Privacy Policy

Last updated: April 18, 2026

This document is a draft prepared for review by legal counsel. It is not legal advice. Consult an attorney before relying on this policy.

1. Who We Are

TrainFinder is operated by CommandWorks LLC, a Texas limited liability company. This policy explains how we collect, use, and protect information when you use TrainFinder at www.trainfinder.us.

2. What We Collect

Information you provide

• Account information — email address, display name, and password (hashed, never stored in plain text) when you create an account
• Profile information (optional) — zip code, preferred scales, favorite brands, collector type, state, and bio
• Product feedback — comments you submit about product listings
• Seller reviews — ratings and review text you submit
• Want list entries — products you mark as “looking for,” including budget preferences

Information collected automatically

• Page views — which pages you visit on TrainFinder
• Search queries — what you search for
• Session identifier — a one-way hash of your IP address and browser type (not reversible, not personally identifiable)
• Google Analytics — standard web analytics (page views, device type, referral source). Google Analytics may set cookies on your browser. See Google's privacy policy.

What we do NOT collect

• Payment card numbers (Stripe handles all payment processing if/when marketplace features launch)
• Precise geolocation
• Social media profiles

3. How We Use Your Information

• To operate and improve TrainFinder
• To sync your watchlist across devices
• To send you price change notifications and new inventory alerts (only if you opt in to marketing emails)
• To send you a periodic newsletter with market trends, new sellers, and features (only if you opt in)
• To display anonymous engagement statistics (e.g., “5 people viewing this product”)
• To understand how people use the site (analytics)
• To prevent abuse and enforce our terms of service

Aggregate and anonymized data

We may create aggregate, anonymized reports from user activity — such as most-searched products, most-watched items, and price sensitivity trends. These reports contain no personally identifiable information. We may share aggregate reports with dealers and sellers to help them understand market demand. Individual user identities are never disclosed.

4. Third-Party Services

We share limited data with the following services to operate TrainFinder:

• Vercel — hosts our website (may log IP addresses)
• Render — hosts our API server
• Neon — hosts our database
• Google Analytics — web analytics
• eBay API — we fetch listing data from eBay; your searches are not sent to eBay
• Stripe — payment processing (only when marketplace features are active)

We do not sell your personal data to anyone. Aggregate, anonymized reports (which contain no personally identifiable information) may be shared with dealers and sellers as described in Section 3.

5. Data Retention

• Page view data — automatically deleted after 90 days
• Account data — retained until you request deletion or deactivate your account
• Watchlist data — retained until you remove items or delete your account
• Reviews and feedback — retained indefinitely (may be anonymized on deletion)

6. Your Rights

You may:

• Request a copy of all data we hold about you
• Request deletion of your data (account, watchlist, reviews)
• Unsubscribe from marketing emails at any time using the one-click unsubscribe link in every email
• Opt out of marketing emails in your account settings at any time
• Opt out of aggregate data inclusion by contacting us

To exercise these rights, email tonysunday@commandworks.us. We will respond within 30 days.

7. Cookies

TrainFinder uses a single httpOnly authentication cookie ("tf_auth") to keep you logged in. This cookie contains a session token — not your password or personal data. It expires after 7 days. Google Analytics may set additional cookies for analytics purposes. Your browser settings control whether cookies are accepted.

8. Children

TrainFinder is not directed at children under 13. We do not knowingly collect information from children under 13. If you believe we have collected data from a child under 13, contact us and we will delete it.

9. Changes to This Policy

We may update this policy at any time. When we do, we will update the “Last updated” date at the top. Continued use of TrainFinder after changes are posted constitutes acceptance of the updated policy.

10. Contact

Questions about this policy? Contact us at tonysunday@commandworks.us.