Privacy Policy

1. What We Collect

Account data: name, email address, password (stored hashed), optional profile photo and bio.

Transaction data: listings you create, orders you place or receive, reviews, and messages sent through the Platform. Payment card details are processed by Pay.aw and never stored on our servers.

Technical data: IP address, browser type, and usage events collected via Google Analytics to understand how the Platform is used.

2. How We Use It

We use your data to: operate the marketplace (matching buyers and sellers, processing orders), send transactional emails (order confirmations, shipping updates, security notices), prevent fraud and abuse, improve the Platform through aggregated analytics, and comply with legal obligations. We do not sell your personal data to third parties.

3. Sharing

We share data only with: other users as needed to complete transactions (your name and profile are visible to people you transact or message with), service providers that operate the Platform on our behalf (Pay.aw for payments, SendGrid for email, Railway for hosting, Google Analytics for usage measurement), and authorities when legally required.

4. Cookies

We use a strictly necessary session cookie to keep you logged in, and Google Analytics cookies to measure usage. You can block analytics cookies in your browser settings without affecting core functionality.

5. Retention

We keep your account data while your account is active. Transaction records are retained as required for financial and legal compliance. Messages are retained while both accounts exist. You may request deletion of your account and associated personal data (see Your Rights below); financial records we are legally required to keep are retained in anonymized form.

6. Your Rights

Depending on your jurisdiction (including under GDPR), you have the right to: access the personal data we hold about you, correct inaccurate data, request deletion, receive a copy of your data in a portable format, and object to certain processing. To exercise any of these rights, contact support. We respond within 30 days.

7. Security

Passwords are hashed with bcrypt, connections are encrypted with TLS, payment processing is delegated to Pay.aw, and optional two-factor authentication is available on all accounts. No system is perfectly secure; notify us immediately if you suspect unauthorized access to your account.

8. Children

The Platform is not directed at children under 18, and we do not knowingly collect data from them.

9. Changes and Contact

We will notify registered users of material changes to this policy by email or in-app notice. Questions: contact support.