Privacy

Who we are

OOSClub is run by Resellsnob LLC, which decides how the data on this page is used (in EU and UK terms, the controller). Email legal@oosclub.com about anything on this page.

Clicks on links to other sites

When you follow a link from OOSClub to a seller, it passes through an address on our domain (starting with /go/), which records the click and sends you on. For each click we store:

• which link, listing and offer it was, and where on the page it sat (for example, the buy box);
• the address of the OOSClub page you were on, without anything after a “?” in it (so never what you searched for);
• the domain name of the page the link was on, as your browser reports it: normally our own, or another site's if it linked straight to a /go/ address;
• your country, as reported by our host, and whether your device is a phone, tablet or computer;
• whether the visit looks automated, so crawlers don't count as people;
• a daily visitor code: a one-way hash made from your IP address, your browser's user agent, the date and a secret value. It lets us tell that two clicks on the same day came from the same visitor, and it changes every day. We don't store your IP address, but because the code is made from it, data-protection law treats it as personal data, and so do we.

We use this to see which listings and pages are useful, and to count affiliate referrals.

Searches

When you search the directory we store the search words (lowercased and trimmed), the filters you chose, how many results came back, the time, and the same daily visitor code. Before storing the words we replace anything that looks like an email address with “[email]” and any run of seven or more digits, such as a phone or order number, with “[number]”. Searches that look automated aren't stored. We use them to improve search and to find listings people look for that we don't have yet.

What we store from the suggest form

The suggest a listing form asks for a product's link and name and, if you like, what it is and a note, which editors read; please don't put personal details in it. If you're suggesting something, we don't ask for your name or email. We store what you typed for our editors to review. Nothing is listed until an editor approves it. If someone already suggested the same product, yours counts as a vote for it instead of a new suggestion.

If you run the product (“I run it”, or “Update this listing” on a listing), the form also asks for your email and, if you like, links to its pricing, refund or terms and updates pages, a code for our readers and what changed. We store those with the request, and the time you ticked the box saying listing is free and not guaranteed. Only our admins can see your email, and we use it only to ask about this listing or to tell you it's live or updated.

Reporting a listing (“Report it”) stores what you say is out of date, your note and the link where you saw it, if you give them, and which listing it's about, for an editor to recheck.

To stop abuse, each request also stores a one-way hash of your IP address made with a secret value and the date (no browser details, and never the IP address itself), with the time it was sent and which suggestion it counted towards. It lets us limit how many requests one visitor can send in an hour, and count one vote per visitor per day. We delete these hashes after a day.

How long we keep it

• Click and search records: 90 days. After that, a daily clean-up adds each record to totals per day (for example, how many clicks a listing had on a given day, or how often a search was made and whether it found anything) and deletes the record itself. The daily totals don't include the daily visitor code, the page you were on, the referring domain or the search filters. The search totals keep the search words, with email addresses and long numbers already removed. We keep the totals.
• The suggest form's IP hashes: one day, deleted by the same daily clean-up.
• Owners' email addresses: 30 days after we approve or decline the request, deleted by the same daily clean-up.
• Suggestions, owners' requests and reports, without the email: kept as the record of where a listing and its facts came from.

Server logs

Like any website, the services that run OOSClub log requests: as part of running the service, our host (Vercel) and our database provider (Supabase) keep short-lived request logs that include IP addresses, the address requested (including any search words in it) and browser details, under their own retention policies. When a page fails, our own code writes an error record with the page's path (without anything after a “?”) and the error; it never includes cookies, request headers or search words. We use logs only to keep the site running and secure.

No analytics

We don't use analytics or tracking cookies, our own or anyone else's: no page-view counters, no advertising or social-media pixels. The click and search records above are the only usage data we keep.

Cookies and what your browser keeps

• theme (a cookie): set only if you pick a light or dark theme, and remembers that choice for a year. It holds nothing else.
• oosclub:compare (your browser's local storage): the listings you picked to compare, kept in your browser until you clear the comparison. It's never sent to us.
• A few session-storage entries starting oos: remember where you were in a list for the current tab; your browser deletes them when you close it.
• Our team's sign-in pages set session cookies for staff only. Scripts on the page can't read them, and they last at most a week.

None of these track you, and none is shared with anyone.

Staff accounts

Only our team has accounts. For each one we store the email address, the sign-in and two-factor authentication details, the role, and a record of the changes the account makes to the directory.

Who processes it for us

These companies process the data above on our behalf, under their own data-processing terms:

• Vercel: hosting, and the server logs above, in the United States (East).
• Supabase: our database, image storage and staff sign-in, in the United States (East).

Our fonts are served from our own domain, and listing images come from our own storage, so no font or image service sees your visit.

We don't sell personal data, and we don't share it for advertising. When you follow a link to a seller, you leave OOSClub: the seller's own privacy policy applies there, and an affiliate link tells the seller you came from OOSClub (see how we make money).

Where it's processed

Resellsnob LLC is based in the United States, and Vercel and Supabase process the data above in the United States (East). For data from the EU or the UK, transfers to Vercel and Supabase are covered by the safeguards in their data processing terms, such as standard contractual clauses.

Why we're allowed to use it (EU and UK)

• Clicks, searches, the suggest form's IP hashes and server logs: our legitimate interest in running, improving and securing the site, and in counting affiliate referrals. We keep the least we need (hashes, not IP addresses) and for the times above.
• Suggestions, reports and owners' requests, with an owner's email: our legitimate interest in reviewing what you sent and answering you about it.
• The theme cookie and the browser storage above: they only do what you asked for (a theme, a comparison, your place in a list), so they need no consent.
• Staff accounts: what's needed to give our team access and to keep a record of their changes.

Your rights

In the EU and the UK you can ask for a copy of data about you, and ask us to correct it, delete it, restrict how we use it or give it to you in a portable form. You can object to any use based on our legitimate interests. You can also complain to the data-protection authority where you live or work.

In US states with privacy laws you can ask what we hold about you, and ask us to correct or delete it. We don't sell or share personal data for advertising, so there's nothing to opt out of. Using your rights never changes how the site treats you. If we turn a request down, you can ask us to look at it again by replying.

To use any of these rights, email legal@oosclub.com. We don't know who you are, so to find a record we may need details such as the time of a suggestion or the email an owner's request used. We answer within the time the law where you live requires.

Children

OOSClub isn't for anyone under 18 (pages about sports betting are for 21 and over). We don't knowingly collect data from children; if we learn something we hold came from a child, we delete it.

What we don't do

• No analytics, no advertising trackers, no advertising cookies and no social-media pixels.
• No visitor accounts, and no newsletter sign-up.
• We don't sell personal data or share it for advertising.

Changes

If what we collect changes, we'll update this page and the date at the top before it does.

Contact

For questions about privacy or the data described here, email legal@oosclub.com.