What UsedAlert stores, who else sees it, and how to delete all of it.
Last updated 6 September 2026.
UsedAlert needs an email address to send you alerts and a list of what you want alerting about. That is essentially the whole data set. There are no ads on this site, no third-party analytics or tracking pixels, and nothing here is sold or shared for marketing.
| Data | Why | Kept until |
|---|---|---|
| Your email address | To send alerts and password resets, and to identify your account at sign-in | You delete your account |
| Your password, hashed with Argon2id | To verify sign-in. The password itself is never stored and cannot be recovered from the hash | You delete your account |
| Your watchlist: ASINs, the item names you type, the condition grades you accept, and any price ceiling | To decide which used offers should alert you | You remove the item, or delete your account |
| Alert history | So you can see past alerts in the dashboard | You clear it, or delete your account |
| Sign-in tokens, stored as SHA-256 hashes | To keep you signed in without re-entering your password | You sign out or change your password, which revokes all of them |
| Push subscription details, only if you turn on the notification bell | To deliver push notifications to that browser or device | You turn the bell off, the subscription expires, or you delete your account |
| Password reset codes | To verify a reset request | 15 minutes |
| Rate-limit counters, keyed to a truncated form of your IP address | To stop automated attacks on sign-in and signup | 15-minute rolling window |
Your browser also keeps your sign-in token and email address in its own local storage so you are not asked to sign in on every visit. Signing out clears them. That is local to your device, not a cookie sent to us on every request.
Nobody else. Your data is not sold, rented, or shared for advertising.
If you only want the emails to stop, every alert email carries an unsubscribe link. Unsubscribing stops alert emails and leaves your account and watchlist intact. Push notifications are controlled separately by the bell in the app, and can also be revoked in your browser or phone settings.
Account-related mail you cannot unsubscribe from is limited to what you ask for: password reset codes.
UsedAlert is not directed at children under 13 and we do not knowingly collect their data.
If this page changes materially, the date at the top changes with it. For anything not covered here, email alerts@usedalert.com and ask.