Phone number: used to create and secure your account via one-time SMS codes. We check the number's line type with our carrier-data provider (Twilio) to block VoIP and virtual numbers. Display name: shown to stores you message. Messages: stored so your conversations work across devices. Technical data: IP address and basic request logs, kept for security, rate limiting, and abuse prevention. We do not collect email addresses, and we do not run third-party advertising trackers.

We use your data to operate the platform: signing you in, delivering messages between you and stores, showing live prices, and keeping the platform safe. We do not sell personal data. We do not share your phone number with stores; they only ever see your display name.

By entering your phone number you consent to receive one-time passcode texts needed to sign in. These are transactional messages, not marketing. Message frequency depends on how often you sign in. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

We rely on a small set of processors to run the platform: Supabase (database, authentication, file storage), Twilio (SMS delivery and line-type checks), Vercel (hosting), Upstash (rate limiting), Cloudflare (bot protection), and OpenAI (generating product descriptions from item photos; store inventory photos only, never your personal data). Each receives only what it needs to perform its function.

Product photos uploaded by stores are re-encoded on our servers before storage, which strips embedded metadata including GPS location. Photos you see on the platform carry no location data.

Account data is kept while your account is active. Security logs are retained for up to 12 months. To delete your account and associated personal data, request deletion through your account page or by contacting us; we honor verified requests within 30 days, except records we must keep for security or legal reasons.

All traffic is encrypted in transit (TLS). Sessions use httpOnly, secure cookies. Access to production data is restricted and audited. Database access is enforced by row-level security so each account can only reach its own records. No system is perfectly secure; if a breach affecting your data occurs, we will notify you as required by law.

Updates to this policy will be posted here with a new date. For privacy questions or deletion requests, contact the address published on our main page.