How BidPulse protects your account
Last updated October 18, 2026.
To bid for you, BidPulse signs in to ShopGoodwill as you. This page explains what we store, how we protect it, and what you control.
Your ShopGoodwill login
- We check your username and password with ShopGoodwill before we save them. If ShopGoodwill does not accept them, we do not save them.
- We encrypt your ShopGoodwill username, password, and sign-in session with AES-256-GCM. Our whole database is also encrypted.
- Your password and session never go back to your browser. Settings shows only your username.
- We use your login only to sign in to ShopGoodwill, place the bids you set up, and check whether you won.
- Your password goes straight to ShopGoodwill over an encrypted connection (HTTPS). When we check whether you won, your sign-in session passes through our proxy provider inside an encrypted connection to ShopGoodwill that the provider cannot read.
Why we keep your password
ShopGoodwill sign-in sessions expire. When yours does, BidPulse signs in again for you. A snipe you set days ahead still goes in at the last second, even while you are asleep or away.
- If your ShopGoodwill login stops working (for example, after you change your password), we show a banner on your dashboard and send you an email, so you can update it.
Remove it at any time
Go to Settings and choose Delete Credentials. This removes your ShopGoodwill username, password, and sign-in session from BidPulse right away. Without a saved login, BidPulse cannot place bids for you.
Your BidPulse password
- We store your BidPulse password only as a one-way hash (Argon2id). Nobody can read it, including us.
- After 5 failed sign-in attempts, sign-in to that account is locked for 15 minutes.
- Password reset links expire after 15 minutes and work only once.
- If you sign up with email, you confirm your address before you can sign in.
- If you sign in with Google, we check that Google issued the sign-in for BidPulse before we let you in.
Payments
Payments go through Stripe Checkout. You enter your card on Stripe's secure page, and your card details never reach our servers.
How the site is built
- Every page uses HTTPS, and browsers are told to always use HTTPS for bidpulse.app.
- Cloudflare sits in front of our server, and a firewall blocks direct traffic to it from the public internet.
- Our pages cannot be loaded inside other websites, which helps stop tricks that hide our buttons under someone else's page.
Who can see your data
- Our admin tools do not show your ShopGoodwill password.
- We do not sell your personal information. Our Privacy Policy (https://bidpulse.app/privacy) explains what we collect and why.
Report a security problem
If you think you found a security problem, email [email protected] with the details. Please do not access other people's data or disrupt the service while you look into it.
No system is perfectly secure. We keep only what we need to bid for you, and we protect what we keep.