Privacy Policy

Introduction

Discount Bin Stores (“we”, “the site”) is a directory of bin stores, liquidation stores and Goodwill outlets. This policy explains what data we handle, why, how long we keep it and what you can ask us to do with it. It is written to match what the site actually does rather than what a template says, and it is updated when the site changes rather than afterwards.

Most of the site is plain HTML you can read without typing anything in. Every page does load Meta's (Facebook's) advertising pixel, which sets cookies in your browser and tells Meta about your visit — see Meta pixel and Conversions API for what it collects and how to block it. Beyond that, three things involve personal data, and each is entirely optional: signing up for email or text alerts, sending us a message or a store submission, and — if you run a store — signing in to manage your listing.

What we collect

From every visit: the standard web-server access log — the URL requested, the time, your IP address, your browser's user-agent string and the referring page. Logs are used for capacity planning, debugging and abuse prevention, and are rotated automatically.

If you subscribe to alerts: your email address; optionally a mobile number if you ask for text alerts; the states and stores you chose to follow; and, as a record of your consent, the date and time, your IP address, your browser's user-agent string, the page and the widget you signed up from, and the version of the consent wording that was on screen (currently email-v1 for email and sms-v1 for text messages). We keep that consent record because the law expects us to be able to prove what you agreed to and when.

If you contact us or submit a store: your name, your email address and whatever you write in the message.

If you claim and manage a store listing: your email address, the listing you claim, what you change, and — where a listing is paid for — billing details handled by our payment processor. We never see or store full card numbers.

Advertising measurement: the Meta pixel on every page, and — once we switch it on — server-side events we may send to Meta when you use a form, click through to a store, or view a store, state or city page. What those involve, including hashed copies of the contact details above, is set out under Meta pixel and Conversions API.

We do not ask for, and have no use for, your date of birth, your address, your gender or any other profile detail. We do not buy contact lists, and we do not sell, rent or trade yours for money.

Email alerts and how consent works

Alert sign-ups are confirmed opt-in. Submitting the form does not subscribe you: it creates a pending record and sends you one email with a confirmation link. Nothing else is ever sent until you click it. Confirmation links last seven days and work once. If you never click, the pending record is deleted automatically after 14 days and you receive at most one reminder in the meantime.

Once confirmed, you get the alerts you asked for — at most one email a week in normal operation. Every marketing email identifies us, says why you are receiving it, and carries a working unsubscribe link plus the one-click unsubscribe header that mail apps use. Unsubscribing takes effect immediately, needs no account, no password and no explanation, and the link keeps working long after the email was sent. Preference links in those emails let you change which states and stores you follow without signing in to anything.

Email addresses are stored in a normalised form so the same person cannot end up on the list several times, and unsubscribed or bounced addresses are added to a suppression list that we check before every single send. That list survives deletion of your subscriber record on purpose: it is the only way to guarantee that erasing your data does not accidentally start the emails again.

Text messages

We are not sending text messages at this time. Where our forms offer text alerts, they collect a mobile number and express written consent so the programme can begin once it is registered with US mobile carriers; nothing is sent to a number until then. The consent box is separate, never pre-ticked, and never a condition of using this site or of any purchase.

When the programme does start, message frequency will vary, message and data rates may apply, replying STOP will stop messages immediately and permanently, and replying HELP will return our contact details. Full terms are on the SMS terms page. Email and text subscriptions are independent: stopping one does not stop the other.

Phone numbers published on store listing pages are business contact details taken from public sources. They are directory content, not subscribers, and they are excluded from the alert programme entirely.

Cookies and local storage

Browsing the public site sets two advertising cookies belonging to Meta, placed by the Meta pixel described below: _fbp on every visit, and _fbc when you arrive from a Facebook or Instagram ad. They are set under this site's domain but read by Meta's script. We do not use local storage, and apart from that pixel the site runs no JavaScript: your light or dark preference is honoured through a CSS media query, which sends us nothing, and the filters, menus and forms work without scripts. We do not show a cookie banner; instead this policy explains the cookies and how to block or opt out of them, and blocking them does not break anything on the site.

One cookie exists, and only for store owners: when you sign in to claim or manage a listing, we set a strictly necessary session cookie so the site knows it is still you on the next page. It holds a random session identifier and nothing else — no name, no email, no tracking value — is restricted to this site, and is deleted when you sign out or when the session expires. It is not used for advertising, analytics or profiling, and it is never set for visitors who are not signed in.

Listing view counts

So that a store owner can see how much interest their listing gets, we count views of store pages. The count is collected by a small first-party request to a /px/ address on this same site when a store page loads. It records which listing was viewed and when, together with the same IP address and user-agent already present in our server log, which we use to discard duplicate and automated hits.

The counter itself sets no cookie and assigns no identifier to you. What an owner sees is a total — “this listing was viewed 412 times last month” — never anything about an individual visitor. The same request may also be used to send a store-page view to Meta as described below. Apart from the Meta pixel there is no third-party analytics on this site: no Google Analytics, no tag manager, no other pixel.

Meta (Facebook) pixel and Conversions API

We use Meta's advertising tools to measure whether ads we run on Facebook and Instagram bring people to the site, and to improve those ads — for example, by showing them to people similar to our visitors, or not showing them to people who have already signed up. There are two parts: a pixel in your browser, which is live now, and server-side events, which we may send once that is switched on.

The pixel in your browser

Every page loads Meta's fbevents.js script from connect.facebook.net and records a page view. If your browser blocks scripts, a one-pixel image from facebook.com records the page view instead. Either way Meta receives the page address, the referring page, your IP address, your browser's user-agent and basic device details, and any Facebook cookies your browser already holds for facebook.com — which is how Meta can link the visit to a Facebook or Instagram account if you are logged in. The script also sets these first-party cookies:

Server-side events (Conversions API)

Our own server may also send events directly to Meta's Conversions API, because browser-side measurement is often blocked. None of this needs any JavaScript in your browser. The site may send an event when you:

• use a form — submit a store, sign up for alerts, confirm your alert sign-up, or send a contact message or a store change report; and later, claim a listing or pay for one;
• click through to a store — a store's website, phone number, directions and social links go through a /go/ address on this site, which redirects you to the destination and may send a click event recording which store and which kind of link;
• view a store page — through the same /px/ request used for the listing view counts above;
• view a state or city page — these pages carry the same kind of invisible one-pixel image, loaded from a /px/v/ address on this site, which may send a location-page view recording the state or city and how many stores it lists. Unlike the store-page counter, nothing about these views is stored on our server.

For clicks and page views, an event may include: your IP address and browser user-agent; the values of the _fbp and _fbc cookies, if your browser has them; the page address; and details of the store or place, such as the store's name, city and state and the type of store. For forms, it may also include your email address, name and phone number (the phone only when you gave one) — and, for a store submission, the store's city, state and ZIP code — each SHA-256 hashed on our server before it is sent, so Meta receives a scrambled value it can only match against details it already holds. We do not send the text of your messages, your alert preferences or any payment card details.

How Meta uses it

We use these tools to measure and improve our advertising on Meta's platforms. Meta receives the data as an independent business under its own terms and data policy, and may use it to provide its advertising services, including for its own purposes such as improving ad delivery. Some US state privacy laws treat this kind of advertising measurement as “sharing” or “targeted advertising”; the controls below let you opt out of it.

Your choices

• Meta ad preferences — control how Meta uses activity from other websites to show you ads at facebook.com/adpreferences.
• Off-Facebook activity — see and disconnect the activity businesses like us send to Meta; Meta explains how at facebook.com/help/568137493302217.
• Block the cookies or the script — block third-party cookies or cookies for this site in your browser settings, delete _fbp and _fbc, or use a content blocker that blocks connect.facebook.net. Blocking them does not break the site: every page, filter and form works the same without them. Server-side events are then sent without the cookie values, though they may still include your IP address and user-agent.

Advertising

The site carries no display advertising. There are no ad networks, no ad slots and no service worker. The only advertising technology on the site is the Meta pixel and the planned Conversions API events described above, which measure our own ads on Meta rather than showing ads here. If that ever changes, this section will be updated with the specific controls available to you before it takes effect.

Contact and submission forms

The contact form, the report-a-change form on each store page and the submit-a-store form store their contents on our own server — along with the IP address and browser details the request arrived with, used only to fight spam. We keep those messages for as long as needed to process the request — typically until the listing is published or the question answered — and use the details to verify and publish store information or to reply to you — plus, once server-side events are switched on, the hashed advertising-measurement event described under Conversions API. Store details you submit (name, address, prices, hours, links) become part of the public directory; your own name and email do not.

Every form on the site carries a hidden field that real people never see and never fill in. If it arrives filled, we treat the submission as automated and discard it. We also limit how often the same address or network can submit. No CAPTCHA is used, and no third-party bot-detection service sees your visit.

Who else handles your data

We keep the number of outside parties as small as the job allows. When the alert programme is running, an email delivery provider sends the messages on our behalf and reports back whether each one was delivered, bounced or marked as spam; a text-message provider will do the same for SMS; and a payment processor handles card details for paid listings, which never reach our servers. Each acts on our instructions, for that purpose only. Our own hosting provider stores the site and its database. The one exception to “on our instructions” is Meta, which receives the pixel data and any server-side events described above under its own terms. Nobody else receives your details, and we do not sell them.

How long we keep things

Server access logs are rotated automatically within weeks. Unconfirmed alert sign-ups are deleted after 14 days. Subscriber records last until you unsubscribe or ask us to remove them; after that we keep only the suppression entry needed to make sure we never email or text you again. Consent and opt-out records are kept for four years, because that is the period during which we may need to prove them. Message-delivery logs are kept for two years. Form emails are kept until the request is dealt with. Owner accounts and their listing edits last as long as the claim does. The _fbp and _fbc cookies last about 90 days unless you delete them sooner; what Meta keeps from the pixel and server-side events is governed by Meta's own retention rules.

Third-party links

Store pages link to stores' own websites, Facebook, Instagram, Yelp, Google Maps and a third-party publisher of Goodwill rotation guides. Those sites have their own privacy policies; we have no control over what they collect once you leave.

Data about stores

Listings contain business information — addresses, phone numbers, hours, prices and publicly posted customer reviews attributed by first name or handle as originally published. If you are a store owner and want a listing corrected, or a reviewer who wants a quoted review removed, contact us and we will act on the next site build.

Children

The site is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us their details, email us and we will delete them.

Your rights

Whatever jurisdiction you are in, you can do all of the following, free, without an account and without explaining yourself:

• Stop the emails — the unsubscribe link in any of them, acted on immediately.
• Stop the texts — reply STOP, or ask us any other way.
• Change what you get — the preference link in any email.
• See what we hold — email us and we will send you your record.
• Correct it — tell us what is wrong.
• Have it deleted — we delete your subscriber record and everything attached to it. We keep the suppression entry and the consent history, because deleting those would let the emails restart and would destroy the evidence that you consented and then withdrew; they contain your address and nothing more.

If you are covered by the GDPR, the UK GDPR or a US state privacy law such as the CCPA, those rights include access, correction, deletion, portability, and objecting to direct marketing. We do not sell personal information for money. Our use of the Meta pixel and Conversions API may count as “sharing” for cross-context behavioural advertising, or as targeted advertising, under some US state laws; you can opt out using the controls under Your choices. We do not make automated decisions about you that have legal or similarly significant effects. We answer within 30 days, and we will not treat you differently for asking. Use the contact form to exercise any of them.

Security

The site is served over HTTPS. Subscriber data, consent records and owner accounts live in a database on our own server, not in a third-party marketing platform — Meta only ever receives the hashed or event-level data described above — and access is limited to the people who run the site. No system is perfect, and if a breach ever affects your data we will tell you and the relevant regulator as the law requires.

Changes to this policy

Material changes — new categories of data, a new provider, or switching advertising on — are reflected here with a new “last updated” date before they take effect. Changes to the consent wording used on our forms get a new version number, and the wording you originally agreed to is kept on record.

Contact

Privacy questions: the contact form.