Privacy policy

Last updated 23 September 2026. There is not much to say, which is the point.

Who we are

SleeperLot is run by Luke Jones, an individual in Kentucky, United States. He is the person responsible for the data described below — there is no company behind this and no one else has access. Questions, corrections, and deletion requests all go to the support form or, if you prefer plain email, support@sleeperlot.com.

What we collect

• Email you send us. If you write to us, or use the support form, we store the address you wrote from, the time, and what you wrote. That is the whole record.
• Server logs. Our hosting provider (Cloudflare) records standard request logs, including IP address, user agent, and requested URL, for security and operations. These are held briefly and not used to build profiles.
• Account email and password. Signing up or signing in at sign-up / sign-in stores your email, the time you signed up, and the IP address and browser the request came from — used to confirm your email and to rate-limit abuse. We store a bcrypt hash of your password, never the password itself. Signing up requires one; at sign-in you can leave the field blank instead and we email you a one-time link. A successful sign-in sets one cookie, a random session token, read only by this domain's account server and cleared on sign-out, after 14 days idle, or 30 days regardless of use. Ask for deletion any time on the support form.
• Account settings, if you choose to add them. On the account page you can optionally add a ZIP/postal code (never a street address) so a future shipping-cost estimate can be banded to your region, and a timezone so alerts and digests land at a sane local hour. Both are blank until you set them, used for nothing else, and visible only to you.
• Your wishlist, if you add one. Up to two short phrases for things you’re after, saved with your account so we can tell you when one is for sale. Delete them from the account page any time.
• Notification channels, if you choose to add them. On the account page or during setup you can connect Discord (a webhook URL or, via Discord's own sign-in, your Discord account ID so our bot can message you directly) or enable push notifications on this device (your browser's own subscription details — not your location or IP). Whichever of these you connect is encrypted at rest with a key the database itself cannot read, used only to deliver the alerts you asked for, and removable any time from the account page. Signing in on a second device can show a QR code that carries a single-use, three-minute sign-in token — nothing else — so you can finish enabling push there; the code expires whether or not you scan it.
• Who invited you, if someone did. An invite link (sleeperlot.com/r/…) puts that code in a cookie on your browser for 90 days and, if you go on to create an account, records which account invited you. That link is the whole record: we do not learn who sent it to you, where you saw it, or anything about the visit itself. The person who invited you is told how many people accepted — a number, never your address or name. You can delete the code from the box on the signup form before you sign up, and then nothing is recorded at all.
• Almost nothing else. Every asset a page loads — stylesheets, scripts, typefaces — is served from this domain, with one exception, and reading the site contacts no third party. The exception is the checkout page, which loads Stripe’s own card form directly from Stripe. That has to come from Stripe rather than from us — it is what keeps the card number off our servers — and it means that on that one page, and only that page, your browser talks to Stripe and Stripe sees the request, including your IP address, and sets its own fraud-prevention cookies under its own policy. The other exception is Discord, and only if you choose to connect it.

What we do not collect

No plaintext passwords — only a bcrypt hash, and only if you choose to set one (see above). No card numbers: card details are typed into Stripe’s own form and go straight to Stripe. A card number never reaches our servers, and we could not produce one if you asked us to. What we hold against your account is Stripe’s customer reference, so we know what you are subscribed to, and nothing more of the card than that.

No advertising trackers and no analytics scripts. None of our own cookies is used to track you across the web, and there are only ever four of them. Two are ordinary: a session token once you sign in, and — only if you arrived through an invite link — the referral code described above, which is deleted if you clear the box on the signup form. The other two exist for a few minutes at most: connecting Discord sets a one-time value used to check that the account coming back from Discord is the one that left, plus the page to return you to afterwards. Both are scoped to the Discord connection step and expire on their own. The site does not use local storage to identify you. Stripe sets its own cookies on the checkout page, described above, which are Stripe’s rather than ours. If any of that changes, this page changes first.

The browser extension

The SleeperLot price check extension for Chrome needs no account and has no sign-in. It downloads our price list once a day and works out the price of the eBay listing you are looking at on your own computer. The listing, its title, its price and the address of the page are not sent to us to do that. It runs only on eBay pages. It never reads checkout, order or account pages, and it never reads any other site.

Three things do reach our server, and each one is sent only when you use it:

• Cheaper listings. When the extension recognises the product, it asks us for cheaper listings of it. It sends the product’s eBay catalogue number and the price to beat. We do not store the request, and the answer is not saved on your computer.
• Your wishlist phrases. If you type up to two things you’re after into the extension’s settings, it sends those words when you open eBay, at most once every half hour, so we can tell you if one is for sale. The phrases are saved on your computer. We do not store them.
• Nothing else, unless you switch it on. The welcome page that opens when you install the extension has two options, and both are off until you tick them:

• Share the products I look at. For each eBay listing you open, we get which product it is (its eBay catalogue number, or its brand and model) and its eBay category. We never get the listing, its price or its title. These are sent in batches a few times a day. Each one carries a code made from the product and a random number that never leaves your computer. That lets us count how many different people looked at a product, but we can’t link one product you looked at to another or to you. We use this to decide which products to price next.
• Ask me whether I bought things I checked. The extension remembers the listings you checked on your computer for 14 days, then asks once whether you bought one. If you save an answer, we get the product, the price you paid, the day, whether it was an auction or a fixed price, and the item’s condition or grade. We never get the listing or who you are. We use it only to check our prices against what people actually paid.

Switching an option off throws away anything waiting to be sent. What we already received has no name, account or listing attached, so we keep it, and we couldn’t pick your reports out of it even if you asked. Uninstalling the extension deletes everything it saved on your computer. None of this is sold or shared. Like every request to this site, these ones pass through Cloudflare, whose short-lived logs are described above. We do not keep the address a request came from with anything the extension sends.

Why we hold the email

To run your account and deliver what you asked for: the link that signs you in, the alerts you subscribed to, and anything about a payment. That is the service, and it does not depend on a marketing consent.

Announcements are separate and opt-in. We only email you about new features and plans if you ticked that box when you signed up — it is its own unticked checkbox, never bundled into agreeing to the terms, and we record when you ticked it. Untick or withdraw it at any time and the announcements stop while your account carries on as normal.

We do not sell, rent, or share addresses. You can withdraw yours at any time through the support form, by emailing support@sleeperlot.com, or using the unsubscribe link in any message we send. We delete the address on request and, in any case, within twelve months of the last message we send you if you have not signed up for anything.

Marketplace data is not about you

The auction data behind our estimates is public listing information. It describes items, not people. We never store seller identities, buyer identities, or bidder histories, and we discard individual listing records once they are no longer publicly available on their source, keeping only aggregate statistics.

One thing does outlive the listing, and it is ours rather than the marketplace’s: the record of a prediction we made. It holds the marketplace’s item number, the numbers we published, and which version of the model produced them — no title, no image, no description, no price from the listing, nothing about a seller. It exists so that a prediction cannot be quietly revised after the outcome is known, which is the whole basis of the track record.

Where data lives

The site itself, and the waitlist address if you joined one, sit with Cloudflare, whose edge network is global, so a record may be handled outside the United States. Everything tied to an account — your email, your settings, your delivery channels, and anything you send us through the support form — lives in the database on our servers at Hetzner, in Germany, alongside the collection and analysis that produce the estimates. Email is sent through Zoho. Payments go through Stripe, who hold the card details you give them and their own record of what you paid. We are based in the United States, so your data may be processed here as well as in Germany.

How long we keep it

Account data stays while the account does. Ask us to delete it and it goes, along with your settings, your delivery channels and your alert history — we do not keep a shadow copy. A waitlist address you never turned into an account is deleted on request and, in any case, within twelve months of the last message we send you. Sign-in sessions expire on their own: 14 days after you last used one, and 30 days after it was issued whatever you do. Sign-in links and the code for connecting a second device are single-use and expire in minutes. Server logs at our host are short-lived and are not used to build profiles.

Marketplace data runs on its own clock, set by the eBay licence rather than by us: an individual listing record is discarded once the listing is no longer publicly available, and the item link inside a past alert is stripped on the same schedule. What survives is aggregate statistics and the record of predictions described above.

Keeping it safe

Everything travels over an encrypted connection. A password, if you set one, is stored only as a bcrypt hash — we could not tell you what your password is, and neither could anyone who took the database. A connected Discord webhook or account id is encrypted before it is written, with a key held outside the database, so the database on its own does not reveal where your alerts go. One person operates this and no one else has access to the systems or the data.

That said: no one can promise a system is impossible to break into, and a policy that said otherwise would be worth nothing. If data about you is exposed in a way that could actually harm you, we will tell you by email — promptly, with what happened and what to do about it, rather than a notice months later written to say as little as possible.

Children

This is not a service for children. You need to be at least 13 to have an account, and if you are under 18 a parent or guardian has to agree to the terms for you. We do not knowingly collect anything from a child under 13; if we discover we have, we delete it. If you are a parent and think your child has signed up, write to support@sleeperlot.com and we will remove the account and its data.

Your rights

You can ask what we hold about you, ask us to correct or delete it, or object to its use. Ask on the support form and you get a reference by email straight away, so you can see the request landed; plain email to support@sleeperlot.com works just as well. We answer within thirty days. We honour these requests from everyone who asks, wherever you live, rather than only where a law compels it.

Changes

We will update the date above whenever this policy changes materially. If a change means we start doing something with your data that this version does not allow — a new recipient, a new purpose — we will email account holders before it takes effect rather than quietly reposting the page.