Privacy & retention

What we process

Account profile, listings you post, chat messages you send, ratings, moderation actions, verification status, and technical logs needed to keep the service secure.

Who processes data (processors)

We use vetted providers under contracts. They process data only on our instructions:

• Supabase — database, authentication, file storage (avatars, listing photos, ID images).
• Resend — transactional email (sign-in, alerts, account deletion).
• Stripe — seller payouts and buyer payments for marketplace listings (when enabled).
• Photon (Komoot) — address search and map place suggestions; queries include typed text and coarse map bias, not your stored home pin unless you search.
• Sentry — error and performance monitoring (may include request metadata; no intentional chat content).
• Cloudflare — hosting, CDN, DDoS protection, and Turnstile bot checks on auth forms.

Location on maps

Your profile home pin and each listing pin are stored as coordinates in our database. Neighbours see a fuzzy display point for approximate listings; exact coordinates are shown only to participants when the listing allows it (e.g. after contact). Public profile pages show the neighbourhood label you opt into — never your exact GPS.

How long we keep data

Default retention (operator may shorten on request):

• Account & profile — until you delete the account.
• Listings — until expiry/delete, then removed with the account cascade.
• Chat threads & messages — while either party’s account exists.
• ID verification images — removed after staff approve or reject; status metadata may remain for audit.
• Account-deletion feedback (including optional avatar snapshot) — up to 24 months, then purged by automated cleanup.
• Ops health samples — about 7 days.

Your rights

Download your data from Settings (GDPR Art. 20), correct profile fields there, or start account deletion from Settings. For access, erasure, or objection requests, contact us via the footer link when live or email the operator listed in Terms.