How GavelOwl handles your data

Last updated: July 2026.

This policy covers the hosted service only

GavelOwl comes in two forms, and this distinction matters a lot for your data:

Self-hosted (the version most people use) runs entirely on your own computer or server. Your eBay credentials live in a file on your own hardware. We never see them, never store them, and have no server-side component in the picture at all. There is nothing for this policy to say about self-hosted, because there's no data collection to describe.
Hosted is a separate, no-install option: you connect your eBay account via eBay's own sign-in flow, and we run the service for you on shared infrastructure. That necessarily means we store some of your data to make the service work. Everything below describes exactly what, why, and for how long.

What hosted stores

Your Telegram chat ID

Used to identify your account and send you alerts. Not your phone number, username, or any other Telegram profile data.

Your eBay OAuth tokens

When you connect your eBay account, we store the resulting access and refresh tokens, encrypted at rest (AES-256-GCM). These let the service check your listings, messages, and sales, and place bids on your behalf when you schedule a snipe. We never see or store your eBay password - the connection happens entirely on eBay's own sign-in page.

Your settings

Search terms, marketplaces, allowed countries, and which features are enabled - the same things you configure by chatting with the bot.

Deduplication records and scheduled snipes

IDs of listings, messages, sales, and offers we've already alerted you on, so you don't get repeat alerts - and any bids you've scheduled via /snipe. We don't retain the full content of your eBay messages beyond what's needed to show you the alert.

Who else sees this data

Only the two services required to make the product work:

eBay, to read your listings/messages/sales and place bids on your behalf.
Telegram, to deliver your alerts and receive your commands.

We don't sell, rent, or share your data with anyone else. There's no advertising or analytics tracking on the hosted service.

How long we keep it, and how to delete it

Your data is kept for as long as your account is active. Deduplication records older than 30 days are pruned automatically. If you want your account and all associated data deleted - your eBay tokens, settings, and dedup history - message the bot or contact us using the details below, and we'll erase it.

Changes to this policy

If this policy changes in a way that affects what we collect or how we use it, we'll update the date at the top of this page.

Contact

Questions, deletion requests, or anything else about your data: privacy@gavelowl.com.