Where your data goes, how it is protected and the controls available to you.
Updated October 27, 2026 · Desktop 0.1.7 Preview
ListingSail stores your website profiles, directory records, campaign notes, service requests and monthly usage on its server. A guest workspace is linked to a signed, secure browser cookie and expires after 30 days of inactivity. Registered account workspaces persist beyond the guest period and can be accessed after signing in on another device. Creating an account copies the current guest workspace; the previous guest copy follows its original expiry.
Registration stores your name and email address. Passwords are stored as salted password hashes, never as readable passwords. Account sessions use Secure, HttpOnly cookies with a 14-day expiry. Email verification and password recovery use expiring single-use links. Password recovery signs out previous sessions. A non-secret, allowlisted Billing plan/add-on return path may be kept in per-tab session storage for up to 30 minutes so sign-in and verification can preserve the requested destination; it contains no credentials, checkout session ID or license value. The site owner can access customer workspaces and manage service work; administrative access and changes are audited.
Postmark processes email addresses and message contents to deliver account verification, password recovery and security notices. Verification and recovery links are kept in the private delivery queue and expire after 24 hours and one hour respectively. The admin mail view does not expose message bodies or those links. We do not enable open or click tracking. Provider acceptance does not guarantee inbox delivery.
When you submit a public website URL, our server requests its homepage and up to two same-site About or Contact pages. The destination sees a request from our server. We store extracted public facts, source URLs and your edits. Do not put third-party passwords, verification codes, secret keys or confidential customer information in website profiles or notes.
The site uses Cloudflare for DNS, HTTPS and security, Hetzner infrastructure in Germany and Postmark for transactional email. Providers process technical connection information under their policies. Server access logs rotate daily and are retained for 14 days. We add no advertising or analytics trackers. Workspace and account cookies support the requested service; interface preferences may be saved locally in your browser. You can inspect and export workspace data from the dashboard. Clearing a guest cookie removes browser access but does not immediately erase the server copy. Contact privacy@listingsail.com for account access or data requests. Live monthly software checkout is available through Stripe.
The site owner can configure Claude through a protected administrator form. The API key stays in a private server file and is not included in workspace exports. The optional Fill with AI button sends the supplied public homepage and at most one same-site About, Contact and Pricing page to Anthropic (four pages total). Only public text and metadata are sent; current form drafts, private notes and account identity are excluded. Source URLs accompany field suggestions; unknown facts stay unknown. Suggestions change the form only when you apply them, and are saved only after your review. For directory form mapping, Claude receives approved public website descriptions and directory field labels to suggest field mappings; contact values and private notes are kept locally. Claude also helps organize public directory submission rules with source references; those assessments do not include customer credentials. Reviewed profile facts may be sent to a destination directory when submission is authorized. Optional submission contact names, location fields and product-pricing/use-case answers are supplied and reviewed by you; they are not inferred from your account identity. Browser attempts can retain private screenshots accessible to the customer and owner. CAPTCHA, sign-in, consent and unclear results require human review.
You can connect your own HuntScreens account using its Agent token. The token is verified through the official read-only daily-products endpoint and stored in a private per-account server file. It is never displayed or included in workspace exports. Authorized submissions send only your reviewed public website URL to HuntScreens. You can disconnect through Account; revoke an exposed token at the provider. No external account or paid upgrade is created for you.
On request and at most daily for previously confirmed public listings, ListingSail fetches a saved public listing page and checks its HTML for links to your website. The source sees a request from our server. We save the observed link text, rel attributes and check date. An observed HTML link does not prove visibility, search indexing or ranking.
The optional Windows companion keeps local product briefs, browser profiles, screenshots and its queue in the current user’s local app-data folder. It sends supplied public page text and form labels to your selected Codex, Claude or Gemini CLI using your own provider account, or your configured local Ollama model. It does not read or copy the CLI’s authentication files. Licensing sends a random installation identifier, activation request and technical connection data to ListingSail. The server stores hashes of license keys and activation tokens, device identifiers, entitlement dates and administration audit events. Local activation tokens, directory credentials and mailbox app passwords are encrypted for the current Windows user with DPAPI; browser sessions use the separate browser profile storage. Protection does not replace securing your Windows account.
If you enable directory account creation and connect a dedicated IMAP mailbox, the companion opens its INBOX read-only and inspects at most 20 new messages per poll after the requested registration began. It checks recipient, sender, date, authentication results and intended HTTPS confirmation domain. It does not send mailbox contents to AI, delete messages or mark them read. A supported account flow sends a unique locally generated password only to that destination directory. Ambiguous messages, unsupported sign-in, interactive CAPTCHA, 2FA and binding terms require your action.
The licensed remote MCP has a separate server workspace containing product briefs and records you create there; local browser profiles and mailbox passwords are not synchronized. Human review is required to grant public submission/registration permissions or attest a live listing. Public link monitoring is opt-in and normally weekly while the license is active. The desktop ZIP and public release metadata contain no customer credentials. Software subscriptions can renew monthly through Stripe. Closing the app or revoking a license does not erase your local files; remove the private app-data folder yourself only after exporting any work you need.
Registered customers with confirmed emails can buy a monthly software subscription through Stripe-hosted checkout. Stripe processes card details and billing information; ListingSail does not collect card numbers. We send your account email, an internal account reference and the selected plan to Stripe, and store Stripe customer/subscription/invoice references, subscription status, confirmed paid-period end, entitlement and administrative audit records. Signed webhooks and server-to-server provider checks update access; returning from checkout alone is not proof of payment. Stripe’s customer portal manages payment details, invoices and cancellation of future renewal. Transactional activation/renewal notices link to your authenticated billing page and do not contain the software key.
Stripe secret keys and webhook signing secrets are isolated by test/live mode in private server files. The license registry keeps hashes; a separate private issuer secret derives Stripe-issued license keys for display only to their authenticated account holder. Preserving that issuer secret is essential to key recovery. Test checkout is restricted to the existing owner and does not charge real money. Billing secrets are excluded from public files, source archives and customer exports. Live checkout uses the configured ListingSail Stripe account.
If you separately purchase and enable the optional add-on, ListingSail connects directly to the configured literal loopback HTTP endpoint of your independently installed/licensed provider. For a supported browser task it sends the current public page URL, widget site key and optional provider API key. A manual image test sends the image you choose. The provider returns an answer to the same current task; unsupported or uncertain results require your review.
Provider settings and its optional key are stored in the current Windows user’s DPAPI vault. ListingSail does not send these keys or answers to its AI providers, put them in browser environment variables, or include them in exported reports. Private queue history may record task status and provider task references; the consumed answer cache is limited to the original in-memory task. Cancelling our wait does not claim to cancel an already accepted provider task.
The separate provider controls its own processing, network activity, logs and retention under its terms. A loopback connection does not establish that all of that provider’s work remains offline. ListingSail does not install or distribute its recognition software/models. Stripe and license records also hold the add-on subscription reference and its linked base license to check entitlement. See setup and limits.
Official installed desktop copies can check the public release manifest daily and download an installer from ListingSail over HTTPS. The service sees ordinary technical connection information for these requests. The updater stores its preference, check status and verified staged installer in your private desktop data folder. No website profiles, mailbox contents or provider credentials are required to check a release.
Optional AI providers process the reviewed public facts and form context sent to them. A locally hosted model keeps inference on its configured local endpoint; cloud-provider processing follows the account and service you select. Provider quotas and model downloads are separate from ListingSail. The app does not download a model automatically.