Privacy Policy

Last updated: September 21, 2026

The short version: we collect only what's needed to run the site and keep accounts safe, we don't sell data, we don't run ads, and we don't track you. The details:

1. What we collect

• Account details: email, username, region, language, your password (stored only as an argon2 hash — we can't see it), and, if you enable an authenticator app, its secret (stored encrypted) and backup codes (stored only as hashes).
• Security logs: IP address, browser information, time and result of each sign-in attempt; your list of active sessions. Used to spot unusual logins, lock out brute-force attempts and send you new-device alerts.
• Content you post: listings, photos (metadata such as GPS location is stripped automatically and the image is compressed on upload), direct messages, and reports.
• Moderation records: an audit log of moderator actions.

We do not collect payment details (the site never handles payments), real names or postal addresses, and we don't use analytics or advertising trackers.

2. How we use it

To run the site (show listings, deliver messages, send verification codes and security alerts); to protect accounts and the site; to enforce the Community Rules; and to respond to reports and lawful requests.

3. Who can see it

• Other members: your username, region, join date, listings and photos are public. Your email, IP addresses and security logs are not. Direct messages are visible only to the two people in the conversation (and to a moderator if one of you reports the other).
• Service providers: DigitalOcean (hosting), Resend (sends verification codes and alerts — they see your email address), Cloudflare (DNS). They process data only as needed to provide their service.
• Legal: we may disclose information where required by law or where necessary to protect someone's safety.

We never sell, rent, or share your data for advertising.

4. Cookies

The site uses three strictly necessary cookies: one for your login session, one to prevent cross-site request forgery, and one that remembers a browser you have already confirmed so you are not asked for an email code every time. There are no tracking cookies and no third-party cookies.

5. How long we keep it

Account details are kept until you delete your account. Security logs are kept for 12 months. Removed listings and photos are deleted from the server (backups may hold them for up to 14 days). When you delete your account, your username and email are anonymised and your listings are removed; messages you sent remain visible to the other person as coming from "deleted user".

6. Your rights

You can see your details on your Profile page; on the Security page you can review sessions and sign-in history, change your password, regenerate backup codes, or delete your account. For a data export or any other request, email us.

7. Security

HTTPS everywhere, argon2 password hashing, email confirmation for new browsers, optional authenticator-app two-factor with encrypted secrets, server-side sessions you can revoke at any time, lockout after failed sign-ins, rate limiting, a strict Content Security Policy, photo metadata stripping and daily backups. No system is perfectly secure — if you find a vulnerability, please email us.

8. Children

The site is not for anyone under 13. If we learn we've collected information from a child under 13, we'll delete it.

9. Changes

When we update this policy we'll change the date at the top; significant changes will be announced on the site.

10. Contact

[email protected]