Privacy policy

Tupendan is an auction aggregation service operated from Sweden. This page describes what personal data we handle, why, and what your rights are. The short version: we store what you need to have an account, we don’t sell or share your data, and you can delete everything yourself at any time.

What we collect

• Account data. Your email address and, if you sign in with Google, the name and profile details Google shares with us.
• Things you save. Your boards and saved lots, watched lots, and saved searches — this is the product, and it only exists so we can show it back to you and improve your feed.
• Technical logs. Standard server logs (IP address, request, timestamp) kept short-term for security and debugging.
• Search terms, without who typed them. We record the words searched for, how many results came back and how long the search took, so we can see which searches fail and make them work. These records carry no identifier at all — no account, no session, no IP address — so they cannot be traced back to you, and they are not part of your account data. Anything that looks like an email address, phone number or personal ID number is removed before the record is stored. Kept for 180 days.
• Browsing behaviour — only with your ok. If you switch on personalisation in the cookie banner, we record which lots you open, how long you look at them and which cards you scroll past, to build a taste profile for the “Personal” feed. See the section below.

We do not handle payment information — bidding and buying happen at the auction houses, never on Tupendan.

Where it lives

Your data is stored with our database provider Supabase on servers within the EU. It is never sold, rented, or shared with third parties for marketing.

Personalisation

The “Personal” feed ranks lots by what you seem to like. Two kinds of signals feed it. Things you do on purpose — saving, watching, the interests you pick in onboarding — are part of your account and always count. Browsing behaviour — which lots you open, how long you stay, which cards you scroll past — is used only if you say yes to personalisation in the cookie banner and, for signed-in users, under Settings. Both must be on; either one off means we stop.

For visitors without an account we set a random identifier cookie so the profile can follow you between visits; it is never linked to a name or email. Browsing events are kept for at most 180 days and which cards you were shown for at most 30 days (90 for signed-in users); the derived taste profile is rebuilt from those and expires with them. Turning personalisation off, or deleting your data under Cookie settings, removes the browsing data and the profile. No automated decision with legal or similar effect is made about you — this only changes the order of lots in one feed.

Cookies

Strictly necessary cookies — keeping you signed in, remembering preferences like theme, layout and sort order — are always on. Analytics cookies (Google Analytics and Microsoft Clarity, which records anonymised sessions and heatmaps with form input masked) are used only if you say yes in the cookie banner, and never before. If you are signed in, your account ID (a random number, never your name or email) is attached to that analytics data so we can see how account holders use Tupendan across devices. Analytics data held by Google and Microsoft expires under their retention (Google Analytics up to 14 months, Clarity 30 days); deleting your account removes everything we hold ourselves. The personalisation cookie (a random identifier for visitors without an account, 180 days) is set only if you say yes to personalisation. We run no advertising cookies. You can change your choice at any time:

Your rights

Under the GDPR you can access, correct, export, or erase your personal data. Deleting your account under Settings removes your account and everything you have saved. For anything else, contact us and we will sort it out.