Last updated 27 October 2026
The short version: we store your email address, what you have unlocked, and what you have saved. We count which pages get used, on our own server, without a cookie and without anything that identifies you. There is no advertising and no third-party analytics of any kind on this site, and nothing about you is sold or shared for marketing.
KickBack Rewards LLC, trading as JunkYardPicker, is responsible for the data described here. Reach us at hello@junkyardpicker.com.
Post reaches us at 30 N Gould St Ste N, Sheridan, WY 82801.
Your email address. It is how you sign in and how we reach you, and it is the only thing we ask for. We do not ask for your name, your address or your phone number, and there is nowhere to give them.
Your account activity: which vehicles you have unlocked, the price alerts you have set, and whether you are in saving or reselling mode. This is what makes the account useful to you rather than an empty shell.
Your trip log, if you keep one with an Unlimited plan: the parts you brought home, what you paid for them, and what you listed and sold them for. It is yours alone. Nobody else is shown it, it is not pooled with anybody else’s, and it is not used to price anything.
Your billing state: whether a subscription or day pass is active, when it ends, and the identifiers Stripe gives us for your customer record, your subscription and your payment. We do not store card numbers, expiry dates or security codes - those go from your browser to Stripe and never reach our server.
Ordinary server logs, which include IP addresses, kept briefly for security and debugging.
Nothing from a search for yards near you. The ZIP code you type, or your location if you tap Use my location, is used for that one search and not stored or logged. Your location is only read if you allow it, and your phone rounds it to about a kilometre before it is sent.
Super Junkyard Pickers, the game at /game, is played on your device. It makes a random number the first time it talks to our server and keeps it there, so that your runs count as one line on a board. That number is all it sends about you: nothing links it to an account, an email address or an IP address.
When you start a run or the day’s course, the game asks our server for a ticket, sending that number and which course it is, so that a time sent later can be checked. For the day’s course we keep that number and the day, so that only your first try counts.
A time goes on a board only when you press the button that puts it there. Then we keep the name you typed for the board, your time, your score and the rare parts you found, with that number. The name and the time are shown to everybody who looks at the board; that is what a board is, so do not use your real name if you would rather not. We hide names that should not be there.
A day’s board and its record of first tries are deleted after 60 days. The all-time boards are kept; write to us with the name and the time and we will take a line off.
We keep a count of which pages are opened and how far people get, because otherwise every decision about what to build next is a guess. It is our own server counting, not a service we send you to.
Each event is: the name of the step, the path of the page with anything after the question mark removed, a random number made in your browser tab that your browser throws away when you close it, whichever campaign tag was on the link you first arrived by, and the name of the site that linked to us - the site, never the page you were reading on it. Once you have an account, your account is attached to it.
The Android app keeps a note on your phone that it has been opened before, so the first time it opens is counted once. The note itself never leaves your phone.
It does not record your IP address, which browser or device you are using, or anything that would still be true of you tomorrow or on another site. There is no cookie involved. The table has no column for any of it, which is a thing you can check rather than a thing to take our word for.
These rows are deleted after 90 days.
No advertising, no third-party analytics, no tracking scripts, no social pixels, no fingerprinting, no profiling, no cross-site identifiers, and no selling or sharing of your data with anyone for their own purposes. This is a statement about the code, and it is checkable: the site loads no third-party script at all, and not even the fonts come from anywhere but this domain.
One cookie, and it is the one that keeps you signed in. It is strictly necessary for the site to work, which is why there is no consent banner asking you about it - there is nothing optional to consent to.
Your device also stores the sheets you have opened, your pull list, your trip log and your display preferences locally, so they work offline. Your pull list never leaves your device; we never receive it. Your trip log is also copied to your account, as above, so a new phone gets it back. Clearing your browser data clears what is on the device.
The game keeps its own things on your device: best scores and times, the rare parts found, the names given to the pickers, its settings (sound, music, vibration and running on a phone), whether the day’s course has been played, a recording of where your picker went on your first try at it, which the game shows beside your practice runs that day, and the random number described under The game’s boards. The recording is never sent to us. A copy of the game itself is kept too, so it opens with no signal.
Two smaller things sit there too: the campaign tag from the link you first arrived by, and a random number identifying the tab you are in, which the browser discards when you close it. Neither is a cookie, neither is sent anywhere but here, and neither can be read by another site.
Stripe processes payments and receives what it needs to do that, including your email address. It is the controller for that payment data and has its own privacy policy.
Resend sends our email - sign-in links and the alert digests you asked for - and therefore handles your address and the content of those messages. It also sends us short notes when somebody visits or buys a plan: which pages, which site sent them and what was bought, never your name or email address.
Railway hosts the application and its database, and Cloudflare provides DNS and forwards mail sent to our address.
We query eBay for public listing prices. Those requests carry nothing about you: eBay is never told who asked, and never receives your email address or anything else identifying you.
When you look a car up by its VIN, our server sends that VIN, and nothing else, to the decoder run by the US National Highway Traffic Safety Administration (NHTSA), which says what the car is. The VIN is not stored against you or your account. If you scan the VIN barcode instead of typing it, the camera picture is read on your phone and never leaves it; only the VIN found in it is sent.
Beyond that, we disclose data only where the law requires it.
We store your email and account activity because we cannot provide an account without them - performance of the contract you entered by signing up. Billing records are kept because tax and accounting law requires it. Logs and rate limits exist for security, which is our legitimate interest in not being taken down.
Alert emails are sent because you explicitly set an alert. We send no marketing email, so there is none to opt out of.
Account data is kept while the account exists, and is deleted when you delete it.
A sign-in link expires fifteen minutes after it is issued and is cleared out shortly after. A sign-in session lasts ninety days from the last time you used it, and no more than a year in total, after which you sign in again.
Billing records are kept for as long as tax law requires, which is longer than the account and applies even after deletion.
You can ask for a copy of what we hold, ask us to correct it, or ask us to delete it. Deleting the account removes your email address, your unlocks, your trips and your alerts. Depending on where you live you may also have the right to object to processing, to restrict it, or to complain to your data protection authority.
Write to hello@junkyardpicker.com and we will deal with it within a month. We will not charge you for it and will not ask why.
Email hello@junkyardpicker.com from the address on the account and ask for it to be deleted. That is the whole request: no form, and no reason needed. This works the same whether you use the website or the Android app.
We cancel any subscription first, so nothing is charged afterwards, then delete the account and reply to confirm, within a month and usually much sooner. That removes your email address, your unlocks, your trips and your alerts. Page-use counts you appear in lose their link to you.
Billing records stay for as long as tax law requires, as described under How long. Sheets and settings stored on your phone stay there until you sign out or clear the site's data.
This is not a service for children and we do not knowingly hold data about anybody under sixteen. If you believe we have, write to us and we will remove it.
If this policy changes materially we will email account holders before it takes effect. The date at the top is when it last changed.