What BidBuddy knows about you.
Written against the actual database rather than from a template, so it says what is really stored — including the parts that are less flattering.
Last updated 18 September 2026
Who this is about
This notice covers BidBuddy, the eBay auction sniper at bidbuddy.humanishintelligence.com. It does not cover the other Humanish products, which handle different data and are described separately.
The data controller is Humanish Intelligence Limited, 38 Gorst Road, London SW11 6JE. For anything in this notice, write to info@humanishintelligence.com.
What is stored
BidBuddy runs on a single server with a single database. This is everything in it that relates to you.
| What | Why it exists |
|---|---|
| Username | Identifies your account and separates your snipes from everyone else’s. |
| Password | Held as a scrypt hash, never as the password itself. It is used to check a sign-in and cannot be read back or reversed into your password. |
| Your invite code | Who issued it, when it was redeemed, and by whom. Access is invite-only, so this is the record of how your account came to exist. |
| Your eBay link | An authorisation token issued by eBay, encrypted with AES-256-GCM before it is written down, plus your eBay user ID and which eBay site you bid on. The token lets BidBuddy bid on your behalf and do nothing else. |
| Your snipes | The listing ID and title, your maximum, how many seconds before the close to bid, and any bid group you put it in. |
| What happened | Whether a bid was sent, for how much, when, whether you won, and how many milliseconds before the close it landed — plus a short event log per snipe, so a failure can be explained rather than guessed at. |
| Auctions you watch | The listing, its closing time, and how long before the close you asked to be warned. Kept until the auction finishes or you stop watching it. |
| Where to reach you | The URL your close-time alerts are sent to, if you set one. Still no email address — that is the point of doing it this way. |
| Two timestamps | When your account was created and when you last signed in. |
What is never stored
- Your email address. BidBuddy does not ask for one and has nowhere to put it. This is also why there is no password reset.
- Your eBay password. You sign in on eBay’s own pages. What comes back to BidBuddy is a token, not a credential you could sign in with.
- Payment or card details. Money is entirely between you and eBay. BidBuddy places a bid; it never touches a payment.
- Anything for advertising. No analytics, no tracking pixels, no third-party scripts, no profiling, and nothing is ever sold or shared for marketing.
Cookies
One cookie, and it is not for tracking. When you sign in, BidBuddy sets a signed session cookie carrying your user ID. It lasts seven days, is marked HttpOnly, Secure and SameSite=Strict, and signing out clears it. There are no others, so there is no cookie banner to dismiss.
IP addresses
The sign-in form is rate-limited by network address: five wrong attempts locks that address out for fifteen minutes. That counter is held in memory only and is never written to the database. A refused or failed sign-in also writes the address to the server log, which is how a brute-force attempt would be spotted.
Those logs are held by the hosting provider for a limited period and are used for nothing but keeping the service running and secure.
Who else sees any of it
eBay
Unavoidably, and it is the point of the product. When a snipe is scheduled or fires, BidBuddy sends eBay the listing ID, the bid amount and your token. eBay’s own privacy policy governs what they then do with it.
Whoever you told it to notify
If you set a notification URL, close-time alerts are POSTed to it — the listing title, its current price, how long is left, and how that price compares. You choose that address, so you choose who can read it. With a service like ntfy, anyone who knows your topic name can subscribe to it, which is why the settings page suggests a long unguessable one.
Fly.io
The server runs on Fly.io in London. They hold the disk the database sits on and the server logs. They are a hosting provider and do not use the data for anything of their own.
Other people using BidBuddy
They cannot see you. Every query is scoped to the signed-in account, so another user cannot see, cancel or interfere with your snipes or your watches — and two people can bid on the same listing without either knowing.
One thing is shared, and it is worth being exact about. When an auction someone here was watching closes, BidBuddy records what it sold for — the listing, its title and its final price — and that record is pooled across everyone using this instance, so the app can tell you what similar things go for.
Those records carry no user id. They say what a public listing sold for, which is a fact about the listing and not about the person who happened to be watching it. Nobody can look at the pool and work out what you were interested in, and it is not possible to ask BidBuddy what another user watches. The pooling exists because one person watching alone would wait months to see the same kind of thing close twice.
The person who runs the server
Worth being plain about. BidBuddy is self-hosted, and whoever operates the server has direct access to the database file and holds the key that decrypts stored eBay tokens.
So encryption at rest protects the database if a copy of the file were taken; it does not put your token beyond the reach of the operator. Link an eBay account only if you would trust that person with it.
How long it is kept
Your account and its snipe history stay until you ask for them to be deleted. Old snipes are kept deliberately: the record of when a bid landed is what tells you whether your lead time is being honoured.
The eBay token is the exception — it goes the moment you unlink, and is replaced rather than accumulated if you link again.
Closing prices are kept indefinitely, and deleting your account does not remove them: there is nothing in them to remove. They record what a public listing sold for and are not linked to you, so once written there is no "your" record among them to find.
What you can do
- Unlink eBay in Settings. The stored token is deleted immediately and BidBuddy can no longer bid for you.
- Revoke access at eBay instead, from your own eBay account. That works even if BidBuddy is unreachable, and it is the stronger of the two.
- Cancel or delete a snipe at any time before it fires.
- Stop watching an auction at any time, which cancels its alert.
- Remove your notification URL in Settings, after which nothing is sent anywhere.
- Ask for your account to be deleted. That removes the account, its snipes, its bid groups, its watches and its eBay link. The pooled closing prices stay, because they are not yours — they are what public listings sold for.
Under UK GDPR you also have the right to access the data held about you, to have it corrected, to have it erased, to receive a copy, and to object to how it is handled. Ask at info@humanishintelligence.com. The lawful bases are performance of a contract — running the service you asked for — and legitimate interests, for keeping it secure.
If you are not satisfied with how a request is handled, you can complain to the Information Commissioner’s Office at ico.org.uk.
Security, and its limits
Passwords are hashed with scrypt. eBay tokens are encrypted with AES-256-GCM under a key held only in the server’s environment, never in the database beside them. Everything travels over HTTPS, and the session cookie is refused over plain HTTP.
None of that makes a promise nobody can keep. It is one small server; a determined attacker who reached it while it was running would reach the key with it. What the encryption buys is that a stolen copy of the database is not, by itself, a stolen set of eBay accounts.
Changes to this notice
If what BidBuddy stores changes, this page changes with it and the date at the top moves. There is no mailing list to notify, because there are no email addresses to notify it with.