Your conditions stay private.

Your raw future-purchase request, price policy, individual-option research, destination city/region/ZIP and lifecycle history are private to you, authorized Popular Demand operators, and an agent or capability holder you explicitly authorize. They are not published as a product-country market.

Anonymous drafts are stored privately for activation, expire after seven days, and are not counted as active demand. Short activation links last twenty minutes and are removed from the address bar. Knowing an intent ID is not access. Keep read-only status tokens private; they expire and can be revoked in the purchase page.

Your email is held by Supabase Auth. Purchase records use a pseudonymous account ID. City, state or ZIP can help research delivered cost; Popular Demand does not request a street delivery address. In existing paid Israel rounds, the seller collects checkout and shipping information.

Public market pages show aggregate active purchase-intent counts with counts below five suppressed. These are potential purchases, not guaranteed buyers. Private clusters can overlap and must not be summed as executable demand. A reviewed price baseline is not a supplier offer.

Tagged links preserve the latest valid source/campaign token in a browser-session cookie through navigation and sign-in. A new purchase preserves its original source, capture transport and verified OAuth client when present. Activation, editing and withdrawal do not rewrite origin. Tags are self-reported metadata, not a verified referral, endorsement or payout claim.

OAuth connections require your approval of specific soft-purchase permissions. You can revoke them in your account. No connection grants payment, seller or administrator access. Optional single-purchase capability access is read-only and can be revoked separately.

Email subscriptions are optional and can be stopped on the purchase page. Local development messages go to the test inbox. Hosted delivery requires a configured provider; provider acceptance is not proof of inbox delivery or attention. Private polling records when an agent checked, separately from when you last confirmed interest.

Versioned conditions, research evidence and important lifecycle events are retained for recovery and audit. Closing soft demand revokes polling capabilities and subscriptions and cancels pending messages. A configured scheduler expires stale records and redacts unclaimed expired draft content and its raw revisions. Minimal source/capture/lifecycle metadata remains. Owned future-purchase records remain available for history and export. You can download your private future-purchase data in your account. You can also permanently erase ordinary soft-demand data there. This removes your Requests, history, candidate Offers and related derived simulations and briefs, and revokes agent authority. Minimal opaque account, event and retry tombstones remain to prevent old work from restoring erased data. The application account cannot be reactivated. This does not delete your authentication-provider identity, previously delivered messages, downloads or provider backups. Staff, seller accounts and accounts with legacy commitment history require separate retention review.

Erasure waits while you have a payment hold that has not ended, until the payment provider confirms an ended hold can no longer be charged, and until a captured payment has its Order record. Payment records are then kept without your account, Request or Offer: the amounts, tax location (state and postal area) and the payment provider’s references, which refunds and disputes need. Your notes and your agent’s notes on an Order are removed; the seller’s shipment records stay. The address of a hold that was never charged is removed at once; an Order’s shipping address is removed on its usual schedule, a few months after delivery and its returns window. How long these pseudonymized payment records are kept is set separately.

For existing seller-held paid rounds, a seller sees deposit reference codes and clearing outcomes. A release because a limit is below clearing can reveal which of the seller’s own price bands the limit reached. Exact reservation prices are not published to sellers.