Privacy policy

Last updated: 17 September 2026

This policy explains what information App4Scrap collects, why we collect it, and how you can control it. We keep things proportionate: the minimum data needed to run a directory, accounts, optional paid listings and optional waste-receipt filing, processed lawfully under the UK GDPR and the Data Protection Act 2018.

Information we collect

• Account details — your name and email when you register. Passwords are stored only as salted hashes and are never recoverable. If you use Google Sign-In we receive the email and subject identifier Google provides so we can create or recognise your account.
• Profile content — reviews you write, favourites you save, price-alert subscriptions, and reply messages you post as a merchant.
• Listing content — if you register as a merchant, the business name, description, photos, opening hours, location pin and prices you publish on your yard’s profile.
• Billing — if you take a paid Yard or Waste Tracking plan we store PayPal subscription identifiers, plan, status and period dates so we can show or hide your listing and waste tools. We do not store your full card number.
• Waste receipts — if you use Waste Tracking we store the receipt details you enter (including carrier, producer name and address, EWC codes, weights and any hazardous flags) plus DEFRA’s tracking id and API responses, so you can prove what was filed.
• Location — your approximate location is used only when you search and only to sort results by distance. If you press “Locate”, the browser is asked for your position; it is sent to our search only at that moment and is not stored.
• Technical data — your IP address and the pages you request may be logged briefly for security, abuse prevention and rate limiting. Waste audit entries may also record IP and user agent. We do not build advertising profiles.

Local storage and cookies

• A session cookie keeps you signed in.
• Your theme choice (light/dark) is saved in your browser’s local storage.
• Your saved location may be cached in your browser so searches feel instant; it never leaves your device unless you search.

Services we share data with

• Google — maps and address suggestions use the Google Maps and Places APIs. If you choose “Continue with Google”, Google’s OAuth service authenticates you. Those uses fall under Google’s privacy policy.
• PayPal — paid subscriptions are created and billed by PayPal. PayPal processes your payment details under its own privacy policy. We send PayPal a merchant id so webhooks can update your entitlement.
• DEFRA Waste Tracking Service — when a merchant files a receipt we submit it to DEFRA’s waste-tracking API. DEFRA is a government controller for the statutory waste record. Copies we keep are described above.
• Market price providers — reference metal prices are fetched from third-party APIs. No personal data is sent to them.
• Email — transactional messages (password resets, price alerts, contact form replies) are sent through our mail server at mail.app4scrap.app.

We do not sell your data, and it is never shared with anyone for advertising purposes.

How long we keep it

Account data is kept while your account is active. If you delete your account from account settings, we remove your login, listing, reviews, favourites, alerts and our copies of waste receipts, subject to any short security logs and PayPal’s own billing records. Receipts already accepted by DEFRA remain with DEFRA. An active PayPal subscription is cancelled when we can; otherwise cancel it in PayPal.

Your rights

Under UK GDPR you have the right to access, correct, port, restrict or delete your personal data, and to object to processing. You can update or delete your account from account settings, or contact us to exercise any other right.

Contact

Privacy questions: hello@app4scrap.app, or use the contact form.