Privacy & account data

Updated 12 October 2026. This page describes the current login and waitlist implementation, not future planned features.

Who runs this site

Bazaro is operated by Mohammed Masthan. For privacy and account questions, contact hello@bazaro.space.

What Google login shares

If you choose Google login, we request only basic account identity: your Google account identifier, name, verified email address and profile image information. We do not request access to Gmail, your contacts, files, calendar, payment details or your Google password.

How we use and store it

We use your verified identity to sign you in and show your account email. Your session is kept in an encrypted, HttpOnly cookie, with a maximum lifetime of seven days. Our current session response does not expose Google access or refresh tokens. Your Google profile image is not displayed by the current account page.

There is no persistent customer account database, personal wishlist, personalized search history or customer price-drop alert service in this version. Signing in does not activate AI MAX or a paid membership.

Services that process data

Google handles authentication. Vercel hosts the application and may process technical request data, such as IP addresses, timestamps and error logs, under its own service policies. Login information is not sent to the product-launch parser or an AI model. Upstash stores catalog and price records; Google login identity is not stored there. If you join the AI MAX waitlist, Upstash stores the email you enter, signup time and launch-update consent version separately from catalog records.

AI MAX launch waitlist

The live waitlist collects only the email you enter, signup time and your agreement to one AI MAX launch email. Joining does not activate AI features, membership or payment. No launch date or benefits are promised, and the address is not used for other marketing.

Waitlist entries expire after six months unless removed sooner. To withdraw consent or request deletion, contact hello@bazaro.space from the signup address. We will remove the waitlist record after confirming the request. Automated unsubscribe and launch-email sending are not enabled yet.

To limit spam, the server briefly stores a keyed, non-readable hash of the request IP address with an attempt count, deleted within two hours. The raw IP is not stored in the waitlist database; hosting logs may process it separately.

Cookies, logs and external links

Authentication uses session and security cookies to keep you signed in and protect the login flow. We have not enabled visitor click analytics in this version. Retailer and other external links take you to separate services with their own privacy policies. Some outbound links may earn a commission; commission does not change price ranking.

Your choices

You can browse the catalog without signing in. Sign out to clear the current browser's login session. You can remove Bazaro's Google access in your Google account's connected-app settings. For account or data questions, email hello@bazaro.space. There is no dedicated customer record database to delete in this version; technical logs may remain subject to the hosting provider's retention rules.

Changes

If we add persistent profiles, wishlists, personalized alerts, analytics or a new use of account data, we will update this notice before enabling them. We will request any new permission needed for those features.