Company

Privacy Policy

Effective 2026-09-20 · Updated 2026-09-20 · Version 1.0.0

Change Log

  • [Version 1.0.0] (2026-09-20): Initial 3shots release adapted from the FantasyPilot LLC policies and rewritten for a listing-helper product (photos, marketplace browser helper, Bedrock vision, Clerk identity, no card billing).

At FantasyPilot LLC ("we," "us," or "our"), operating the 3shots product accessible from threeshots.ai, protecting your privacy and securing your personal and listing data is our top priority. This Privacy Policy outlines how 3shots—including our web application, marketing site, and the official 3shots Browser Helper Chrome extension (collectively, the "Product")—collects, uses, stores, shares, and safeguards your data, as well as your rights regarding this information.

1. Personal Identifiable Information (PII) & Data We Collect

To deliver AI-assisted listing kits for used household items on Facebook Marketplace, Nextdoor, and OfferUp, we collect and process the following categories of information:

A. Data Collected by the 3shots Browser Helper

The Browser Helper is a Chrome extension that keeps marketplace session state in your browser so you can post and reply without pasting credentials into 3shots. To perform this role:

  • Marketplace Session Tokens: The extension may store Facebook Marketplace, Nextdoor, and OfferUp session tokens in sandboxed local extension storage (chrome.storage.local). These marketplace tokens never leave your browser. They are never posted to 3shots servers, SST, S3, or any FantasyPilot LLC backend.
  • Clerk Authentication Token: The extension holds the Clerk JWT (clerkToken) pushed from the 3shots app so it can call authenticated 3shots APIs. This is the only token that may leave the extension toward threeshots.ai / app.threeshots.ai.
  • Session Presence Signals: The extension reports whether a marketplace session is present or absent (in / out) so your settings UI can show connection status. It does not transmit the raw token bytes.
  • Seller Outbox Actions: When you initiate a post or reply through 3shots, the helper may use locally stored marketplace tokens to submit those actions on the marketplace sites. Those actions are yours as the seller.

B. Data Stored in Our Core Database

Our Postgres database stores:

  • User Identity: Clerk user ID, email address, and first name.
  • Seller Profile & Pickup Details: Optional Venmo handle, Zelle handle, street address, neighborhood, and preferred pickup window. Privacy toggles (maskAddress, firstNameOnly, mirror) control how some of this appears on buyer-facing kit pages.
  • Listings & Photos: Item titles, prices, condition, descriptions, city, attributes, photo object keys in our item-photos bucket, public track slugs, and post/sold status across marketplaces.
  • Buyer Inbox: Buyer display names, marketplace platform, message text, offers, pickup scheduling fields, and blocked-people entries you create.
  • Helper Status: Marketplace session presence flags and helper-installed timestamp (not marketplace credentials).

C. Data We Do Not Collect

  • We do not collect general browsing history, search terms, passwords, or autofill payment cards from your browser.
  • We do not receive or store Facebook, Nextdoor, or OfferUp passwords or session cookies on our servers.
  • We do not currently operate a first-party analytics, advertising, or cookie-tracking SDK on the marketing site or app. Essential cookies used by Clerk for authentication may be set by that identity provider.

2. How We Process and Use Your Data

We process your data exclusively to operate 3shots:

  1. Listing Kits: Generating titles, descriptions, condition suggestions, attributes, and buyer-facing kit pages from your photos and edits.
  2. Marketplace Assist: Helping you copy or post listings and manage buyer messages through the app and Browser Helper.
  3. Pickup & Payment Hints: Showing the pickup and payment details you choose to share with interested buyers.
  4. Account Security & Diagnostics: Authenticating sessions via Clerk and troubleshooting product failures.

A. Automated Decision-Making & Profiling (GDPR Article 22)

3shots uses computer vision and language models to propose listing copy, condition labels, and attributes from photos. These outputs do not make legally binding decisions about you. They are assistive suggestions. You remain responsible for reviewing and approving anything before it is posted to a marketplace.

B. Sensitive Personal Information (CCPA / CPRA)

Precise street address and peer-to-peer payment handles (Venmo / Zelle) may constitute sensitive personal information under California law. We use this information only to operate listings, pickups, and buyer communication for your account. We do not sell it or share it for cross-context behavioral advertising.

3. Third-Party Sharing & AI Subprocessors

We do not sell, rent, trade, or share your personal information for cross-context behavioral advertising. We do not sell marketplace session credentials. To operate the Product, data is processed by the following subprocessors:

A. Cloud & Identity Providers

  • Amazon Web Services (AWS): Backend compute, VPC networking, Aurora PostgreSQL, and the item-photos object store are hosted on AWS in the United States.
  • Clerk: Identity verification, sign-in, and account authentication.

B. AI Subprocessors (Amazon Bedrock)

  • Subprocessor: We use Amazon Bedrock (amazon.nova-lite-v1:0) to identify items in your photos and propose listing fields.
  • What Is Sent: Item photos and a structured identification prompt. We do not intentionally transmit your email address, Venmo/Zelle handles, street address, or marketplace session tokens to the model.
  • Training: We do not use your listing photos or account data to train or fine-tune FantasyPilot LLC proprietary foundation models without your explicit, separate opt-in. Bedrock inference is subject to Amazon’s applicable AWS service terms for model providers.

C. Marketplaces You Choose

When you post or reply on Facebook Marketplace, Nextdoor, or OfferUp—manually or via the Browser Helper—those platforms receive the listing content and messages under their terms and privacy policies. 3shots is not the marketplace of record.

4. EU AI Act Transparency Disclosures

Under the European Union Artificial Intelligence Act (EU AI Act):

  • Risk Classification: 3shots operates as an AI-assisted listing and productivity tool, classifying it in the Minimal or Limited Risk tier.
  • Active Transparency Obligation: Listing titles, descriptions, condition suggestions, and attributes may be generated by an artificial intelligence system. By using these features, you acknowledge that you are interacting with AI-generated assistive output and that you must review it before publishing.

5. Algorithmic Fairness, Bias, & Variance Disclaimer

AI-generated titles, prices, condition labels, and attributes are statistical suggestions derived from photos and prompts:

  • We disclaim liability for algorithmic bias, pricing variance, misidentification, or listing errors.
  • AI outputs are not appraisals, authenticity certificates, or professional valuations.
  • You assume responsibility for the accuracy of anything you publish on a third-party marketplace.

6. Photos, Homes, and Children’s Items

Listing photos may depict rooms, backgrounds, faces, or children’s products (for example, a playard or toy). You agree:

  • Not to upload photos whose primary subject is an identifiable minor.
  • To crop or avoid capturing unrelated personal documents, mail, or credentials in the frame when practical.
  • That photo content you upload is processed to operate the Product as described in this policy.

7. Data Security, Retention, and Deletion Rights

A. Data Security

Data in transit uses industry-standard TLS (HTTPS / TLS 1.3). Persistent datastores and object storage use encryption at rest (AES-256 via AWS). Administrative database access on remote stages is restricted to private VPC networking and IAM-authenticated access patterns. Marketplace tokens remain in browser-local storage and are not stored on our servers.

B. Local Extension Storage Isolation

The Browser Helper stores marketplace tokens strictly in chrome.storage.local. This storage is sandboxed by the browser and is inaccessible to other extensions or third-party web pages.

C. Retention

We retain account, listing, photo metadata, and inbox records for the life of your account and for a short backup / disaster-recovery window afterward as needed to operate and restore the service. We do not retain marketplace session tokens on our servers because we never receive them.

D. Account Deletion & Right to Be Forgotten (GDPR / CCPA / CPRA)

You may request access, correction, deletion, or an appeal of a denied privacy request by emailing hello@threeshots.ai. Upon processing a deletion request:

  • Active user profile records are purged from our operational databases.
  • Associated listings, photo records, buyer inbox rows, and blocked-people entries are removed or anonymized as applicable.
  • You should also remove the Browser Helper (or clear its extension storage) to destroy any marketplace tokens that remain only on your device.

California residents may also designate an authorized agent to submit requests. We will not discriminate against you for exercising privacy rights.

8. Browser Helper Purpose Limitation & Limited Use Disclosures

Our data practices for the 3shots Browser Helper follow a least-privilege, purpose-limited model aligned with Chrome Web Store User Data Policy Limited Use principles (including for a future store listing):

  1. Purpose Limitation: Host permissions are limited to Facebook, Nextdoor, OfferUp, and 3shots app origins needed to store marketplace sessions locally and call authenticated 3shots APIs. The helper does not monitor general web browsing.
  2. No Data Monetization or Sales: We do not transfer, lease, rent, trade, or sell marketplace session credentials or listing data to advertising networks, data brokers, or retargeting agencies.
  3. Tokens Stay On-Device: Marketplace tokens never leave chrome.storage.local toward FantasyPilot LLC servers.
  4. No Creditworthiness Profiling: We do not use extension-collected information to evaluate credit, employment, or housing eligibility.
  5. No AI Training on Credentials: We do not feed marketplace session tokens or Clerk JWTs into foundation models for training or fine-tuning.

9. SMS / text messages

If you turn on texts in Settings › Your agent, enter a mobile number, and tick the consent line, 3shots may text you about your listings and buyers. Message and data rates may apply. Frequency varies. Reply STOP to opt out and HELP for help. We never share or sell your number.

10. Contact and Inquiries

If you have questions, concerns, or privacy requests regarding this Privacy Policy or your data:

Disclaimer: This is an AI-generated draft policy for informational purposes only. It does not constitute legal advice. Please consult with a qualified attorney before deploying to production.