Old Oak Syndicate

Old Oak Syndicate / Your information

Privacy Policy

Gear research should be straightforward. So should understanding what happens to your information. This policy describes the service we operate today, including its current limitations.

Last updated:

Your account

We use account details to sign you in and keep your saved gear criteria associated with you.

Your buying notes

Saved buying briefs are private account information, not public listings or editorial AI inputs.

A person to contact

Privacy requests go to the operator for manual review. There is no self-service account-erasure tool.

1. Who operates Old Oak

Old Oak Syndicate, also called Old Oak Gear Scout, is an independent Australia-based service operated by Nick Carter at oldoaksyndicate.com. We help people browse outdoor gear, research marketplace listings and manage saved buying criteria. Purchases of marketplace items take place with the marketplace and seller, not with Old Oak.

For privacy questions, access or correction requests, deletion requests or complaints, email [email protected]. This is the operator-provided contact for this service.

2. Information we handle

  • Account and sign-in details. Your name, email address, internal account identifier, email-verification status, account role, creation/activity timestamps and locale/currency settings. Account records also support a profile-image reference. Password registration stores a salted bcrypt password hash, not a readable password. Email-link sign-in uses verification tokens and expiry information. Authentication uses session cookies. Current sign-in options are password and email link; social OAuth sign-in is not currently offered.
  • Saved gear and personal criteria. Products and searches you save, target asking prices, active state and saved preferences, including older alert/score criteria. A saved buying brief can include your before-tax budget, size/fit, model/generation and condition requirements. Existing eligible paid accounts can save briefs; saved briefs remain readable and removable after a downgrade. Temporary budget checks stay in the page unless you explicitly save a brief. Avoid putting sensitive personal information in notes.
  • Billing records. Where a Stripe subscription exists, we keep customer and subscription identifiers, plan/status, billing-period and cancellation information, and synchronization timestamps. Stripe handles payment details. Old Oak does not store payment-card numbers or security codes. New subscription checkout is currently paused; this does not itself cancel any existing subscription.
  • Messages and delivery records. Information you send to our contact address and, for application service emails, recipient, subject, template, delivery status, provider message identifier, timestamps and associated metadata. Email-link delivery is handled separately by the authentication provider integration.
  • Technical and operational information. Requests necessarily expose network information such as IP address, browser details and requested URL to our hosting and delivery systems. Registration uses IP-based abuse controls. Application logs, error reports and sampled performance traces can include diagnostic context, release information and timestamps. Administrator/editor actions can be recorded with account identifiers, email, action and related content.
  • Marketplace and editorial information. Official eBay responses provide listing identifiers, seller-described titles, images, asking prices, shipping where supplied, condition, seller feedback and item details. Legacy records may also contain seller-identifier fields, listing observations and derived records. Editorial storage includes drafts, revisions, references, assets, review/audit records and AI job inputs/outputs. If eBay sends an account-deletion notification, it can contain marketplace user identifiers, notification identifiers and timestamps; these are for marketplace-data handling, not an Old Oak login.

3. Why we use it

We use information to operate sign-in and account access; store and display your own watchlists and briefs; retrieve relevant marketplace results; synchronize existing subscription access; send requested sign-in and other service emails; respond to requests; prevent abuse; investigate errors; and administer reviewed editorial content.

Private buying briefs are not included in shared marketplace caches, public metadata or editorial AI prompts. They are available through your authenticated account and to authorized operators where needed to maintain the service or handle your request. “Private” does not mean inaccessible to the operator or encrypted so that only you can read them.

Marketplace-derived analytics, resale modeling, marketplace AI processing and promotional dispatch are withheld under our current feature restrictions. We do not import the sold results opened by the research links: that research takes place on eBay.

4. Providers and overseas processing

We use service providers for the functions below. They receive the information needed for those functions, and their own handling and retention rules also apply. Some services are independently responsible for information you give them directly.

  • Hosting and delivery. The application and PostgreSQL database run on self-hosted infrastructure in New South Wales, Australia, managed with Coolify. Cloudflare provides edge/network delivery. Hosting, network and browser caches can process request information and public resources.
  • Stripe. Existing subscription management, hosted billing controls and payment processing. Stripe can receive account/customer identifiers and email, and collects payment information directly in its own interface.
  • Resend and email systems. Sign-in and application service emails send the recipient address and message content to Resend. The email-provider integration has Resend SMTP settings, but the current sign-in sender uses the Resend API. Contact correspondence is also processed by the email systems used by you and the operator.
  • Error monitoring. We use the Sentry SDK with self-hosted GlitchTip for errors and sampled performance monitoring when configured. Collection settings restrict cookies, headers, query parameters, request bodies, user details and AI/database payloads; event hooks also remove selected identifying fields. These safeguards reduce exposure but do not guarantee that every diagnostic message is anonymous or contains no personal information.
  • eBay, image delivery and affiliate links. Our server sends catalogue/search terms and item identifiers to the official Browse API. Listing images load directly from eBay image servers. Clicking an item, sold-research or affiliate link opens an external service which can receive your request details and use its own cookies. Affiliate-aware item links may include campaign/reference identifiers; sold-research links are untracked by our affiliate integration. Old Oak may earn a commission on qualifying purchases.
  • Google Fonts and search reporting. Our pages load fonts from Google servers. Google Search Console reporting is used for site/search visibility. The current application does not load a Google Analytics 4 tracking tag, although GA4 appears in our setup records; a configured account is not the same as an active browser tag.
  • Editorial AI. Authorized editorial work can send reviewed independent reference URLs, titles and fact excerpts to the configured AI provider. The adapter supports OpenAI, Anthropic, Google, Kilo and compatible endpoints; this is not a statement that all are in use. Marketplace or unknown-provenance inputs are blocked in this workflow. Outputs and job records can be stored for editorial review. Account passwords and private buying briefs are not inputs to that workflow.

Although the application origin is in Australia, providers, their subprocessors and support systems may process information in the United States or other countries. Edge delivery may also occur near the visitor. We do not promise that all information stays in Australia or that every provider uses the same storage location or retention period. We may also disclose information where required by law or reasonably necessary to investigate abuse, protect the service or respond to a legal claim.

5. Cookies and browser connections

NextAuth uses cookies for the sign-in session, CSRF protection and sign-in callback handling. The configured session lifetime is up to 30 days; signing out clears the current application session cookie. Blocking required cookies can prevent sign-in. Clearing cookies does not delete your account or server-side records.

The error-recovery page uses sessionStorage for a last-reload timestamp to prevent repeated reloads. The buying-brief and temporary budget tools do not use localStorage for your notes. Browser and CDN caches may retain public page resources, fonts and images independently of our listing-response cache.

Loading Google Fonts and eBay images creates browser connections even if you do not click an external link. Those services can see network/browser information; listing images are requested with a no-referrer setting. We do not currently provide an on-site analytics-consent manager. This policy is not a consent control, and we do not treat viewing it or creating an account as newsletter consent.

6. Email and marketing

Requested sign-in links and supported account, billing or support communications are separate from marketing. Registration can trigger a welcome email. Marketplace deal alerts, digests and promotional email dispatch are currently paused. Saving a watchlist or an old frequency preference does not mean those messages are being delivered, or that you have joined a newsletter.

You can manage saved items in your account dashboard and contact the operator about unwanted messages. We are not claiming that an automated marketing opt-in, unsubscribe system or deletion-confirmation email is currently implemented. Any future marketing flow needs its own appropriate choices and controls before use.

7. Storage and retention

Current browsing cache: the current eBay discovery flow keeps bounded listing/search responses in process memory for at most one hour, with expiry and earlier withdrawal controls. It does not write those current responses into historical business tables. This limit applies to that cache, not every copy of marketplace information.

Legacy data: older database listing records, derived records and a small number of unapproved sourced images were present when this policy was drafted. Their approved active-store cleanup is staged separately from publication of this page and must be verified before we claim it is complete. Hiding a record from public view does not erase it. Older backups and Git copies need separate review. We do not claim that all sourced data expires after one hour or that a marketplace deletion notice guarantees removal from every copy.

Account and operational records: accounts, saved criteria, subscription references, email/audit records and editorial jobs can persist beyond a browsing session. There is not yet a finalized, automatically enforced retention schedule for every category. Legal, billing, dispute or security needs may require some records to remain after a request; provider logs, caches and any backup copies have separate lifecycles. We cannot promise immediate removal from every backup or third-party system.

eBay account-deletion notifications concern related marketplace data, not automatic deletion of an Old Oak account. Verified notices are recorded with a durable receipt and comparable source identifiers are suppressed; notices missing a comparable identity require manual review and pause source publication. Legacy identity coverage and any older copies still require separate review. Contact us if information about you appears in retained marketplace material or you need a status update on a request.

8. Your choices and requests

You can browse without registering, remove your own saved watchlists and remove saved buying briefs through the account interface. Existing subscription management is separate: use the available billing controls or contact us. A privacy request does not automatically cancel a subscription, trigger a refund or erase Stripe records.

To request access to information we hold about you, correction, account deletion or other privacy assistance, email [email protected]. Describe the request and, where possible, write from the account email address. Do not send your password, sign-in link or card details. We may ask for proportionate identity verification before releasing or changing account information.

Requests are handled manually. We will assess the information involved, applicable obligations and any necessary retention, and explain limitations or reasons if a request cannot be fully met. There is no self-service full-account deletion or automatic completion guarantee. Depending on your location and the laws that apply, you may also have rights to object to or restrict certain processing, receive a copy of information, withdraw consent where processing relies on it, or complain to a relevant privacy regulator. These rights can have conditions and exceptions.

Raise a privacy complaint with the operator at the same address. If unresolved, you can seek guidance from the Office of the Australian Information Commissioner or the privacy authority relevant to your location. This policy does not certify that a particular legal regime applies to every visitor or that the service has received regulatory approval.

9. Security and children

We use measures including HTTPS, password hashing, authenticated account access and restricted administrator controls. No internet service, email system or storage method can guarantee absolute security. Keep your password and sign-in links private, and report suspected account misuse to the operator.

Old Oak is not designed for children. We do not currently implement age verification or claim that an age restriction is automatically enforced. If you believe a child has provided personal information, contact us so the operator can review the circumstances and appropriate action.

10. Changes to this policy

We may update this page as the service and its data handling change, showing the revised date here. Where applicable, material changes may require additional notice or choices; publishing this policy does not activate new marketing, analytics, payment or data-erasure features.

Current product restrictions are summarized on Plans & Status. For privacy matters, the contact remains [email protected].