Privacy Policy

Who operates the site

moddesta operates moddesta. For privacy questions, email hello@moddesta.com.

Information we collect and why

• Optional accounts: your email address, account creation date and saved Wishlist items, plus a protected password hash if you create an email/password account. These let you sign in and keep favorites between visits. We do not store your password in readable form.
• Google sign-in: if you choose Google, Google and Supabase Auth process the sign-in and basic profile/email permissions. We store your verified email and stable account identifiers to recognize your account. We do not request access to your Gmail messages, contacts, Drive files or calendar, and do not retain Google or Supabase access/refresh tokens in our catalog database. Connecting Google to an existing account keeps its Wishlist with that account.
• Sessions and security: session identifiers, expiry times and sign-in attempt counters, including a hashed identifier derived from an email address. We use these to keep accounts signed in and limit abuse.
• Shopping clicks: when you follow a retailer link, the app records the product, time, referring-page information when supplied by your browser, and browser user-agent information. This helps us understand outbound shopping activity. Click records are stored separately from account and Wishlist records.
• Technical requests: servers and service providers may process IP addresses, request details and error logs to deliver and secure the site. Product images may be delivered by retailer or image-provider servers, which receive the information necessary to serve them.
• Messages: if you contact us by email, we receive your address and the information you choose to send so we can respond.

Browsing does not require an account. We do not collect payment details or process purchases on moddesta.

Cookies and device storage

A necessary first-party sign-in cookie can keep you signed in for up to 30 days. Signing out clears the sign-in cookie and revokes that session. Google sign-in also uses an encrypted first-party handoff cookie for up to ten minutes, cleared when that flow finishes. You can also clear cookies using your browser, though this may sign you out.

The optional installed web app stores a small offline shell and icons. Account, Wishlist, admin and product inventory responses are not cached for offline use. This version does not load third-party advertising or analytics scripts on our pages.

Retailers and shopping links

When you follow a shopping link, the retailer and any affiliate network in that link receive your browser’s request. They may use cookies or similar technologies to attribute a purchase and process information under their own policies. Their privacy and cookie choices apply on their services.

Read our affiliate disclosure. Before introducing additional on-site tracking, we will update this notice and implement applicable consent and opt-out controls. A retailer listing alone does not mean we share your account or Wishlist with that retailer.

Who can access information

The operator and service providers needed to run the site, database, security and email can process information for those purposes. We may also disclose information when required by law or to address fraud or security incidents. Infrastructure and retailer services may process information in countries different from yours.

We do not sell customer account or Wishlist records. This does not describe the separate data practices of retailers or affiliate networks you visit.

How long information stays

Account and Wishlist records remain stored until removed. Sessions expire after up to 30 days; expired session records are cleaned up during subsequent sign-ins. Signing out revokes the current session.

Click and security records currently have no automatic deletion schedule. Contact us to request deletion or ask about retention. Some information may need to remain for security or legal reasons; backup copies can remain until the relevant backup is replaced. We do not promise immediate erasure from backups.

Your choices and requests

You can browse without signing in, remove Wishlist items and sign out at any time. To request access, correction, account deletion or information about other privacy rights that may apply where you live, use our Contact page. We may need to verify your identity before fulfilling a request. There is currently no self-service account-deletion page.

Children and changes

moddesta is intended for adults and is not directed to children. If you believe a child has provided account information, contact us so we can investigate and remove it where appropriate.

We may update this notice as the service changes. The date above identifies this version.