Privacy Policy

This Privacy Policy explains how Worthy (“Worthy”, “we”, “us”, “our”) collects, uses, shares and protects personal information when you use the Worthy mobile app, the website at worthy.nirovalabs.com (also reached through nirovalabs.com) and the services connected to them (together, the “Service”). It also explains the choices and rights you have. Words such as “find” and “credits” mean the same as in our Terms of Service.

The short version

• We collect what we need to run Worthy: your name and email address from Apple or Google, the photos and details of the items you scan, what you save and list, your purchases, and how you use the app.
• Your scan photos go to an AI service to identify the item, and we keep them with your account.
• If you connect eBay, we exchange information with eBay to prepare, publish and follow your listings. Nothing is published until you ask.
• We don’t sell your personal information for money or show ads in Worthy. Optional advertising measurement may link activity across companies only with your permission, as section 7 explains.
• You can remove finds, disconnect eBay and delete your account in the app. Section 8 explains what we keep, and for how long.
• For questions and requests, email support.worthy@nirovalabs.com.

1. Who we are and what this policy covers

Worthy provides the Service and is responsible for the personal information described in this policy. You can reach us at support.worthy@nirovalabs.com.

This policy covers the Worthy app, our website and our emails with you, including processing by service providers on our behalf. When you use another company’s services directly, such as signing in with Apple or Google or using eBay, that company’s own privacy policy also applies to its handling of your information.

2. Information we collect

Information you give us

• Sign-in details. Worthy creates an account for you when you answer the first onboarding question. When you sign in with Apple, we receive the name and email address you choose to share, which may be an Apple private relay address, and an Apple user identifier. When you sign in with Google, we receive your name, email address, profile picture link and a Google user identifier. We never receive your Apple or Google password.
• Onboarding answers. How often you pass on items that later sell for more, what you usually look for, your gender (you can choose “Prefer not to say”) and your age range.
• Photos. The photos you take or choose when you scan an item, and the photos you add to a listing. Before a scan photo leaves your phone, the app resizes it and removes its location and other embedded details.
• Your finds. What you save, what you paid, what you sold for elsewhere, your profit settings (such as fee rates and shipping and packing costs) and the words you search for in My Finds.
• Listings. If you list on eBay: the title, description, condition, category, item details, grading details, price and offer settings, package size and weight, and photos.
• eBay setup. The ZIP code your items ship from, the city and state it belongs to, and your choices for shipping, returns and payment.
• Messages. Bug reports and feedback you write in the app, problem reports about eBay, and emails you send us. When you email support from the app, the app adds a support code, the app and iOS versions, your device model and your language to the draft, and you can see them before you send it.

Information collected automatically

• Identifiers. Your Worthy account ID, an installation ID for the app, a push notification token, and the identifier Apple gives apps from the same developer (the IDFV), which our app analytics collects.
• Device and app details. Device model, iOS version, app version and build, language and region, time zone, whether you allowed notifications, and whether Save scan images is on.
• How you use the app. The screens you view and what you do on them, such as the onboarding steps and options you choose, sign-ins, scans, purchases you start and paywalls you see, and when and for how long you use the app.
• Scans and results. Every scan, its photos, the item identified, any text read from the item or its label, the prices and market information found, and our estimates, whether or not you save the find.
• Security information. App and device integrity signals and a record of whether a device has already received free credits, used to prevent fraud and abuse.
• Logs. Our servers and hosting services record technical details about requests: your account ID, IP address and device details, the time, the operation requested, its status and any error. The app also keeps a technical log on your phone, which stays there unless you choose to send it to us.
• Approximate location. Our servers and service providers receive your IP address when the app connects to them, and our app analytics uses it to estimate your city, region and country. We don’t collect your precise location.
• Optional advertising measurement. Where this feature is available and you allow it, we may collect your advertising identifier (IDFA), app and device details, IP address, and events such as installs, app opens and purchases (including their time, value and currency). Section 7 explains the permissions and choices that apply.

Information from other companies

• Apple and Google, when you sign in (see above).
• Apple and our subscription provider, when you buy something: the product, the date, the price, the currency and country of the purchase, renewals, cancellations and refunds, transaction identifiers, and whether the purchase was made in Apple’s test environment.
• eBay, if you connect your eBay account (see section 5).
• Market data providers: information about items and the prices they sell and are listed for. It isn’t information about you.

What we don’t collect

We don’t collect your precise location, your contacts, sound from your microphone, your payment card details or your passwords. We access your advertising identifier only with your permission, as section 7 describes.

3. How we use information

• To run the Service: to create and keep your account, identify items, show estimates, calculate fees and profit, keep your finds and history across devices, and manage your credits and subscription.
• For eBay features: to connect your eBay account, set it up, prepare and check listings, publish, change and end them when you ask, and show their status and your sales.
• For purchases: to confirm purchases with Apple, add credits and Pro, restore purchases, stop a purchase being counted twice, and deal with refunds.
• To talk to you: to show messages in the app’s inbox, send the push notifications you allowed, and answer your questions.
• To tailor the app: we may use your onboarding answers to decide what to show you first, such as which categories.
• To keep Worthy safe: to check devices, give free credits only once, detect and stop fraud and abuse, block accounts that break our Terms, and protect our users, our providers and ourselves.
• To understand and improve Worthy: to learn how people use the app and who uses it, fix problems, measure performance, and check and improve the accuracy of our identifications and estimates, which can include reviewing scans and their results.
• To measure our advertising, where available and with your permission: to understand whether our ads lead to installs and purchases.
• For legal reasons: to comply with the law, respond to lawful requests, and establish, exercise or defend legal claims.

We don’t sell personal information for money or show ads in Worthy. Our optional use of information for advertising measurement is described in section 7.

4. AI and automated processing

Worthy uses an AI service to identify items and suggest item details. For each scan we send our AI processing provider the photos and the instructions needed to read them. When you prepare a listing, we may also send the item’s name, the details found in the scan and eBay’s list of allowed values. We don’t include your name, email address or account ID in these requests. Avoid including faces, personal documents or other people’s personal information in your photos.

The provider processes this content on our behalf under its data processing terms. It doesn’t use the content to improve its general-purpose products or train its general-purpose AI models. It may retain inputs and results for up to 55 days for abuse detection, security and legal requirements, including to improve abuse-detection systems. Processing may take place in the countries described in section 13.

AI can be wrong, and our Terms of Service explain how to treat Worthy’s results. Worthy doesn’t make decisions about you that have legal or similarly significant effects based solely on automated processing.

We don’t use your photos or other personal information to train AI models, including large language models. If that changes, we’ll update this policy first and ask for your consent where the law requires it.

5. When you connect eBay

Connecting eBay is optional.

• Signing in. You sign in on eBay’s own page, in a secure sign-in window that doesn’t keep cookies. eBay then gives us access tokens that let Worthy act for you within the permissions you approved. We keep the tokens encrypted on our servers. They never go to your phone, and we never see your eBay password.
• What we receive from eBay. Your eBay user ID, which we keep only in a scrambled one-way form so that one eBay account connects to only one Worthy account; your eBay username; the country your eBay account is registered in; whether your account can sell; your business policies and item locations; and information about your listings and orders, such as prices, fees, postage, dates, statuses, cancellations and refunds. eBay’s order data includes your buyers’ details; Worthy ignores them and doesn’t store your buyers’ names, usernames or addresses.
• What we send to eBay. The location your items ship from (ZIP code, city and state), the shipping, return and payment policies you set up, and your listings: their text, item details, price, offer settings, package details and photos. To prepare a listing, we may upload its photos to eBay’s picture service and save the listing on your eBay account as an unpublished draft that buyers can’t see. When you publish, the listing and its photos become public on eBay.
• Keeping up to date. While you’re connected, Worthy checks eBay regularly for changes to your listings and for new sales, and it may notify you about them.
• Pictures and pages from eBay. Pictures of other listings that Worthy shows you load straight from eBay’s servers, so eBay receives your device’s IP address. When you open an eBay page from Worthy, such as a search for your item, eBay receives that page’s address, including the search words, and handles your visit under its own privacy notice.
• Our limits. We use information from eBay to provide the eBay features you ask for, to answer your support requests, to keep Worthy secure, and to understand in our own reports how Worthy is used. We don’t use it to train AI models, and we don’t use it to send you marketing.
• eBay’s own policy. eBay’s User Privacy Notice governs how eBay uses information.
• Disconnecting. When you disconnect, we revoke our access at eBay and delete the tokens and your connection details, including your eBay username. Worthy keeps the history of your listings and sales in your finds, and a record of the eBay settings you used, as section 8 describes. Removing Worthy under your eBay account’s third-party app access also ends our access, but your connection details stay in Worthy until you disconnect.
• Closing your eBay account. If eBay tells us that an eBay account connected to Worthy was closed, we delete the connection, the tokens, the history of your eBay settings and the links between your finds and eBay listings.

6. How we share information

We share personal information only as described here.

Service providers. We use providers to operate and support Worthy. They receive the information needed for their work, subject to contractual data protection obligations. The categories are:

• Cloud and technical services: processing and storing account information, photos and app records; sign-in; security; notifications; logs; and analytics. Push notifications can include an item’s name and price.
• AI processing: identifying items and suggesting item details using the content described in section 4.
• Purchase and subscription services: processing your Worthy account ID, basic device details and purchase records to manage credits and subscriptions.
• Market information services: finding prices from a short item description, such as its brand and model. We don’t send them your name, email address, photos, account ID or device IP address.
• Website and communications services: delivering and protecting our website using standard connection details, and routing and hosting your support emails.

Apple and Google also handle sign-in, and Apple handles App Store purchases and refunds, under their own privacy policies. Location lookup services receive the ZIP code you enter to find its city and state, and security services process app and device integrity information to help prevent abuse.

Advertising measurement partners. Where this feature is available and you allow it, we may share the identifiers, device details and app events described in section 7 with Meta to measure our advertising. This is separate from the service-provider processing above. Meta handles information under its Privacy Policy.

eBay, at your direction. When you connect eBay and use listing features, we send eBay what section 5 describes. You decide this, and it isn’t a sale of your information.

Apple, if you ask for a refund. If you ask Apple to refund a purchase made in Worthy, we may tell Apple how you used it, such as how many of its credits you used, to help Apple decide.

For legal and safety reasons. When we believe in good faith that the law, a court order or a lawful request from authorities requires it, or that it’s needed to protect the rights, property or safety of our users, the public or ourselves, or to enforce our Terms.

If the Service changes hands. If Worthy, or a part of it, is sold, merged, transferred or reorganized, information may pass to the new owner, who must keep protecting it as this policy describes.

With your consent, or when you ask us to share something.

Information that doesn’t identify you. We may share statistics and other information that can’t reasonably be linked to you.

We don’t sell personal information for money. Some privacy laws define “sale” or “sharing” more broadly, including certain exchanges with advertising partners even without payment. The choices in sections 7, 11 and 12 apply to our optional advertising measurement.

7. Analytics

App analytics

We use Google Analytics to understand how people use Worthy.

• It records app usage events, such as screen views, onboarding steps, scans, paywall views and purchase activity, and events it collects on its own, such as first opens, sessions and app updates. It also collects device details, the IDFV and an approximate location (city, region and country) based on your IP address. This describes activity in the app, not a transfer of all the information listed in section 2.
• We link this data to your Worthy account ID, including before you sign in, and attach your onboarding answers to it.
• We retain identifiable app analytics data for up to 14 months, including copies used for our internal reports. Aggregated reports that no longer identify you may be kept longer.
• Google processes this data for us as our service provider. You can read how Google uses information from apps that use its services at policies.google.com/technologies/partner-sites.
• This app analytics processing is separate from the optional advertising measurement below.
• You can ask us to delete the analytics data linked to your account by emailing us.

Optional advertising measurement

We may introduce optional advertising measurement through Meta. Where available, and only after you allow tracking through Apple’s App Tracking Transparency prompt and give any additional consent required by law, we may send Meta your advertising identifier (IDFA), app and device details, IP address, and events such as installs, app opens and purchases, including their time, value and currency. Meta may match this information with information from its services to measure the effectiveness of our ads. Apple treats this cross-company matching as tracking, even when the purpose is only measurement.

We don’t send Meta your scan photos, item or listing contents, eBay account or order information, onboarding answers, support messages, name or email address for this purpose. We don’t use this feature to build retargeting or lookalike audiences.

You can decline without losing access to Worthy’s features, and you can withdraw tracking permission in iOS Settings, Privacy & Security, Tracking. If you decline, tracking is unavailable or you withdraw permission, we don’t access your IDFA or send data for this cross-company measurement. We don’t use another identifier or device fingerprinting to get around your choice. We may still receive aggregated, privacy-preserving advertising reports that don’t identify you or your device. Accepting our Terms or this policy does not give tracking permission.

Our website

Our website has no accounts and sets no analytics or advertising cookies. Our website provider processes standard request details, such as your IP address and browser, to deliver and protect it. App tracking permission doesn’t enable tracking on our website.

8. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy. Then we delete it, or keep it in a form that no longer identifies you.

• Your account, onboarding answers, finds, scans, photos, listings and settings: while your account exists.
• Finds you delete: a deleted find disappears from Worthy at once. We keep it, with its scans and photos, while your account exists, so we can help if you contact us and look into problems. You can ask us to delete it sooner.
• Listing drafts you discard: deleted at once, with the photos you added to them, except photos that an earlier eBay listing of the same find still uses.
• eBay tokens: deleted when you disconnect eBay or delete your account. If you ask us to end your listings when you delete your account, we keep the tokens for up to 24 hours to finish.
• Your eBay history in Worthy: the history of your listings and sales, and a record of the eBay settings you used, while your account exists, even after you disconnect.
• Messages in the app’s inbox: while your account exists.
• Support requests, bug reports and feedback: while your account exists. Emails you send us: up to 2 years after our last exchange.
• Records of item identifications and price lookups, which contain the item’s details but not your photos or account ID: up to 190 days.
• Server logs: up to 400 days.
• Analytics data: up to 14 months.
• Optional advertising measurement data: any identifiable copies we keep for measurement are retained for no longer than 14 months. Information already received by Meta is retained under its Privacy Policy; withdrawing permission stops future sharing but doesn’t automatically erase past data. You can ask us for help with deletion requests.
• Records of purchase notifications from our subscription provider: up to 400 days.
• Copies of our database for internal reports: replaced every day; the files they’re made from are deleted after 7 days.

When you delete your account, we delete your personal information, or remove what identifies you from it, within 30 days. We keep only:

• purchase and credit records, without your name or email address, for as long as we need them for accounting, tax, refunds and fraud prevention;
• a scrambled one-way record of your Apple or Google sign-in, and a device-level record that free credits were already granted, so that free credits aren’t claimed again. Neither contains your name or email address;
• information we need for legal reasons, such as to resolve a dispute or comply with a legal obligation, for as long as that requires;
• logs and analytics data, until they expire as described above.

Our providers remove deleted information from their backups on their own schedules, which for some cloud services takes up to 180 days. Your listings and photos on eBay are kept or deleted under eBay’s policies.

9. Deleting information and your account

• A find: open it and tap the trash icon. If it’s listed on eBay, you choose whether to end the listing. We keep a removed find as section 8 explains; email us to erase it.
• A listing draft: Discard draft.
• Your eBay connection: Disconnect in Worthy’s eBay settings.
• Your account: in the app, go to Profile, then Delete account. If you have live listings on eBay, you choose whether to end them or leave them. Deleting your account also removes Worthy’s access to your Apple or Google sign-in and disconnects eBay.

Deleting your account doesn’t cancel a subscription. Cancel it in your Apple Account settings.

If you never finished signing in, can’t open the app, or your account is blocked, you can ask us by email to delete your account. You can also ask us to delete particular information.

10. Security

We use safeguards suited to the information we handle, including encryption in transit and at rest, restricted access, and checks to prevent unauthorized access and abuse. Access to personal information is limited to those who need it to operate and support the Service.

No system is completely secure, and we can’t guarantee the security of information. If a breach affects your personal information, we’ll tell you where the law requires it.

11. Your choices

• Camera and Photos. Worthy asks for camera access to scan items. You can pick a photo from your library without giving Worthy access to it. With Save scan images on, Worthy asks to add photos to your library, and can’t read it. You can change these permissions in your phone’s Settings.
• Notifications. Worthy sends push notifications only if you allow them. You can turn them off at any time in your phone’s Settings. Messages still appear in the app’s inbox.
• Advertising measurement. Where offered, you can decline or withdraw tracking permission in iOS Settings, Privacy & Security, Tracking. You can also email us to withdraw consent or opt out of any sale, sharing or targeted advertising covered by applicable law. We apply the more restrictive choice; an email or other permission never overrides a denied iOS tracking request.
• Save scan images. Turn it off in Profile to stop Worthy saving scan photos to your library. It doesn’t change what Worthy keeps on its servers.
• eBay. You can disconnect eBay at any time.
• Account. You can sign out or delete your account at any time. If your account is blocked, email us to delete it.
• Free credits on a second-hand device. If you got your device from someone else and Worthy won’t give you free credits because of the device check, email us and we’ll look into it.

12. Your rights

Everyone. You can ask us for a copy of your personal information, to correct it or to delete it. Email support.worthy@nirovalabs.com from the email address linked to your Worthy account, or write to us through Contact support in the app, which adds your support code, so we can check that the request is yours. If you signed in with Hide My Email, use Contact support in the app. We may ask for more information to verify it. We’ll answer within 30 days. If we need longer, as the law allows, we’ll tell you why. We won’t treat you differently for making a request. Some rights have limits: for example, we may keep information we need for legal reasons, as section 8 describes.

If you live in the European Economic Area, the United Kingdom or Switzerland. We rely on these legal bases:

• contract: to provide the Service you asked for, including scans, finds, listings, purchases and support;
• legitimate interests: to understand and improve Worthy, keep it secure and prevent abuse, tailor what we show you, keep deleted finds so we can help you, and handle legal claims, where these interests aren’t overridden by your rights;
• consent: for optional advertising measurement and, where required, notifications and device access. You can withdraw consent at any time through the controls in section 11 or by emailing us, without affecting the lawfulness of earlier processing;
• legal obligation: to comply with the law, such as tax and accounting rules.

You also have the right to restrict our use of your information, to object to uses based on legitimate interests (including analytics), to receive your information in a portable format, and to complain to your local data protection authority.

If you live in the United States. Depending on your state, you may have the right to know what personal information we collect and how we use and disclose it, to access it and get a copy, to correct it, to delete it, and to opt out of its sale, sharing, targeted advertising and profiling with legal or similarly significant effects. We don’t sell personal information for money or profile people to make decisions with legal or similarly significant effects. To opt out of optional advertising measurement and any related sale, sharing or targeted advertising under applicable law, use the controls in section 11 or email us. You can use an authorized agent, and we may ask them for proof that you authorized them. If we decline your request, you can appeal by replying to our answer within 45 days. We’ll answer the appeal in writing within 45 days and explain our decision, and our answer will tell you how to contact your state’s attorney general if you disagree with it. If you live in Nevada, you can send a request not to sell your personal information to the same address.

California

In the last 12 months we collected these categories of personal information, from you, your device and the sources described in section 2, for the purposes in section 3:

• Identifiers: name, email address, account ID, device and installation identifiers, IP address and eBay username.
• Customer records: name and email address.
• Characteristics of protected classifications: gender and age range, from your onboarding answers.
• Commercial information: purchases, credits, and the items you scan, save, buy, list and sell.
• Internet or other electronic network activity: how you use the app, and logs.
• Geolocation data: approximate location from your IP address, and your ship-from ZIP code, city and state. Not precise location.
• Audio, electronic and visual information: photos.
• Sensitive personal information: the access tokens that let Worthy use your eBay account. We use them only to provide the features you ask for, and not to infer anything about you.

We disclose each category, as needed for its work, to the relevant service providers in section 6, and identifiers, commercial information, geolocation data (your ship-from ZIP code, city and state) and photos to eBay at your direction. Optional advertising measurement, once enabled with your permission, may disclose identifiers, commercial information (purchase events) and app activity to Meta. This may qualify as “sale” or “sharing” under California law even though we don’t receive money for the information. You can opt out using section 11. We don’t knowingly sell or share the personal information of anyone under 16. Section 8 explains retention.

Do Not Track and Global Privacy Control. Our website doesn’t use advertising trackers or sell or share visitor information for cross-context behavioral advertising. Browser signals don’t change the separate tracking permission on your iPhone. To opt out in the app, use the controls in section 11. Where applicable law requires us to honor an opt-out preference signal, we do so.

13. Where information is processed

Worthy’s database, files and servers are in the United States. We and our providers may process information in other countries, where data protection laws may differ from those where you live. Where the law requires it, we rely on safeguards such as the Standard Contractual Clauses in our providers’ data processing terms.

14. Children

Worthy is only for people 18 and older. We don’t knowingly collect personal information from anyone under 18. If we learn that we have, we delete it and close the account. Parents and guardians who believe someone under 18 has given us information can email us.

15. Changes to this policy

We may update this policy by posting a revised version on this page and changing the effective date at the top. Where the law permits, we may make changes without sending an individual notice. Where additional notice is required, we will provide it in an appropriate way, such as a notice in the app, a prominent notice on our website or an email, and in advance where required. Before using information for a new purpose, we will provide any required notice and obtain any consent required by law. A policy update doesn’t override your existing privacy choices or give us tracking permission.

16. Contact us

For questions about this policy or to make a request, email support.worthy@nirovalabs.com.