Privacy Policy

1. Information collected

• Account email, password hash, verification and policy-acceptance records.
• Profile name, self-reported phone number and general collection area.
• Listings, photographs, private auction messages, bids, favorites, reports and handover confirmations.
• Security and technical records such as sessions, timestamps, IP-derived rate-limit records, device push subscriptions and administrative activity.

2. How information is used

We use information to operate accounts and auctions, verify email ownership, send security and auction notices, prevent abuse, moderate content, investigate reports, maintain audit records, improve reliability and comply with legal obligations. We do not collect or process transaction payments.

3. When information is shared

Public listings show seller display name, general collection area and listing content. Email and phone are not public. After a qualifying auction closes, the seller and winning bidder receive the contact information necessary to arrange collection. Service providers may process hosting, email, monitoring, backup and push-notification data under appropriate safeguards. Information may be preserved or disclosed when lawfully required or reasonably necessary to protect rights and safety.

4. Cookies and notifications

A secure, HTTP-only session cookie keeps members signed in. Optional PWA push notifications use a browser subscription endpoint and cryptographic keys. Push messages avoid phone numbers, email addresses and exact collection locations. Members can disable push permission in their browser or device settings.

5. Retention

Account, bid, listing, message, moderation and dispute records may be retained for marketplace integrity, security, legal compliance and dispute handling. Expired sessions, tokens and rate-limit records are periodically removed. Backup copies rotate on a schedule and may persist temporarily after live records change.

6. Security

Passwords are stored using salted scrypt hashes. Sensitive sessions and one-time email tokens are hashed at rest. Access controls, rate limits, input validation, backups and audit logs reduce risk, but no internet service can guarantee absolute security.

7. Choices and requests

Members may update profile information and notification permission. Requests concerning access, correction or account closure will be assessed against security, transaction-record and legal-retention needs. Identity verification may be required before fulfilling a request.

8. Age and changes

The service is intended only for people aged 18 or older. We may update this policy and request renewed consent for material changes. The effective version appears above. A qualified Turks and Caicos Islands lawyer should review this policy before public launch.