Privacy Policy

Last updated: November 8, 2026

This Privacy Policy describes how Garey Hoffman (d/b/a Punchcard) ("we", "us", "the Tool") handles information in connection with the Punchcard Listing Tool, a private, single-user application that connects to eBay through eBay's public APIs. This policy applies to the website nobikeshedding.com and to the Tool itself.

1. Who we are

Operator: Garey Hoffman (d/b/a Punchcard)
Location: St. Louis, Missouri, United States
Contact: punchcard107@outlook.com

2. The scope of this application

The Tool is not a public service. It is a personal application used exclusively by its owner to research and manage the owner's own eBay listings. It does not serve third-party users, does not accept user registrations, and does not create accounts for any person other than its owner.

3. Information we access from eBay

When the owner authorizes the Tool via eBay's OAuth flow, the Tool is granted access to the following, and only the following:

• Sell Inventory (sell.inventory) — to create and read the owner's own listing drafts, inventory items, and offers.
• Sell Account (sell.account) — to read the owner's own selling policies so listings can be published correctly.
• Public catalog data — public listing data (titles, prices, condition, images, item specifics) retrieved through eBay's public Browse API for price research.

4. Information we do NOT access or collect

• We do not access, store, or process eBay buyer names, shipping addresses, email addresses, or telephone numbers.
• We do not use eBay's Fulfillment or Order APIs, and therefore receive no buyer personally identifiable information from eBay.
• We do not collect information from any person other than the application owner.
• We do not collect payment information — the Tool has no payment functionality.
• We do not use cookies for tracking, advertising, or analytics.

5. How information is stored

• OAuth tokens (access and refresh tokens) are stored in a private, access-controlled password manager (1Password) and on the owner's own self-hosted, access-controlled server. They are never stored on this public website and never embedded in page source.
• Listing drafts and research notes are stored in a local database on the owner's own equipment.
• This website (nobikeshedding.com) stores no database, sets no cookies, and retains no request bodies. It functions solely as an OAuth redirect endpoint: it displays the authorization code returned by eBay so the owner can pass it to the local application, after which it is discarded.

6. How information is used

Information is used solely to produce, edit, and publish the owner's own eBay listings and to research comparable prices. It is not used for profiling, marketing, advertising, resale, or any purpose unrelated to that function.

7. Sharing and disclosure

We do not sell, rent, share, or otherwise disclose any information obtained through eBay's APIs to third parties, except:

• as required by applicable law, legal process, or a valid request from a governmental authority;
• as necessary to protect our legal rights or to investigate suspected fraud or misuse.

No third-party analytics, advertising networks, or data brokers receive any information from this Tool.

8. Data retention and deletion

OAuth tokens are retained only while the Tool remains authorized. The owner may revoke access at any time, which immediately invalidates the tokens, via eBay's Third-party app access settings.

Upon revocation or upon request, all locally stored tokens and any associated cached data are deleted. Deleting local tokens does not affect the owner's eBay account or listings.

To request deletion of any data held by this application, email punchcard107@outlook.com. Requests are actioned within 30 days.

9. Security

Access tokens are transmitted only over HTTPS. Tokens are held in a password manager with encryption at rest and are never committed to source control or exposed in client-side code. The endpoint on this site is read-only with respect to eBay credentials: it displays the authorization code to the browser that requested it and stores nothing.

10. Children's privacy

This application is not directed to children under 13 and collects no information from any person other than its owner.

11. Your rights

Because the Tool processes no third-party personal data, the rights of data subjects are not implicated. The application owner retains full control of all data at all times and may revoke authorization unilaterally through eBay.

12. Changes to this policy

Material changes will be posted at this URL with a revised "Last updated" date. Continued use of the Tool after a change constitutes acceptance.

13. Contact

Questions about this policy or about data handling: punchcard107@outlook.com

This application uses eBay's APIs but is not endorsed or certified by eBay, Inc. eBay and the eBay logo are trademarks of eBay, Inc.