Privacy Policy

Firewood Willie helps small firewood operators find customers and keep track of them. This policy explains what we collect when you use Willie, why we collect it, who else touches it, and what you can do about it. It covers the Willie website, the seller account at /account, and every lead source you choose to connect.

Willie is Firewood Willie, operated by Travis Lewis. We are not a big company — there is no ad business here, no data brokerage, nothing to sell but the product itself. Where that shapes an answer below, we say so plainly.

From you, when you sign up and use Willie

• Your email address and business name.
• Your ZIP code, and the service area and facility location derived from it.
• What you sell and how: wood types, seasoning, amounts and prices, delivery notes and radius, and which payment methods you take.
• Your customer contacts — names, phone numbers, email addresses, delivery towns, and the jobs and messages attached to them.
• Photos you pick for your public page.

Automatically, as you use Willie

• Session data — a signed cookie that keeps you logged in, plus which of your businesses you last had open.
• Product analytics through Google Analytics 4: which screens you open and which actions you take, so we can tell whether a feature works.
• Device and browser information, including whether you installed Willie as an app.
• Your IP address, used for rate-limiting and abuse prevention on sign-in and messaging endpoints.

From sources you connect — and only if you connect them

• Gmail. Messages matching a fixed list of lead-sender patterns. The Gmail section below describes this in full.
• Shared messages. Text you share into Willie from another app using your phone’s share sheet — typically a Facebook Marketplace or Craigslist enquiry you want tracked.
• Your Willie ingest address. Mail you or your lead sources forward to the unique address on your Lead Sources page.

Every one of these is off until you switch it on, and each can be disconnected from Lead Sources without affecting the rest of your account.

• Running the service. Routing leads to your inbox, matching buyers to sellers, generating quotes, sending your magic-link sign-ins, and delivering the alerts you asked for.
• Willie’s coaching. The messages Willie sends you are generated from your own account activity — unread leads, jobs on the calendar, amounts you have or haven’t priced.
• Improving Willie. Aggregate analytics about how the product is used. We do not build profiles of individual sellers, and we do not look at your customer messages to decide what to build.
• Security and abuse prevention. Rate limits, signature checks on inbound webhooks, and logs of rejected requests.
• Talking to you about your account. Sign-in links, lead alerts, and service notices. We do not send marketing email or texts unless you have opted in, and the text alerts have their own explicit opt-in with STOP handling.

If you connect Gmail on the Lead Sources page, Willie reads a narrow slice of your mailbox so your firewood leads land in the same inbox as everything else. This section describes that in detail, because it is the part of Willie that touches the most sensitive thing we ever handle.

The exact scope we request

Read-only. Willie cannot send mail as you, cannot modify or delete anything in your mailbox, and cannot change your Gmail settings.

Why Willie needs it

Firewood leads arrive scattered across Craigslist relay mail, Nextdoor, Google Business Profile, and Facebook Marketplace notifications. Sellers lose them in a personal inbox between receipts and family mail. Reading those specific messages is what lets Willie show you every lead in one place, with the buyer’s name and number already pulled out.

How Gmail data is used

• We run a server-side Gmail search restricted to a fixed list of sender patterns: Craigslist relay addresses, Nextdoor, Google Business Profile, and Facebook notification mail. The search is also bounded to recent mail rather than your whole history.
• We fetch the full content of only the messages that match. Nothing else in your mailbox is retrieved.
• We send the text of each matched message to Anthropic’s Claude API once, to extract the buyer’s name, phone, email, and what they asked for.
• We store that parsed result as a message in your Willie inbox, along with the original email body for reference.

How Gmail data is not used

The one third party: Anthropic

The content of each matched message is sent to Anthropic’s Claude API in a single request, and the structured result comes straight back. Anthropic does not use data submitted through its API to train its models. Anthropic retains API inputs and outputs only for the limited period described in its own policies, for safety and abuse-detection purposes.

Anthropic’s privacy policy and privacy center describe their handling in full.

Storage

• Parsed leads are stored as ordinary messages in your Willie inbox, scoped to your account.
• The original email body is stored alongside them so you can see the raw message.
• Your Gmail OAuth tokens are encrypted at rest with AES-256-GCM. The encryption key lives in the server environment, never in the database.

Retention and disconnection

• Gmail-derived data is kept for as long as your account is active.
• Disconnecting stops it immediately. When you press Disconnect on the Lead Sources page, Willie deletes your stored Gmail tokens and asks Google to revoke them. No further reads are possible, whether or not a scheduled check is due.
• Leads already in your inbox stay there — they are your customer records. Delete them individually, or ask us to delete the account.
• If you delete your Willie account, all Gmail-derived data is deleted within 30 days. Account deletion is handled by a person today: email crossroadsfirewood@gmail.com and we will confirm when it is done.

Limited Use

Willie is a small product standing on a few other people’s infrastructure. These are all of them that touch your data.

• Anthropic

  Reads the text of a matched lead email once and returns the buyer’s name, contact details, and message.

  Their privacy policy

• Resend

  Sends your sign-in links and lead notifications, and receives mail sent to your Willie ingest address.

  Their privacy policy

• Neon

  Hosts the Postgres database where your account and your leads live.

  Their privacy policy

• Vercel

  Hosts and serves the Willie application itself.

  Their privacy policy

• Google

  Gmail sign-in and lead reading (only if you connect it), Places data for the seller directory, and Google Analytics for aggregate usage stats.

  Their privacy policy

• Twilio

  Delivers the text-message alerts you turn on, and receives your replies.

  Their privacy policy

• We do not sell your data. Not to advertisers, not to brokers, not to anyone.
• We do not share your data for advertising purposes.
• We share what is necessary with the services in the table above, only so they can do their part of running Willie.
• When a buyer contacts you through Willie, the details they submit go to you — that is the point. Your public seller page shows what you chose to publish.
• We will share data if legally compelled by subpoena or court order, and we will tell you when that happens unless we are legally barred from doing so.

• Everything is served over HTTPS.
• Gmail OAuth tokens are encrypted at rest with AES-256-GCM.
• Sign-in sessions are HMAC-signed tokens. We do not store session records in the database, so there is no session table to steal.
• Every read of your data is scoped to your seller account at the query layer, and that scoping is enforced by an automated check that fails the build if a query is ever written without it.
• Inbound webhooks are signature-verified, and rejections are logged rather than silently dropped.
• If we confirm a breach affecting your data, we will notify you within 72 hours of confirming it.

• See your data. Most of it is visible in the app. For the rest, email us.
• Correct it. Your business details are editable under My Info; amounts and prices under My Prices; contacts and jobs in their own tabs.
• Disconnect a lead source. Lead Sources, any time, effective immediately.
• Delete your data. Delete individual messages, jobs, and contacts in the app. For the whole account, email us and we will remove it.
• Export it. Email us and we will send you your data in a portable format.

Requests go to crossroadsfirewood@gmail.com. A person reads that address and will answer you.

Account data is kept while your account is active. When an account is deleted, its data is deleted within 30 days, except records we are legally required to retain — billing records are kept for seven years for tax purposes.

Willie is built for people running a firewood business. It is not designed for or directed at anyone under 18, and we do not knowingly collect data from them. If we learn we have, we delete it.

Willie operates in the United States and stores data in the United States. If you use Willie from outside the US, your data is transferred to and stored in the US.

When this policy changes, we update the date at the top. If we change something material — collecting a new kind of data, or using it in a new way — we will tell you inside the app with a message from Willie, not just quietly edit the page.

Questions, requests, or complaints about privacy go to crossroadsfirewood@gmail.com.

Firewood Willie, operated by Travis Lewis. See also our Terms of Service.