Legal
Privacy Policy
Last updated:
Sorceress is operated by Terrasse Studio LLC (“we”, “us”). This policy explains what we collect when you use sorceress.tools, why, who we share it with and how long we keep it. The short version: we collect what we need to run your searches and save your work. We don't sell your data, we don't show ads, and we don't use advertising trackers. We use product analytics (PostHog) to see how Sorceress is used so we can improve it; see “Usage analytics” below.
1. What we collect
Your account
- Your email address and first name (and last name, if you give one).
- Your password, stored only as a one-way hash (bcrypt). We can't see your password.
- If you sign in with Google: your Google account ID, email address and first name, as provided by Google.
- Your plan and how many searches you have used, for usage limits.
What you put into Sorceress
- Photos. Photos you upload are sent to our AI provider to identify the piece. If you are signed in, the photo is also saved to your Image Library, which is stored in Cloudflare R2. A copy of a photo you upload to search with (scaled down if it is large, and re-saved without location and camera data) is kept with that search in Cloudflare R2, so results can be compared to it and your search history can show it. It is deleted within about 3 days after the search is deleted (see “How long we keep it”). Photos you add to a Rune are stored the same way (see “How long we keep it” for when they are removed).
- Links. If you paste a link, our server fetches that page or image to find the picture to identify.
- Text and filters. Descriptions you type, the marketplaces you pick and your filters. If you use a pickup-distance filter, that includes the ZIP code you enter.
- Searches. What the AI identified, the search terms we built for each marketplace and the results we found.
- Runes, Spells and tabs. Rune (project board) names and notes, listings and photos you save, budget items, and any client details you choose to enter (name, email, phone, address); Spells (saved recurring searches) and their results; and your open search tabs.
Technical information
- Your IP address, used for rate limiting and to enforce the guest search limit (see retention below).
- Our application logs, used for debugging, can include search terms, links you paste and account IDs. They are set up not to record your IP address, cookies or sign-in tokens. Logs are kept by our hosting provider (Railway) for its log-retention period. Our hosting providers may also keep their own technical request logs, which can include IP addresses, under their own policies.
- Usage analytics. When you use the website we record the pages you open and what you do in the app: starting a search (the kind of input, the text you typed with any links, email addresses and phone numbers removed, and the type of piece identified), how many results it found and how long it took, which results you open or save, and creating Runes and Spells. Your browser, device type, screen size, language and time zone, and your approximate location (country and city, from your IP address) are recorded with it. If you're signed in, this is linked to your account ID, not your name or email address. We don't record your photos, links you paste or the addresses of your stored photos.
- Session recordings. We also record how the app is used in a session (session replay): the layout of the pages, mouse movements, clicks and scrolling. All text on the page and everything you type are hidden, and all images, including your photos, are left out of the recording.
We don't collect payment details.
3. How we use it
- To identify pieces, search marketplaces and rank the results for you.
- To save your Image Library, Runes, Spells and tabs, and run your Spells.
- To run your account: sign-in, usage limits and support.
- To keep the Service secure and prevent abuse.
- To fix problems and improve search quality.
- To understand how Sorceress is used (which features, where people get stuck) and improve it.
We don't sell your personal information, share it for targeted advertising or use it to build advertising profiles.
5. How long we keep it
- Searches and their results: deleted automatically about 7 days after the search (the cleanup runs daily), unless a Spell uses that search. Those searches are kept while the Spell exists. The copy of the photo you searched with is kept as long as a search that uses it is kept, and is deleted within about 3 days after the last such search is deleted.
- Image Library photos: until you delete them. Deleting a photo also deletes the stored file, unless the same file is still used elsewhere, for example in one of your Runes, a search tab or a recent search.
- Rune photos: until you remove them from the Rune or delete the Rune. We then delete the stored file, unless the same photo is still used elsewhere in Sorceress, for example in your Image Library, a search tab or a recent search.
- Listings you save to a Rune: we keep a copy of the listing (its title, price, photo link, marketplace link and, for Etsy, its era) with the Rune until you remove it from the Rune or delete the Rune, even after the search it came from is deleted.
- Runes, Spells and search tabs: until you delete them or your account.
- Sign-in tokens: expire after 30 days. Signing out ends the session in that browser.
- IP-based limits: rate-limit records that contain your IP address or account ID are short-lived (their windows last from one minute to one hour) and expired records are cleared periodically. The guest search counter is kept in memory and resets daily.
- Your account: until you delete it in Settings or ask us to.
- Backups: Deleted data may remain in our database backups for up to 90 days before they're overwritten.
6. Your choices and requests
You can delete Library photos, Runes, Spells and tabs yourself in the app (see above for when stored files are deleted). You can also delete your whole account yourself in Settings (Delete account), after confirming it's you with your password or Google sign-in. It deletes the account and its profile, searches, Spells, search tabs, Runes and Library photos at once, signs you out everywhere, and removes its stored photo files from our storage (straight away, or within about 3 days if our storage is briefly unavailable). It can't be undone. To see, correct or export your data, or to delete your account if you can't sign in, email staff@sorceress.tools from the address on your account, and we'll reply within 30 days. We also delete the usage analytics and session recordings that PostHog holds under your account ID. To turn off usage analytics and session recordings, turn on Do Not Track or Global Privacy Control in your browser.
If you live somewhere that gives you additional privacy rights, contact us and we'll respond as that law requires.
7. Security
We use HTTPS everywhere, hash passwords, keep sign-in tokens short-lived and in HTTP-only cookies, and keep uploaded photos in private storage. Photos are served through short-lived signed links or through our storage endpoint, which checks that you own the photo. No system is perfectly secure, so we can't guarantee absolute security. If we learn of a breach that affects your data, we'll tell you as the law requires.
8. Children
Sorceress is a professional tool for adults. It isn't meant for anyone under 18, and we don't knowingly collect data from children.
9. Where data is processed
We are based in the United States. Our providers may process data in the United States and other countries.
10. Changes
We'll update this policy when our practices change (for example, when we add a new provider) and change the “Last updated” date. For significant changes, we'll tell you by email or in the app.
11. Contact
Privacy questions and requests: staff@sorceress.tools.