Privacy Policy
Operated by Scratch Labs. Last updated 13 October 2026.
This policy describes what OneDrop stores when you use the site or the browser extension. Scratch Labs is the operator. Questions go to support@onedropapp.com.
Account data
OneDrop stores your name, email, a password hash when you set a password, and the plan on the account. If you continue with Google or Apple, OneDrop keeps the verified email that service sends and links it to an existing account with the same email. A password reset email contains a link that expires in one hour. A session cookie keeps you signed in. Extension tokens are stored as a hash. The raw token is shown once when you create it.
Listings and photos
Listings include the text, price, and photos you upload. On the hosted app, photos are kept in private object storage and served only after OneDrop checks your session or a signed media link. Sold records can include the sold price, cost, fees, and shipping you enter.
eBay
If you connect eBay, OneDrop stores the refresh token, the environment (sandbox or production), and policy ids you save. Those are used to publish, revise, end, import, and check sold listings through eBay’s APIs. eBay receives the listing fields and photos required to create or update an offer. Optional eBay notification messages are applied only when they carry a signature OneDrop can verify or a token you configured. Unsigned notices are not used to change your inventory.
Chrome extension
The Chrome extension has one job. It takes a listing you already saved in OneDrop and fills it into a sell form you have open on Depop, Mercari, Vinted, Poshmark, Etsy, or Grailed, and it opens an item to remove for you to confirm. You press Post or Publish. The extension does not post, publish, buy, or browse the rest of the web for you.
Extension permissions
Storage keeps, on this browser only, the OneDrop address, the session token created when you sign in from the popup, and the listing you selected. Chrome sync is not used. Host access is limited to Depop, Mercari, Vinted (vinted.com and vinted.co.uk), Poshmark, Etsy, Grailed, and the OneDrop app. The public package may call https://onedropapp.com and https://quay-gamma.vercel.app. The extension needs that access to read the sell form you asked it to fill and to call your OneDrop account. It does not request browsing history, cookies, tabs, or access to every website.
What the extension sends to OneDrop
The email and password you type into the popup are sent once to create a token. The password is not stored in the extension. After that, the extension sends the listing id you select so OneDrop can return that listing’s fields and photos, and the task id when you confirm an item to remove. If you are already on a marketplace page whose visible text says the item sold, the extension may send that page address, title, and a slice of the visible text so OneDrop can match a listing. It does not send the page when the text does not look sold.
What the extension does not collect
It does not read or store marketplace passwords, payment cards, or messages. It does not keep a history of pages you visit. It does not sell personal information. Photos are downloaded from your OneDrop account into the browser so the sell form can attach them. That download is not a separate upload to a new server. A delete or mark-sold control is clicked only after you press the button in the OneDrop panel, and only when the control’s label is a remove action.
Processors
The hosted app uses Vercel for the site, Neon or another Postgres host for the database, and Vercel Blob for photos when that token is set. A draft helper, if you add a model key, sends photo bytes and your notes to that model provider and is instructed not to invent a price. Stripe bills the Pro subscription at $12 a month. OneDrop stores the Stripe customer id and the subscription status. Card numbers stay at Stripe. Canceling and updating the card happen in the Stripe customer portal. Google or Apple receives the sign-in request only if you choose that button. When password reset email is turned on, Resend receives the address and the reset link.
What Scratch Labs does not do
Scratch Labs does not sell your personal information. Inventory is not used to build a profile for unrelated advertising. Marketplace content stays in your account and in the calls needed to list an item or remove it from another site.
Retention
Listings stay until you archive or delete them, or until the account is removed. Disconnecting eBay drops the stored refresh token. You can ask Scratch Labs, at the contact above, to delete the account data the operator still holds.
The Terms of Service cover how the product may be used.