Privacy Policy
Effective date: November 9, 2026
1. Who we are
RoxxDrop is a locally installed e-commerce application owned and operated by Andre Rox Enterprises LLC ("we," "us," or "our"). This policy explains how we handle personal information through RoxxDrop, https://roxxdrop.com, and related services. Contact us at privacy@roxxdrop.com about this policy or a privacy request.
2. Information we process
Depending on the services you use, we may receive your name, email address, account identifiers, customer support communications, and limited technical or security records. Where account, subscription, or billing services are introduced, these may also include subscription status and billing and payment history. A customer subscription and payment-processing system is not currently part of the deployed RoxxDrop release; no payment processor is identified here as an active RoxxDrop provider.
The application processes product information you enter or obtain from an authorized source, product images, listing details, seller configuration, eBay account identifiers, and listing-operation records. Do not include unnecessary personal information in product content or support messages. The current release does not automatically order products from Amazon or transfer buyer addresses to Amazon.
3. Local application processing
Product preparation, image downloads and processing, and eBay listing operations run primarily on your computer. The application stores preferences and listing-job information, including account references and listing identifiers, in a per-user local database. These local business records are not represented as an encrypted database.
The application uses operating-system-protected credential storage for its device authorization credential. Temporary product-image files are removed after processing, including handled failures. On application startup, recognized abandoned image-job directories older than 24 hours are eligible for cleanup. Files on a computer that remains offline or does not run the application cannot be remotely guaranteed to be removed.
Product information and image files are transmitted to eBay when you authorize listing operations. Requests to other product-data providers are subject to the provider you actually use and its terms. Automatic Amazon product retrieval through a licensed provider is not currently configured; manual entry of seller-owned or licensed content is available. We do not treat an Amazon URL as permission to republish content.
4. Our backend services
Our backend supports eBay OAuth authorization and receipt of eBay Marketplace Account Deletion notifications, together with related security and compliance records. These services are separate from the product-processing and listing work performed locally. Customer account administration, subscription verification, and broader compliance delivery functions may be added later; this policy does not represent those functions as already operational.
Network infrastructure necessarily processes information such as IP addresses and request timing to deliver HTTPS connections and protect services. Limited operational and error records may be retained for troubleshooting and security. We do not intentionally include authorization tokens or passwords in application logs.
5. Connecting your eBay account
You authorize RoxxDrop through eBay's official Production OAuth consent process. You sign in directly with eBay and choose whether to grant the requested permissions. RoxxDrop does not ask for or receive your eBay password. Requested permissions support inventory and listing operations, reading relevant seller-account settings, and identifying the authorized account.
The backend exchanges the authorization code and maintains authorization credentials needed to renew access. Its implementation encrypts stored token payloads and restricts access to its configuration and data. The eBay account identifier is also stored to associate authorization with the correct seller; not every database field is encrypted. The desktop retains a protected device credential and uses short-lived access tokens for authorized local API operations. Network transfers use HTTPS.
Disconnecting removes that device's companion authorization record and the application's saved credential. The desktop disconnect workflow also removes local records associated with that account. Disconnecting one device is not an account-wide erasure request and does not necessarily revoke an already issued eBay access token immediately. You can manage or revoke the overall authorization in your eBay account settings. Live seller authorization remains subject to completing the Production sign-in configuration and seller consent.
6. Why we use information
We use information to provide functions you request, maintain authorized eBay access, prepare and publish listings you approve, respond to support and privacy requests, protect services, investigate failures or abuse, and meet applicable legal obligations. Where applicable law requires a legal basis, processing may be necessary to perform our agreement with you, comply with law, pursue legitimate operational and security interests subject to your rights, or act on consent where required. We will obtain consent for additional processing where the law requires it.
7. Sharing and external services
We do not sell customer personal information to advertisers or data brokers. We share information only as reasonably necessary for authorized services, infrastructure, support, security, billing when implemented, or legal obligations. eBay receives information needed for its authorization and marketplace services. Our existing mail infrastructure includes a mail engine hosted through Cloudzy and handles messages sent to our privacy contact. Hosting, network, and email providers may process information needed to provide their services.
If a payment processor or authorized product-data provider is introduced, its role and applicable information will be disclosed when relevant. We may disclose information when legally required or reasonably necessary to protect rights and security. External services apply their own privacy policies to their independent processing. This policy does not replace eBay's privacy notice.
8. Retention, closure, and deletion
Following verified customer account closure or an eligible deletion request, our approved target is to delete or de-identify eligible personal information within 30 days, subject to applicable legal requirements and exceptions. Subscription cancellation alone is not an account deletion request. Financial and tax records, records needed to resolve disputes, and limited security or compliance evidence may require longer lawful retention. We will explain relevant exceptions when responding to a request where permitted.
This target requires an operational review; it is not a claim that deletion is fully automated. We must identify relevant account, authorization, support, notification, local-device, and backup records, verify the request, and record completion. Backup handling and retention schedules, account-wide deletion coordination, and delivery and acknowledgment of deletion obligations by customer devices are not yet fully implemented. We will communicate necessary steps and limitations rather than treating receipt of a request as proof that all copies have been erased.
Authorization flows expire after five minutes. Device authorization records have a one-year expiry in the current implementation, and expired records are removed during subsequent companion requests. This expiration is not a substitute for responding to an eligible deletion request. Other records are retained only for their relevant purposes and lawful requirements; a complete operational retention schedule is still being established.
9. eBay account deletion notifications
Our backend receives and verifies eBay Marketplace Account Deletion notifications and records associated deletion obligations. Receiving a notification does not itself establish that all related information has been deleted. Integration between these obligations, OAuth account-wide deletion, and delivery to customer devices remains under development. We are responsible for addressing applicable deletion obligations, including any permitted legal-retention exceptions, and must not treat a functioning notification endpoint as completed deletion compliance.
10. Your requests and choices
Email privacy@roxxdrop.com to request access, correction, deletion, or information about our processing. Depending on applicable law, you may also have rights to portability, restriction, objection, withdrawal of consent, appeal of a decision, or a complaint to your relevant data-protection authority. We will assess requests under the laws that apply to you and will not unlawfully discriminate against you for exercising a protected right.
We may request proportionate information to verify your identity and authority before disclosing or deleting records. Do not send your eBay password, access tokens, payment-card details, or unnecessary identity documents. An authorized representative may need to provide evidence of authority. Where additional verification or a lawful extension is needed, we will communicate with you. Withdrawal of consent does not change the lawfulness of earlier processing.
11. Website cookies and security technologies
The current public RoxxDrop homepage and privacy page are static and do not install advertising trackers, analytics scripts, or cookies. They do not require JavaScript or login. HTTPS, security headers, and ordinary server security controls help deliver and protect the site. Other services, including eBay's sign-in pages, may use their own cookies and technologies under their own notices. We will update this disclosure if the RoxxDrop website's technologies change.
12. Security
We use measures appropriate to the current implementation, including HTTPS, restricted server file permissions, protected local device credentials, and encryption of backend OAuth token payloads. These measures do not guarantee that every system or record is encrypted or immune to unauthorized access. Customers should protect their computers, Windows accounts, backups, and access to exported content. No transmission or storage method provides an absolute security guarantee.
13. International processing
Your information may be processed in the jurisdictions where you, our infrastructure, eBay, or relevant service providers operate. Privacy laws may differ between jurisdictions. Where applicable law requires safeguards for an international transfer, we will apply the required safeguards before making that transfer. You may contact us for information about safeguards relevant to your information. We do not claim an unverified certification or transfer framework.
14. Children
RoxxDrop is intended for adult business users and is not directed to children under 18. We do not knowingly seek personal information from children. Contact us if you believe a child has provided information so that we can assess and address it appropriately.
15. Changes and contact
We may update this policy as our services and obligations change. We will publish the revised policy with its effective date and provide additional notice or obtain consent when required. Privacy inquiries and requests should be addressed to Andre Rox Enterprises LLC at privacy@roxxdrop.com.