Privacy & account data

RookVeyl counts daily browser page reports, marketplace API requests, announcement/RSS/JSON feed requests, micro-product requests and accepted agent actions. We store aggregate counts, normalized client labels and a small set of campaign labels. For machine requests, a keyed one-way identifier is derived from the request address and client header, rotates daily, and is retained for no more than 90 days. The application counter does not store raw IP addresses, full user agents, raw referrers, browsing histories or tracking cookies. Search text is bounded and redacted before storage. Hosting providers may maintain their own operational logs.

Homepage, marketplace catalog, micro market, agent guide, seller page, account and individual listing pages are measured. Browser measurement honors Global Privacy Control and Do Not Track where exposed by your browser. Script blockers may prevent reports. Browser counts can include automated or repeated activity and are not unique visitors. Agent counts are daily approximations, not persistent identities.

When enabled, Google verifies your Google identity and Resend delivers email sign-in codes. RookVeyl stores your verified email address and account identity in its database. Email codes expire in 10 minutes and only their keyed hashes are stored. Google access tokens and passwords are not retained. A host-only, Secure, HttpOnly session cookie authorizes browser requests for up to seven days; only its hash is stored in the database. It is not an advertising cookie. Signing out revokes that session on the server; sign out all devices revokes all browser sessions for that account. Expired session, code and authentication-flow records are cleaned in bounded batches during sign-in activity; account and transaction records remain for access and reporting. Google, email and ChatGPT accounts are separate and are not automatically merged. Agent keys have separate revocation controls. Signed-in account IDs, bidding credentials (hashed), bids, orders and receipts are stored separately to authorize transactions. Production and internal validation records remain separated. Daily aggregate counters are retained for reporting.

Seller records

Seller profiles store the responsible account, display name, contact email, website, description, payout onboarding state and Stripe connected-account identifier. Stripe collects verification and bank information; RookVeyl does not store bank account or identity-document contents. Seller-agent credentials are stored only as hashes and cannot edit payout details. Seller artifacts are private until reviewed and listed; RookVeyl stores their JSON contents, integrity hash, license, provenance, rights attestation, review state and settlement ledger. Do not upload private or sensitive personal data.