Cookies, Email and Data Retention
Draft version. Effective date: [DATE]
This page explains how the site stores information in your browser, how we use email, and how long we keep data. See also our Privacy Policy.
1. Cookies and similar storage
The site does not use advertising cookies. It uses your browser's built-in storage to run sign-in, and Google Analytics to count visits (see "Visit counts" below).
| Item | Where | Why | How long |
|---|---|---|---|
| Sign-in token | Browser local storage, only if you choose "Keep me signed in" | Keeps you signed in on that device | Until you sign out or the session expires |
| Sign-in token | Browser session storage, if you do not choose that option | Keeps you signed in during that visit | Until you close the tab or browser window, or up to 1 day |
These are needed for sign-in to work. You can clear them any time in your browser settings or by signing out.
Visit counts (Google Analytics). We use Google Analytics to see how many people visit and which pages are useful. It sets cookies in your browser and sends Google your IP address, browser type, and the page you viewed (never the part of the web address after a question mark or a number sign, and never your name, email or anything you type). We turn off Google's advertising features and do not use it to follow you around other sites. We do not count visits on the administration page. You can turn this off for this browser here: Browsers that send Do Not Track or Global Privacy Control are not counted.
Fonts. The site loads fonts from Google Fonts. When a page loads them, Google may receive your IP address and browser details.
2. Email
Account emails. When you sign up, sign in, reset a password, post a listing, receive a message, or when we need to tell you about your account or a safety issue, we email you. These are needed to run the service.
Marketing emails. We send newsletters, tips or offers only to people who tick a clear box agreeing to them, such as the weekly update. We keep a record of when and how you agreed. Every marketing email will say who it is from, use an honest subject line, include our mailing address, and have an unsubscribe link that works.
We will not buy or rent email lists, sell your email, or share it with a carrier or other partner for their marketing.
3. How long we keep data
- Account: While your account is open. You may ask us to delete it (see below).
- Sign-in sessions: Until they expire. Sessions end automatically, after about 1 day if you did not choose "Keep me signed in."
- Unconfirmed sign-ups: Deleted automatically if you do not confirm within 60 minutes.
- Listings and photos: While listed, and for a short period afterward.
- Reports, takedown notices and records we need for safety, fraud prevention or legal reasons: As long as needed for those purposes.
Your requests. You can ask to see, fix or delete your data by writing to the contact form or using the contact form. We may keep some records if the law requires, or to deal with fraud, abuse or legal claims.
4. Who handles the data
| Company | What it does | What it sees |
|---|---|---|
| Google (Apps Script, Sheets, Gmail, Drive) | Runs the back end, stores the database, sends email | Site data and emails |
| GitHub (GitHub Pages) | Hosts the public website files | Visitor IP address and request logs |
| Namecheap | Domain name and DNS | Domain records |
| Mobility City, Appleton (only when you ask for delivery) | Delivers your item | Your name, phone, address and item details for that delivery |
| Zippopotam.us | Looks up city and state for a ZIP code | ZIP codes entered |
| Google Analytics | Counts visits and page views | Visitor IP address, browser details, pages viewed |
| Google Fonts | Fonts | Visitor IP address |
We do not sell personal data.
5. Security
Passwords are stored only as a salted, scrambled hash. The database is private. Sign-in attempts are rate-limited. The site uses HTTPS. If personal data is ever exposed, we will tell the people affected as the law requires.