one copied from the listing.

No buyer information is sent to an AI provider in either case — not a username, not a name, not an address, not an order. That is a property of how the features are built, as described in §4.

9. Children

FiveRowBox is a tool for selling on eBay and is not intended for anyone under 18. We do not knowingly collect information from children.

10. Changes and contact

If this policy changes materially we will say so on this page and update the effective date above. Questions, requests and complaints go to fiverowbox@gmail.com, or to FiveRowBox LLC, 7345 164th Ave NE Ste I145 Space 475, Redmond, WA 98052.