Privacy Policy

Overview

This Privacy Policy explains how GSA Auction Finder handles information. The app is an independent auction-discovery tool, not affiliated with, endorsed by, or operated by the U.S. General Services Administration or the United States Government. For support or privacy questions, contact restartapplication@gmail.com.

1. Listings, searches, and network requests

Our Firebase-hosted service retrieves public auction listings from GSA's API on a schedule and publishes shared JSON snapshots. The app downloads those snapshots without sending search text, saved ZIP codes, notes, or account identifiers. Google Cloud/Firebase receive normal network information, including IP addresses and requested feed paths, and retain operational request logs to operate, secure, and diagnose the service. The project's default Cloud Logging bucket retains ordinary logs for 30 days; the provider-required audit-log bucket retains required audit records for 400 days. These periods do not describe advertising, authentication, Analytics, or Crashlytics retention. These requests are needed to provide auction data and are separate from optional usage analytics.

The app obtains photos, descriptions, bidding information, documents, and other details directly from GSA website services and their hosting providers, including Amazon S3. These providers receive normal network information such as your IP address and requests identifying the listings or files you open. Prefetching and refreshing may request content before you open it.

Search and filter matching use downloaded listings on your device. In guest mode, saved searches and personal notes remain only in local app storage. If you sign in, the account synchronization described below stores the saved search criteria and notes in Cloud Firestore. Agency profiles and comparisons are informational features, not government endorsements.

2. Information stored on your device

Saved listings, personal notes, saved searches, saved ZIP locations, filters, notification preferences, alert history and matching baselines, onboarding state, theme settings, and cached subscription verification are stored locally. Auction information and images may be cached to improve loading and offline browsing. Guest-mode data remains local unless you later sign in and import the supported account-library fields described below.

Recently Viewed retains up to ten listings on your device. Comparison selections are temporary browsing state; the operating system may retain small snapshots to restore the screen. We do not send personal notes or a Recently Viewed or comparison history list as analytics events. Opening these listings still makes the network requests described above.

Sign-in is optional: Google is available on Android and iOS, and Apple on iOS. You can use the app as a guest without creating an account. When you sign in, Google/Apple and Firebase Authentication process your provider identity, name and email if supplied (including Apple's private relay email), account identifiers, authentication credentials, and normal network/device information to create and secure your account. Firebase stores the account profile until deletion. The app displays your profile in Settings and the SDKs keep a protected sign-in session on the device. We do not send names, email addresses, authentication tokens, or account IDs as Analytics events or Crashlytics user identifiers.

When you sign in, Cloud Firestore synchronizes your saved listings and notes; saved searches, including their keyword, filters, sort, location ZIP and alert settings; saved ZIP locations; alert seen-item baselines; selected location; theme; and daily-digest time. Saved auction records contain a reduced snapshot of public listing information needed to display the saved item, not the complete source response. The Firestore document is keyed to your Firebase user ID, protected by rules that allow only that authenticated user, and transmitted using HTTPS. Google processes the stored content, user identifier, timestamps, and normal service/network metadata to provide and secure synchronization.

Recently Viewed, comparison selections, unsaved current search input, notification permission, analytics/crash-report choices, ad-consent state, purchase records, and Pro entitlements do not synchronize through the account. Store purchases remain tied to the Apple or Google store account. Signing out removes the account-linked library from that device but does not delete its Firestore copy; signing in again restores it. Account deletion removes the Firestore library and Firebase Authentication account as described in Section 9. Cloud Messaging is not used for library synchronization or alerts.

3. Location and maps

When you choose a current-location feature and grant permission, the app uses device location to find an approximate ZIP-area location and nearby listings. It does not collect your location continuously in the background. You can enter a ZIP code instead and revoke location permission in system settings.

Listing maps use Google Maps on Android and Apple MapKit on iOS. Public property addresses are sent to the platform geocoding service to estimate a pin, and map providers receive requests for surrounding map areas. These providers may process IP addresses, device information, usage, and diagnostics under their own policies. The listing-map preview does not enable a user-location layer. Opening a listing in an external maps app passes its address; that app separately controls any use of your location.

4. Advertising and privacy choices

The free app uses Google AdMob for banner, native, and app-open advertisements. Native advertisements are identified as ads. Google and its advertising partners may process IP addresses, approximate location derived from IP, advertising or other app/device identifiers where permitted, device and operating-system details, ad views and interactions, and diagnostic information to deliver and measure ads, prevent fraud, and improve their services.

Google's User Messaging Platform handles applicable advertising privacy messages and consent choices. Available choices depend on your region, device settings, and the configured consent message. You can revisit available choices in Settings under Ad Privacy. Non-personalized or limited ads can still involve data processing; they are not the same as no data collection.

On iOS, Google's User Messaging Platform can present an explanation and Apple's App Tracking Transparency permission request for advertising when required by the configured message and device status, after onboarding and your usage/diagnostics choice. You can decline tracking without losing app features or Pro access. The operating system controls whether the prompt may appear, and you can review permission in iOS Settings. Tracking consent is separate from optional usage analytics. Advertising SDKs may still process information needed for contextual or limited ads when tracking is not allowed.

Pro removes advertisements, but does not disable analytics, crash reporting, listing requests, maps, or store services. We do not request advertising tracking just to use Pro or optional product analytics. Locally stored launch counts and presentation timestamps help control app-open ad frequency.

5. Analytics and crash reporting

The app uses Google Analytics for Firebase and Firebase Crashlytics when Firebase is configured and you enable the corresponding option. Analytics can collect app-instance identifiers, device and app details, app/session usage events, and approximate geographic information derived from network information.

Our custom events measure onboarding completion, searches using filter-count and result-size ranges, listing opens using category and status only, saves, comparison opens using a listing-count range, alert creation and update-screen opens, plan-page views and selections, subscription attempts with a limited result such as success or cancellation, feed refreshes using count ranges, and background alert checks using a limited outcome. These app-defined events do not include search text, ZIP codes, coordinates, auction IDs or titles, notes, URLs, transaction identifiers, or API keys. We do not set an Analytics user ID or grant Analytics advertising consent, and disable Analytics advertising-identifier collection and ad-personalization signals. Firebase Analytics can also collect automatic app lifecycle, in-app purchase, and subscription events, including store product identifiers, product names, and prices when supported by the SDK. These are distinct from our restricted custom event fields. Our Analytics property uses two-month user/event retention with reset-on-activity disabled; this limit does not apply to most aggregated reports. Advertising processing by AdMob is separate.

Crashlytics processes crash reports, stack traces, installation identifiers, device and operating-system details, and diagnostic information to help investigate faults. We do not intentionally include exact device coordinates, API keys, personal notes, raw search text, contact details from listings, or complete listing descriptions in custom telemetry.

Usage Analytics and Crash Reports are separate optional controls. A privacy-choice dialog appears after onboarding, and for existing installations without a recorded choice, with both controls preselected. Collection does not begin unless you save those choices. You can turn either option off before saving or later in Settings → Privacy & Legal. The choices are stored on your device and apply independently of Free or Pro access and advertising privacy choices.

With analytics off, the app disables Analytics collection and resets locally stored Analytics data; activity while disabled is not recorded as custom events for later upload. With crash reporting off, the app skips custom non-fatal reports, requests deletion of unsent reports, and sets automatic Crashlytics uploads to disabled; the SDK's opt-out fully applies on the next app launch. The crash SDK may still store crash information locally while uploads are disabled; enabling reporting permits uploads of locally available reports. Turning either control off does not delete information already sent. Provider processing and retention depend on the service and its settings; contact us for privacy questions or requests.

6. Alerts and calendar reminders

Free and Pro alerts are evaluated on the device using downloaded data and saved-search and listing state. For signed-in users, saved alert definitions and seen-item baselines synchronize through the account; check health, delivery history, and generated update-inbox entries remain local. Android and iOS background services and local notifications are used; this is not a developer-operated remote push service. Notification text can include listing titles, saved-search names, or detected changes, and may appear on the lock screen according to your device settings. Notification permission can be changed in system settings.

Add to Calendar passes a listing title, closing date or time, public property address, and official link to the system calendar editor. You decide whether to save, which calendar to use, and which reminders to enable. Personal notes are not included. The app does not read existing calendar events or contacts or record whether you saved an event.

On iOS 16, the editor requires calendar permission and may use contacts for calendar participants. On iOS 17 and later, this action does not request calendar access. Android opens a calendar editor without calendar permission. Saved events may sync through your calendar provider and remain after you remove a listing or uninstall the app.

7. Purchases, reviews, and support

Apple's App Store and Google Play handle subscriptions, Lifetime Pro purchases, billing, refunds, and payment information. The app receives product, transaction, and entitlement information needed to activate or restore Pro, but does not receive full payment-card details. Store purchase history remains with the applicable store account.

Review This App opens the appropriate store listing when available. Any review you submit is handled by that store and may be public under your store profile; the app does not read or store your review.

If you contact restartapplication@gmail.com, we receive your email address and the message or attachments you choose to send. We use them to respond and address support or privacy requests. Please do not include passwords, payment-card details, or sensitive personal notes.

If you join a beta through Apple TestFlight or Firebase App Distribution, those services separately process tester information such as invitation email addresses, installation or usage information, and feedback or diagnostics where provided. We use information made available to us to distribute and improve test builds. Their beta-testing terms and privacy policies also apply.

8. External actions and third-party services

Bidding or buying opens the official listing; transactions and information you submit there follow that site's policies. Document links can open a browser or download a file. Calling or emailing a listing contact opens your chosen phone or email app. Sharing passes selected listing information to the app you choose. Those services process the information you provide under their own policies.

Provider information:

https://www.gsa.gov/website-information/website-policies https://policies.google.com/privacy https://firebase.google.com/support/privacy https://www.apple.com/legal/privacy/

9. Retention, deletion, and your choices

Settings → Account → Delete Account permanently deletes your synchronized Firestore library and Firebase account after confirmation and reauthentication with the same provider. For Apple accounts, the app also requests revocation of Apple authorization before deleting the account. If deletion fails, the account may remain and you can retry. You can also request account deletion without the app at https://gsa-auction-finder-restart.web.app/account-deletion/ or by emailing restartapplication@gmail.com; we may need to verify your identity. Account deletion does not cancel a store subscription, remove calendar reminders, erase store purchase records, or erase previously sent analytics/advertising data. Those are managed separately as described below.

You can remove saved listings, searches, and locations in the app and edit or remove personal notes. Removing a saved listing also removes its note. For a signed-in user, supported account-library changes are synchronized to Firestore and retained there until removed or the account is deleted. Clear app data where supported or delete the app to remove its local data; doing so does not delete the signed-in account's Firestore copy. Operating-system backups or restores can retain or restore local copies. The app does not operate those backups. Cached content may be evicted independently of saved records.

Deleting local app data does not cancel a subscription, remove calendar events, erase store records or submitted reviews, or immediately delete information already processed by service providers. Manage subscriptions in the store, events in your calendar, and operating-system backups through your device account. Third-party data is subject to the applicable provider's retention and deletion practices.

Depending on your location, you may have rights to request access, correction, deletion, restriction, objection, or a copy of personal information, or to withdraw consent where applicable. Contact restartapplication@gmail.com. We may need information to verify and locate a request; we cannot retrieve guest-mode or other local-only records from your device. Advertising choices and any opt-outs offered are available through Ad Privacy and relevant device/provider settings.

10. Security, international processing, and children

The app uses HTTPS for supported network services and platform storage protections. No transmission or storage system is completely secure. Providers may process information in the United States or other countries under their applicable safeguards and policies.

The app is not directed to children under 13. We do not knowingly seek personal information from children under 13. Contact us if you believe a child has provided personal information through our support channel.

11. Changes and contact

We may revise this policy as features or practices change, updating the effective date and providing additional notice or choices where required. Support and privacy contact: restartapplication@gmail.com.