Privacy policy

Last updated October 4, 2026

Adelphian Labs LLC operates Things to Buy. This policy covers our website and shopping workspace. Connected assistants, merchants and payment providers have their own privacy practices.

Information we collect

• Account information such as your email address, password hash, authentication settings, sessions and authorized assistant connections.
• Workspace content you or your assistants save: lists, requirements, links, notes, research, sources, comparisons, image URLs, prices, questions and answers, buying instructions and reported outcomes.
• Subscription references and status, trial and paid-access dates, and payment-related records received from Stripe. We do not store your full payment-card details.
• Security and operational information, including sign-in IP addresses and browser details, activity timestamps, request/retry records and email-delivery information.
• Messages and contact details you provide when asking for support.

We receive the content sent to Things to Buy through the web app, API or authorized connector. Connecting an assistant does not give us general access to all of your conversations with that assistant.

How we use it

We use information to provide your workspace, authenticate access, follow saved preferences, coordinate assistant work, process subscriptions, send account messages, answer support requests, protect the service and meet applicable obligations. We do not sell your personal information.

Things to Buy does not run your product research through a service-side AI model. Your connected assistant performs that work under its provider’s terms and settings, including its own data-retention and model-training choices.

Where information goes

• Your connected assistants: content and instructions available under the permissions you grant. You can change or revoke access in Connected assistants. Disconnecting cannot retract copies already held by another provider.
• Hosting and network providers: DigitalOcean hosts the application. Cloudflare provides traffic delivery, security and encrypted offsite backup storage. These services process information needed to operate and protect the site.
• Email and support providers: Resend delivers account emails, including their recipient and message content. Support email is routed through Cloudflare to our Google-hosted support mailbox.
• Stripe and Link: subscription checkout, payment details, billing support and subscription management. We share account email and identifiers needed to connect a subscription to your account.
• Image hosts and merchants: your browser loads saved product images from their source URLs. The host receives network information such as your IP address. Following a merchant link or asking an assistant to visit it is governed by that service’s practices.

We may disclose information when required by law, to protect people or service security, or in connection with a business transfer subject to appropriate protections. Service providers may process information in the United States and other countries; protections can differ by location.

Cookies and browser storage

We use essential cookies for sign-in, security and account linking. Browser storage remembers appearance preferences. Our infrastructure providers also process traffic and security information. Blocking essential cookies can prevent sign-in or linking.

Retention and deletion

We retain your workspace while your account remains active. Archiving an item or ending Pro does not delete it. The service also retains activity and security records needed for operation, recovery and accountability.

Account → Your data provides workspace export and account deletion. Export includes saved workspace records; it is not a complete copy of every security or billing record. Self-service deletion requires verification and is blocked while a subscription or purchase outcome still needs resolution.

Deletion removes account-owned records from the live application. Backup copies expire under our retention and recovery procedures; routine backups normally use a 14-day retention window, while release/recovery checkpoints may be retained longer. Deletion is not an immediate erasure of every backup. Legal, payment or security records may need separate retention. Copies held by Stripe, email providers, assistants or merchants are subject to their own retention practices.

Your choices and requests

You can edit workspace information, export it, change assistant permissions and request deletion in the app. Email support@thingstobuy.ai for access, correction, deletion or other privacy requests, including help with a minor’s account. Depending on where you live, you may have additional rights. We may verify your identity before fulfilling a request and will explain any limitation that applies.

Young people

Things to Buy is for people aged 13 and older, subject to any higher minimum required where they live. Users below the age of majority need parent or guardian consent. We do not knowingly allow children under 13 to create accounts. If you believe a child under 13 has provided information, contact us so we can investigate and take appropriate action.

Security and changes

We use access controls, hashed passwords, encrypted connections and encrypted offsite backups. No system can guarantee absolute security. Protect your account and assistant credentials and avoid saving unnecessary sensitive information.

We will update this page when our practices change and provide additional notice for material changes where appropriate. Questions or requests can be sent to support@thingstobuy.ai.