Draft. Fill in the bracketed details and have a lawyer review this page before launch. Delete this notice when done.
Privacy Policy
Effective [EFFECTIVE DATE]
This policy explains what information [LEGAL BUSINESS NAME] ("DiscandDeck," "we") collects when you use our marketplace, how we use and share it, and the choices you have. Questions: [PRIVACY EMAIL].
What we collect
You give us
- Account: email address and password. Passwords are stored securely by our authentication provider; we never see them in plain text.
- Profile: username, display name, profile photo, bio and general location (such as a city and state).
- Listings: descriptions, prices, photos, and the ZIP code you ship from. We resize photos and remove hidden data, such as GPS location, before they're stored.
- Questions, answers, messages and ratings you post.
- Sellers: your PayPal merchant ID once you connect PayPal; your ship-from address and phone number if you add them; and a connection token if you link Shippo.
From transactions
- Order details: the item, prices, fees, and dates paid, shipped and delivered.
- The buyer's name and shipping address, provided by PayPal at checkout.
- Tracking numbers and delivery status from carriers, through Shippo.
- Payment references from PayPal. We don't receive or store card or bank numbers; PayPal handles those.
Automatically
- Basic technical information such as IP address, browser and device type, and pages requested, kept in server logs by our hosting providers for security and troubleshooting.
- Your browser's local storage keeps you signed in. We don't use advertising cookies or third-party ad trackers.
How we use it
- To run the marketplace: show listings, process orders and offers, connect buyers and sellers, enable shipping labels and tracking, and complete orders.
- To send emails about your account and activity: receipts, sales, shipping and delivery updates, offers, and questions. You can turn off offer and question emails in Settings. Order emails always send.
- To keep DiscandDeck safe: prevent fraud, enforce our Terms, and protect users.
- To improve the site, and to comply with the law.
Who sees it
- Everyone: your public profile (username, display name, photo, bio, location, ratings, sales count), your listings, and the questions and answers on listings.
- The other person in an order: sellers see the buyer's name and shipping address so they can ship. Buyers see the seller's name, and the return address printed on the label. Order messages are visible only to the buyer and seller.
- Service providers who run DiscandDeck for us, only as needed for their work: Supabase (database, sign-in and file storage), Cloudflare (hosting), PayPal (payments and seller onboarding), Shippo (labels and tracking), and Resend (email delivery).
- Legal and safety: when required by law or legal process, or to protect the rights, property or safety of users, the public or DiscandDeck.
- Business changes: if DiscandDeck is sold or merged, information may transfer to the new owner under this policy.
We don't sell your personal information, and we don't share it for targeted advertising.
How long we keep it
We keep account information while your account is open. We keep order records for as long as needed for payment, tax, dispute and legal purposes, generally [RETENTION PERIOD, e.g. 7 years]. Sent-email records are deleted after 90 days. When you close your account, we delete or anonymize your profile and listings, except information we must keep for completed orders or legal reasons.
Your choices and rights
- Edit your profile, photo and email preferences any time in Settings.
- Ask us for a copy of your information, or ask us to correct or delete it, by emailing [PRIVACY EMAIL]. We'll verify it's you and respond within 30 days, or sooner if your state's law requires it.
- Depending on where you live, such as California, you may have additional rights under state privacy laws, including the right to know, delete and correct information and to not be discriminated against for using these rights. [LAWYER: confirm which state laws apply at your size and add any required disclosures.]
Security
We use encryption in transit, access controls that limit each user to their own data, and reputable providers. No system is perfectly secure, so please use a strong, unique password.
Children
DiscandDeck is for adults 18 and over. We don't knowingly collect information from children under 13. If you believe a child has given us information, contact [PRIVACY EMAIL] and we'll delete it.
Changes
If we make material changes to this policy, we'll notify you by email or on the site before they take effect.
Contact
[LEGAL BUSINESS NAME] · [MAILING ADDRESS] · [PRIVACY EMAIL]