Legal
Last updated: November 5, 2026
Bumpy is a Chrome extension that automates actions on your own Depop account, on your behalf and at your direction. We do not sell your data, we do not track your browsing, and we collect only what is needed to run your account and subscription. This policy describes in full what we collect, how we use it, where it is stored, how long we keep it, and who it is shared with.
Bumpy ("we", "our", "us") provides the Bumpy Chrome Extension and the website and dashboard at bumpy.pro. This privacy policy applies to the extension, the website, and the dashboard.
If you have questions, contact us at: sellervault.ecom@gmail.com
Account information. When you create a Bumpy account or sign in, we collect your email address and a unique account identifier. You sign in either with a one-time code sent to your email address, or with Google sign-in. Bumpy does not use passwords and never collects, asks for, or stores any password. If you sign in with Google, we receive only your email address and basic profile identifier from Google; we do not receive your Google password or access to any other Google data. We never collect, ask for, or receive your Depop password. You provide this information yourself as part of signing up, and no account data is collected before you do.
Subscription and billing information. Payments are processed by Stripe. We receive and store your subscription plan, status, and billing period from Stripe, associated with your email address. We never see or store your full card number; that is handled entirely by Stripe under Stripe's privacy policy.
Settings and usage data stored on your device. The extension stores your sign-in session, task preferences (speed, limits, schedules), and local activity counters in Chrome's extension storage on your device. This data stays on your device and is removed when you uninstall the extension.
Depop session data (authentication information). To perform the actions you ask it to (bumping listings, sending and answering offers, following), the extension reads your existing Depop session token from your browser's cookies for depop.com and attaches it to requests made from your browser to Depop, exactly as the Depop website itself would. Your Depop session token and credentials are used only locally in your browser, only on depop.com, and are never transmitted to our servers or to any third party. We never ask for or receive your Depop password.
Website and dashboard data. The bumpy.pro website does not use advertising trackers or third-party analytics. The dashboard uses only the storage needed to keep you signed in. If you contact us by email, we use your email address to respond to your inquiry.
The extension does not:
We use the data described above only to operate Bumpy's single purpose: automating your own Depop store. Specifically, we use it to:
Data collection begins only after you create an account and sign in, which constitutes your consent to the collection described in this policy. If you do not sign in, the extension collects no account data. You can stop all local data collection at any time by uninstalling the extension.
All data transmitted between the extension, our servers, and these providers is encrypted in transit using HTTPS/TLS. Your Depop session token is never stored on, or sent to, any of these services.
We do not sell, rent, or trade your personal data. We share data only with the service providers listed in Section 4 (Supabase, Cloudflare, Stripe, and Resend), each strictly to perform its function in operating Bumpy, and with no one else, except where disclosure is required by law.
We do not transfer user data to third parties for advertising, data brokering, creditworthiness determinations, or any purpose unrelated to Bumpy's single purpose.
Bumpy's use of information received from Chrome APIs and Google sign-in adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use this data only to provide and improve the extension's single, user-facing purpose, we do not transfer it except as needed to provide that purpose, with user consent, or for legal reasons, and we never allow humans to read it except with your consent, for security purposes, or as required by law.
Account and subscription records are retained for as long as your account is active. If you wish to have your data deleted, contact us at sellervault.ecom@gmail.com and we will remove your account, subscription, and email records from our systems within 30 days, except for billing records Stripe must retain for legal and accounting purposes.
Locally stored data (session, preferences, counters) can be cleared at any time by removing the Bumpy extension from Chrome.
Bumpy is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us immediately.
We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the extension or website after changes constitutes acceptance of the updated policy.
For any privacy-related questions or data deletion requests, reach us at: