Privacy

Last updated 2026-10-08.

What we store about you

• Your email address and name, from the account you sign in with.
• The searches you save — the URL and the name you give them.
• The listings those searches turn up: title, price, location, when it was listed, the listing link and its picture. This is what your alerts are made of, and it is your Finds: every listing a search has ever shown you stays searchable in your dashboard, with a copy of the listing's thumbnail that we store ourselves so it does not disappear when the marketplace's own link expires.
• A random id for each browser extension you connect, and when it last checked in — so your dashboard can tell you when an extension has gone quiet, and, only if you turn on Email me if my searches stop running in your settings, so we can email you once when none has checked in for two days while you have active searches. It is off unless you turn it on.
• Which of your connected extensions sent each listing, and which version of Dibs it was running — so when a listing is read wrong we can tell a bug in one version from a change on the marketplace, and fix the right one.
• Which hours each search checked in, and when you paused and resumed it, kept for three days — so your dashboard can tell you how much of the last day a search was actually watched, without counting time you had it paused.
• Each check a search makes: when, how many listings it saw, how many were new and how many of those we alerted you to, or that the page was blocked or the check failed, and which version of Dibs made it — kept for three days, so your dashboard can show what each search actually checked.
• How you first found us: the site that sent you to dibs.deals (its name, never the page you were on), any campaign tags in that link, the page you landed on, and when. Your browser keeps this in a cookie for 90 days from your first visit, and we copy it to your account if you sign up — so we know which places people find Dibs from.
• Which of our emails you came from, when you open a link in one: the kind of email (an alert digest, a reminder) and when, kept in a cookie for a day — so we know which emails are useful and which bring people back only to turn them off.
• Whether you signed up on a phone or a computer, and when your account was first used on a computer — the extension runs on a computer, so this is how we know whether getting there is where people get stuck. If you open the install link we email you, we note that it was opened and on what kind of device.
• If you answer the question on the page that opens when you remove the extension: the reason you picked and whatever you type in the box, saved as you type — even if you never press Done — kept with that install and deleted with your account.
• If you answer “This is right” when we ask where OfferUp is searching: that you answered, and when, so we do not ask again.
• When you subscribe, billing is held by Stripe. We never see your card number.

What we never collect

The extension runs in your own browser, signed in as you — and that stays in your browser. It does not send your marketplace password, your messages, your profile, or your browsing. It reads one thing: the listing results on the marketplace search pages your searches open, and it sends only the listing fields above.

Your own location. Beyond the area a saved search already names, we keep no ZIP code, town, point or distance for you. Where OfferUp searches is OfferUp's own setting, kept by OfferUp in your browser.

One switch widens that, and it is off until you turn it on: Mark listings on the pagein the extension's side panel. With it on, when you open a Facebook Marketplace, Craigslist or OfferUp page yourself, the extension sends the ids of the listings on your screen to dibs.deals to ask which ones your searches have already found — and, on a search page, the page's address and each listing's title, price and posted time, so it can tell you which new ones match. The answer draws the marks and nothing from the question is kept: it is not stored, not added to your Finds, and not in our logs. Turn the switch off and none of it is sent.

Why the extension asks for access to all sites

Chrome shows a broad permission when you install Dibs, and it is fair to ask why an alerts tool wants it. Which marketplaces Dibs supports is configuration we serve from dibs.deals, not a list baked into the extension — that is how a new marketplace can be added without waiting weeks for a store review, and how a broken site can be fixed the same day. For the extension to be able to read a marketplace we add after you installed it, Chrome requires it to hold that access up front.

What it does with it is narrower than what it is allowed to do. Dibs registers its reader only for the marketplaces it supports — today Facebook Marketplace, Craigslist and OfferUp — and only reads the search pages you chose to watch, plus, if you turn on the marks described above, the listings on those marketplaces' pages you open yourself. It does not read, store or send anything from any other site you visit, and no page content leaves your browser except the listing fields listed above, which go to your own Dibs account.

If you would rather not grant it, Chrome lets you restrict any extension to specific sites from chrome://extensions. Dibs notices what it has been granted and reads only that.

Where your data goes

• Our servers, to store your searches and listings and to build your alerts.
• The channels you turn on for delivery — notifications on your computer or phone, email, Telegram, Discord, or a webhook of your own if you connect one. Alerts go only where you point them.

Our servers run on other companies' infrastructure, and a few services see a slice of your data to do their job. This is the whole list:

• Amazon Web Services — our servers, database, encrypted backups and stored listing pictures, in the United States, and the email we send you.
• Cloudflare — fronts every request to dibs.deals and sees your IP address at its edge under its own policy. When you ask us to email you a sign-in link, its Turnstile check looks at your browser and IP address to tell a person from a script.
• Stripe — payments and invoices, if you pay us.
• Mixpanel — product analytics keyed to an internal id, never your email address.
• Sentry — error reports from the website, the extension and our servers, with cookies, request bodies and addresses stripped before they leave. When a search's page is slow to load, the extension's report says what state its own background tab was in, whether that browser window was minimized or in front, and whether the computer was in use, idle or locked — never a page address or anything on the page.
• Better Stack — our server logs, held for three days, which do not carry email addresses; and the uptime checks on our endpoints.
• Google or Meta — only if you sign in with them; we receive your name and email address from their consent screen and nothing else.
• Telegram — only if you turn on the Telegram channel; it holds your chat id and the alerts we send there.
• Discord — only if you connect a Discord channel; it receives the alerts we post to the webhook you gave us, and holds them under its own policy.
• Your browser's or phone's push service — only if you turn on notifications, in the extension or on your phone. Chrome delivers them through Google's (Firebase Cloud Messaging), Firefox through Mozilla's, and an iPhone or iPad through Apple's (Apple Push Notification service). Each alert is encrypted before it leaves us, so the push service can see that your device was sent a message but cannot read it.
• Anthropic — only if you use the search assistant; it receives the sentence you type and, when you are refining a search, that search's own description and rules. Never your name, your email address, or anyone's listings.

We do not sell your data, share it with advertisers, or use it to train anything.

We sometimes publish figures measured across all searches, such as how long Facebook Marketplace takes to show a new listing. They are counts and times only: never a search, a listing, a place or anything that points to you.

Retention

Listings and their pictures are kept for as long as your account exists, including after you delete the search that found them — keeping them is part of the product. Deleting your account from the dashboard removes your account, searches, every listing and stored picture, alert channels and connected extensions immediately. Four things outlast that, and this is all of them: our encrypted database backups, which age out within 30 days and are only ever restored to recover the whole service, never to bring one account back; if an address of yours ever bounced our mail or reported it as spam, a one-way keyed hash of that address stays on our do-not-mail list so we never send to it again, and our email provider (Amazon SES) keeps its own bounce and complaint record of the address; for at most a day, a one-way keyed hash of each address we sent a sign-in email to, which is how we hold any one address to ten such emails a day; and records we are required to keep for tax purposes.

One security record of the closure is kept for twelve months: the account id, how many pictures were removed, and a one-way keyed hash of your email address, so that we can answer you if you later ask whether the account was really closed. Your address itself is not in it and the hash cannot be turned back into one. Beside it, a summary of the account in counts, kept as long: its plan and age, whether you signed up on a phone or a computer, how many extensions, searches, listings and alerts it had, which kinds of alert channel were on, how you first found us, which of our emails you came from, and the reason you picked, if you picked one — never your searches, your listings or anything you wrote. The same kind of record is written when an email address of yours stops accepting our mail, so that we can tell you why the alerts stopped.

Getting your data or deleting it

Delete your account from the settings page of your dashboard — it takes effect at once. For an export, or to delete a specific listing or picture, email support@dibs.deals. There is no form to fill in.

Your rights

You can see, correct, export or delete what we hold about you. Email support@dibs.deals from your account address and we do it. If you are in the EU, UK or California, those laws give you these rights by name; we honour them for everyone.

Changes

We update this page when what we do changes. A change that matters — a new processor, a new kind of data — is emailed to account owners before it takes effect.