Privacy Policy

Qualit.ly (“Qualit.ly”, “we”, “us”) is a free QC photo database, Discord link converter and parcel-tracking tool for the rep finds community, available at qualit.ly, through our Discord bot, and via our public REST API.

Qualit.ly is operated by an individual (sole trader) based in the United Kingdom. For the purposes of the UK GDPR and the Data Protection Act 2018, we are the “data controller” for the personal data described in this policy. You can contact us about anything in this policy at [email protected].

You can browse QC photos, use the link converter and look up parcel tracking without an account. We collect more only when you create an account or use features that need it.

Account & profile

• Username, email address and a password (which we store only as a secure hash, never in plain text).
• If you sign in with Discord: your Discord account ID, username, avatar and the email address on your Discord account, received through Discord OAuth.
• Profile and preference settings: display name, profile visibility (public or private), preferred currency, preferred shopping agent, language, and your notification choices (e.g. security alerts, price alerts, weekly summary, marketing emails).
• Your account tier (Basic, Early Adopter, Pro, Pro+ or Custom).

Things you create or save

• Favourites, shopping lists / hauls, and parcel tracking numbers you enter.
• Messages you send us (e.g. support or upgrade emails to [email protected]).

Developer API

• API keys you generate (stored hashed), the names you give them, and any IP allow-list you set.
• The IP addresses and timestamps recorded when an API key is used, so you and we can monitor usage and abuse.

Technical & security data

• Your IP address, browser/user-agent and basic request metadata, used to operate the service, apply rate limits, prevent abuse and enforce IP bans.
• Cloudflare Turnstile challenge results, used to tell humans from bots at sign-up and on sensitive actions.
• Transactional email logs (which type of email was sent to which address, and its delivery status).

We do not ask for or store payment-card details (see our Terms for how paid plans work).

We use Discord in two ways, and we handle Discord data in line with Discord's Developer Terms of Service and Developer Policy.

Signing in with Discord

If you choose “Continue with Discord”, we receive your Discord ID, username, avatar and email to create or sign you into your Qualit.ly account. The sign-in also requests the “guilds” scope (your list of Discord servers), which we use to power the link-converter dashboard so you can manage the servers you administer.

The Qualit.ly bot

• When the bot is added to a Discord server, we store the server (guild) ID, name, icon and the settings a server admin configures, plus aggregate counts such as how many links it converted, so the bot and your dashboard work.
• The bot reads a message only to detect a supported marketplace link (Taobao, Weidian, 1688) and reply with converted agent links. We do not store the content of your Discord messages.
• We never use Discord data for advertising and we never sell it.
• If the bot is removed from a server, we delete that server's configuration. To request deletion of Discord-related data, remove the bot or email [email protected].

• To provide and operate the website, the Discord bot, the API and parcel tracking, and to manage your account and tier.
• To send service emails: email verification, password resets and security alerts.
• To detect your local currency (your browser contacts a geo-IP service to suggest a currency; see “Who we share data with”).
• To keep the service secure: rate-limiting, abuse and fraud prevention, and IP bans.
• To respond to your messages and support requests.
• To send marketing or summary emails only where you have opted in, and you can opt out at any time in Settings or via the unsubscribe link.
• To comply with our legal obligations and enforce our Terms.

• Performance of a contract: running your account, the bot and the API, and providing the features you ask for.
• Legitimate interests: keeping the service secure, preventing abuse and fraud, localising currency, and operating and improving Qualit.ly. We balance these against your rights.
• Consent: marketing/summary emails and any future analytics or non-essential cookies. You can withdraw consent at any time.
• Legal obligation: where we must keep or disclose data to comply with the law.

Today, Qualit.ly only uses strictly-necessary cookies and your browser's local storage. We do not use advertising or third-party analytics cookies.

• qualityly_session: a secure, HttpOnly cookie that keeps you signed in.
• csrf_token: protects against cross-site request forgery on actions you take while signed in.
• Local storage: used to cache your profile, settings, recent searches/views, a cookie-notice acknowledgement and product-title translations, so the site is faster. You can clear this any time in Settings or your browser.

Because these are essential to the service, they don't require consent under UK law. The cookie notice is a heads-up, not an opt-in. If we ever add analytics or marketing trackers, we will ask for your consent first and update this policy.

We don't sell your personal data. We host Qualit.ly on our own infrastructure (located in the United States) and send our emails from our own mail server, so those aren't third parties. Beyond that, we share data only with the providers and parties needed to run the service:

• Cloudflare: content delivery, DDoS/WAF protection, the Turnstile bot check, and image hosting (cdn.qualit.ly). Cloudflare processes traffic metadata including IP addresses.
• Discord: for “Continue with Discord” sign-in and to operate the bot. Your use of Discord is also governed by Discord's own privacy policy.
• MyMemory (Translated S.r.l.): machine translation of Chinese product titles into English. It receives product text only, not your identity.
• Geo-IP providers (ipapi.co, ipwho.is, freeipapi.com): your browser contacts one of these directly to detect your currency, so it receives your IP address. This only happens until you set a currency manually.
• Parcel carriers & tracking networks: when you look up a parcel, the tracking number you enter is sent to the relevant carrier or postal/tracking network to retrieve delivery status.
• Authorities or advisors: where we're legally required to disclose data, or to establish, exercise or defend legal claims.

When you click through to a marketplace (Taobao, Weidian, 1688) or shopping agent (CNFans, BBDBuy, ACBuy, KAKOBuy, Sugargoo and others), you leave Qualit.ly and interact with that third party under their own terms and privacy policies. We are not a seller and we don't share your account data with them.

Qualit.ly is operated from the United Kingdom, but our own servers and mail server are located in the United States, and some of our providers (such as Cloudflare, Discord and the geo-IP services) also operate outside the UK. This means your personal data is transferred to and stored in the United States. Where personal data leaves the UK, we rely on appropriate safeguards, such as the UK's adequacy regulations, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses with the UK Addendum.

• Account data: kept while your account is active. When you delete your account, we delete or anonymise your personal data, except anything we must keep by law or to resolve disputes.
• Security & IP logs: kept only as long as needed to prevent abuse, typically up to 12 months (IP bans may persist longer where needed to stop ongoing abuse).
• Discord server configuration: deleted when the bot is removed from the server.
• Email logs: kept for a limited period for deliverability and support.
• Backups: residual copies may persist in backups for a short period before being overwritten.

Under the UK GDPR you have the right to:

• access a copy of your personal data;
• correct inaccurate data;
• delete your data (“right to be forgotten”);
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time (e.g. for marketing emails).

You can exercise many of these directly in Settings, including exporting your data and deleting your account, or by emailing [email protected]. We aim to respond within one month.

If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to address it first.

We protect your data with measures including: passwords stored as secure hashes (never in plain text), HttpOnly session cookies, CSRF protection, Cloudflare Turnstile and WAF, and encryption in transit (HTTPS). No online service can be 100% secure, but we work to protect your information and to respond quickly if something goes wrong.

Qualit.ly and the Qualit.ly bot are not intended for anyone under 13, which is also Discord's minimum age. If you are under 13, please do not use the service or create an account. If we learn that we hold personal data from a child under 13, we will delete it. If you believe a child has given us their data, contact [email protected].

Qualit.ly links to and indexes content from third-party marketplaces, shopping agents and the community. We don't control those sites and aren't responsible for their content or privacy practices. QC photos are publicly-shared images; if you own rights to an image and want it removed, see the takedown section of our Terms.

We may update this policy as the service evolves or the law changes. We'll update the “Last updated” date above and, for material changes, give notice on the site or by email. Continuing to use Qualit.ly after a change means you accept the updated policy.

Questions, requests or complaints about privacy? Email [email protected]and we'll get back to you. You can also reach us through the channels on our contact page.