Privacy at a glance.

Effective August 22, 2026.

What WhyYes is for

WhyYes is decision support for live collectible auctions. It does not place bids, purchase items, operate auction controls. The auction extension does not access Whatnot credentials.

Information we handle

When you start watching, WhyYes may process the visible auction-page context, including item imagery, seller, room, listing title, and bid or sale information. It may process a short audio sample only for a low-confidence, user-initiated fallback. We also handle account and device identifiers, extension version, settings and opt-ins, usage and diagnostic events, collection/watchlist entries and notes, identity corrections, and the resulting card identity, valuation, recommendation, and auction-history records. For a settled lot, that record includes the outcome (won, lost, or unknown), whether it was detected automatically or confirmed or corrected by you, and the price observed when the lot closed. That price is what was seen live on stream at closing, not your final marketplace charge — fees and shipping are never visible to us.

Some information stays on your device and never reaches our servers: the extension keeps its device credential, your optional marketplace username, and any bring-your-own-key (BYOK) AI key in encrypted extension storage. Your marketplace username in particular is used only to work out, on-device, whether you won a given lot; the resulting outcome travels to your account, and the username never does. BYOK keys are provider-scoped and are not put in Chrome sync storage, telemetry, exports, learning data, or our usage receipts. We do not collect Whatnot passwords or other Whatnot credentials.

When you connect eBay, WhyYes receives authorization tokens from eBay and stores them encrypted on our servers. Your eBay password is not shared with WhyYes. With your selling consent, WhyYes sends original card photos to eBay and creates and publishes eligible listings using its card identification, market analysis, and pricing. Pausing or disconnecting stops future listing activity; it does not cancel listings already on eBay. Seller connection, listing, and operation records are not currently included in account export. If provider data is deleted, WhyYes retains the minimum physical record needed to prevent duplicate listing.

Why we use it

We use this information to provide decision support, maintain your account and device session, calculate and display valuations, keep your collection and watchlist, secure and troubleshoot the service, enforce limits, provide support, and produce the export or deletion functions you request. WhyYes does not place bids, purchase items, operate auction controls, or use information for advertising or sale of personal data.

Service providers and other recipients

WhyYes uses Cloudflare to host and operate the application backend and its storage, cache, and queue services. When enabled for a request, visible item evidence may be sent to CardSight for recognition. If you select a BYOK AI provider, the relevant request data and your key are sent only to the provider you selected: xAI or OpenAI. Ollama is a user-configured self-hosted or local endpoint; WhyYes does not provide or transmit a vendor key for it. If the service needs additional completed-sale evidence for a resolved card, it may send only canonical card facts, such as the player, year, set, and grade, to one or both of two configured market-data connectors, Apify and data11; neither receives frames, audio, transcripts, page or chat text, account or device identifiers, credentials, or raw provider payloads. Separately, when a graded card's certificate needs verification, WhyYes sends the grader (PSA, SGC, CGC, or BGS) and the certificate number to data11's certificate-lookup service; that request, too, never includes frames, audio, transcripts, page or chat text, account or device identifiers, or credentials.

These providers process information under their own terms and retention policies. BYOK retention is controlled by your provider account. We do not add advertising, analytics, or third-party scripts to this site.

Retention, deletion, and shared evidence

WhyYes is designed not to retain raw frames, audio, transcripts, chat text, BYOK keys, raw provider responses, raw connector payloads, or raw recordings in its service records. Account-associated settings, activity, valuation, collection, and usage records are retained until you delete your account or they are no longer needed for the disclosed service and security purposes. You can request an account export or deletion from the extension; account deletion removes account-linked records and local account cleanup removes the local vault values described above.

Where product terms permit shared learning, WhyYes reduces auction outcomes to bounded normalized market evidence, such as canonical card identity, confidence/exactness, sale price, source boundary, and expiry. It excludes raw media, transcripts, page/chat text, credentials, and direct account/device identifiers. Account deletion removes your contributions and recomputes affected learning domains; reusable normalized market evidence is expiry-bound. Training eligibility is disabled by default and any future learned influence requires a separate reviewed, versioned product contract.

Chrome Web Store Limited Use

WhyYes affirms that its use of Chrome user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use that data only to provide and improve the disclosed, user-facing decision-support feature and for security and support; we do not sell it, use it for advertising, or transfer it for unrelated purposes.

Your choices

You can stop using WhyYes at any time. For privacy questions or requests, contact privacy@whyyes.dev. For product or account help, contact support@whyyes.dev. To report a security issue, contact security@whyyes.dev.

Changes

We may update this policy as the product develops. The effective date above will change when we do.