What we know about you
Running an auction with escrow means handling real identity documents and real bank details. Here is exactly what that involves, in the order it happens.
Browsing
Nothing but a server log. No account needed to read the catalogue or the results archive.
Registering
Email, username, a hashed password. That's the whole account until you transact.
Winning or consigning
Now we need proof of funds, a photo ID, an address or bank details — the parts that make escrow work.
Afterwards
Documents go once the transaction is closed and defensible. The sale result stays in the public archive.
What we collect
Grouped by when it's asked for, because none of it is collected until it's needed.
Email address, username, and optionally a display name and location. Your password is stored as a scrypt hash — we never hold the password itself and cannot tell you what it is.
Bids and maximum bids, comments, followed lots, alerts, offers, and any listings you create with their photographs and catalogue notes.
A bank or card statement showing sufficient funds, a photo ID, and your shipping address. From a consignor: bank account details for the payout. These are the parts escrow can't work without.
Camera make and model, capture time, editing software and a perceptual fingerprint of each image. We use these to confirm photographs are genuine and not lifted from another listing. Serial-number photographs are stored privately and never published.
IP address, browser and request timestamps, kept for security, abuse investigation and debugging.
What never touches this site: card numbers. Everything is settled by bank transfer, so there is no card data to lose. We also run no advertising trackers and sell nothing to anyone.
Why we need it
Take bids, close lots, move a watch through authentication and escrow, and get the right money to the right person.
Verification links, outbid and won notices, order steps, payment reminders. These are transactional — you can't opt out of them while a sale is live.
Verifying funds and identity before a watch ships, and checking photographs for provenance. Without this the escrow promise is empty.
Only if you asked. Brand alerts and the newsletter are opt-in and every message has an unsubscribe link.
Completed transactions are retained as long as tax and anti-money-laundering rules require.
Four parties. No advertisers.
Our staff, to run sales and support. The other party to your sale — a consignor sees the buyer's shipping address, a buyer sees the consignor's bank details at payment time, and neither ever sees the other's documents. The authentication center, which receives the watch. And two service providers: our email provider and our host. Nobody else, and your data is never sold or rented.
How long we keep it
Your account and its activity are kept until you close it, then only what the law requires us to retain.
Proof-of-funds and ID uploads are kept while the transaction is live and for the period a dispute could still arise, then deleted.
Held so you don't have to re-enter them for the next sale. Delete them from your account at any time.
A completed lot — its photographs, catalogue note and realised price — stays in the archive. That record is the point of the archive and cannot be withdrawn, though it is tied to a username, not your legal name.
What you can do about it
Email, password, two-factor and active sessions are all under account security.
Non-essential email is a switch in your account; the newsletter unsubscribes from any of its own messages. Transactional mail continues while a sale is open.
Ask and we'll send you what we hold, in a readable format.
We'll delete everything we're not obliged to keep and anonymise the rest. Past sale results remain in the archive.
Any of the above: email support@example.com or use the contact form. A person handles it, usually within a business day.
Cookies and security
A signed session cookie keeps you logged in. There is no advertising cookie, no cross-site tracking and no consent banner because there is nothing to consent to. If analytics is switched on here it is a cookie-free product that counts page views without identifying anyone.
Stored with scrypt and a per-account salt. A reset link signs out every other session as a precaution.
ID and proof-of-funds files sit outside the public path and are released only to staff — never guessable by URL.
Any account can turn on an authenticator code, and we recommend it for anyone consigning regularly.
No system is perfect. Report a vulnerability to support@example.com and we'll act on it quickly and credit you if you'd like.
Terms, fees, shipping.
What you agree to, what it costs, and how the watch travels.