Privacy policy

1. Information we collect

Seller accounts contain an email address, securely hashed password, verification status, profile name, handle, area, preferred contact description, and listing details. We also store authentication sessions, hashed single-use tokens, and security rate-limit records.

Buyer requests contain a name, email, contact note, message, optional offer, selected item price snapshots, and request status. Reports contain a reporter email, reason, and details. Administrative audit logs record moderation actions. Hosting infrastructure may produce access and security logs.

2. Why we use this information

We use information to operate accounts and listings, verify emails, relay bundle requests, show request status, provide password recovery, send availability reminders, prevent abuse, and review reports. We do not use the Phase 1 service to process payments or provide advertising analytics.

The service sends transactional emails through its configured SMTP provider. Email outbox payloads are encrypted while queued and removed after successful sending; delivery metadata remains for operations.

3. What is public and what is shared

Your seller display name, handle, area, preferred contact text, listing text, prices, and external URLs are public. Do not put private information in these fields. Seller account email addresses and password data are not public.

After email confirmation, your bundle request details are shared with the relevant seller in their private inbox and notification. Your private status link can be used by anyone who possesses it, so keep it secret. Report information is available to authorized moderators.

4. External providers and cookies

We use necessary authentication and language-preference cookies. External listing images load directly from the image host without a referrer header. That host can still receive your network information, including IP address. Visiting an original marketplace link is governed by that website’s policies.

Where enabled, Cloudflare Turnstile checks forms for abuse. Cloudflare, hosting, and email providers may process technical and service data. Provider roles, processing locations, contractual safeguards, and any cross-border transfer requirements need legal review.

5. Retention, security, and your requests

We keep information needed to run the service, preserve request history, address abuse, and meet applicable obligations. Listings can be removed by sellers and become hidden after 30 days without confirmation; hiding a listing is not a deletion of all related records. A formal retention and deletion schedule requires legal review.

We use access controls, protected authentication cookies, password hashing, hashed tokens, encrypted queued emails, and HTTPS. No system can guarantee absolute security. Do not share passwords or private links.

PDPO data access and correction procedures, data-user identity, a privacy contact channel, response timelines, deletion handling, and notices about collection must be finalized with legal advice before commercial launch. This policy does not claim certified legal compliance.