Information used by this application
We store your account identifier, public display name, city, bio, avatar, listings and photos, saved items, messages, transaction and delivery records, reviews, reports, support requests, moderation decisions, and terms acceptance date/version. When managed email sign-in is enabled, Firebase stores and processes account credentials, sends verification and password-reset emails, and manages sign-in tokens. The marketplace receives a verified account identifier and email, not the Firebase password. Older email accounts retain a salted password hash and hashed recovery code until securely connected to Firebase; their email ownership is unverified. Connecting an older account removes its local credential hashes and revokes its old sessions. Other external sign-in methods use the provider’s identifier and verified email. We also store your saved searches, account preferences, notifications, and notification read status.
What other people can see
Approved profiles, listings, cities, and reviews can be visible to people allowed to access the site. Exact delivery addresses are available to the relevant buyer and seller and authorized staff investigating orders. Case messages and evidence photos are private to those participants and authorized staff. Photos may retain embedded metadata; remove location metadata and unrelated personal information before uploading. Listing details are preserved at checkout for dispute review. Saved items, saved searches, and notifications are private to your account. Messages are available to their conversation participants. Authorized moderators can review reports, submitted support requests, relevant public content, and moderation records; their normal tools do not provide general access to private inboxes or bank information. The operator and infrastructure providers may access stored records when necessary to operate, secure, or comply with obligations relating to the service.
Payments, hosting, and sign-in providers
When configured, Stripe processes payment-card and bank details, identity verification for connected sellers, and payouts under its own privacy policy. The application stores payment reference IDs, totals, status, and shipping details needed for the order. Firebase or Google handles the applicable sign-in flow. Hosting and storage providers process application requests and stored data. Their policies and legal obligations also apply. This application does not operate an advertising data-sale feature or third-party advertising tracker.
Moderation and location
Text and photo checks run using libraries on the server; this version does not send content to an external moderation API. Image uploads are resized and converted before upload. City search uses a bundled US place database. If you choose “Use my nearest city,” your browser asks for location permission and sends coordinates to the site for that lookup. The application stores the selected city, not those coordinates. Hosting access logs may contain request URLs; avoid the location-permission feature if you do not want to transmit coordinates.
Cookies and device storage
Sign-in uses essential cookies, including a secure HttpOnly session cookie for Google and email sessions and temporary sign-in state. Firebase also uses browser storage to maintain and refresh your managed sign-in session. Listing drafts are saved in your browser on that device and can include listing text and uploaded-photo references. They are not a shared cloud backup. Remove saved drafts and sign out on shared devices.
Retention, requests, and security
We retain records while needed to operate accounts, complete orders, handle fraud and disputes, satisfy legal requirements, and maintain backups. There is no automatic deletion schedule in this release. Request access, correction, or deletion through Help. We may verify account ownership, retain legally required records, and explain any applicable exception. Account closure and privacy requests are handled by the operator; the Help form is not an instant erasure button. No transmission or storage system is risk-free, and we cannot promise absolute security.
Children and changes
Account and transaction participation is intended for adults 18 and older. Do not submit a child’s personal information. Contact support if you believe such information was submitted. Material changes will be reflected in this notice. The site remains a private preview until the operator finalizes its identity, contact information, retention practices, and any additional notices required for its launch jurisdictions.
