Privacy Policy
What we collect
| What | Why | Where it comes from |
|---|---|---|
| Email address | Sign-in, notifications, account recovery | You, at signup |
| Username, display name | Your public identity on the board | You |
| Needs, offers, counters, deal records | Operating the marketplace | You, as you use it |
| Photos you upload | Shown with your needs and offers | You |
| Notification and privacy preferences | Honouring your choices | You, in Settings |
| Payment and payout details | Processing payments | Collected by Stripe, not by us |
| IP address, browser, timestamps, error logs | Security, abuse prevention, fixing bugs | Automatically |
We do not collect or store your card number or bank details. Those go directly to Stripe.
What's public
Your username, display name, open public needs, and aggregate deal statistics are visible to anyone — this is a public marketplace and demand being visible is the product. You can restrict your profile in Settings.
Your email address is never public. Your offers are private to you and the buyer. Your private wishlist needs are visible only to you.
Your identity is revealed to a counterparty only when a deal is agreed.
How we use it
To run the marketplace, notify you about your activity, prevent fraud and off-platform solicitation, provide support, meet legal obligations, and understand aggregate usage. We do not sell your personal information. We do not serve third-party advertising.
Who we share it with
Service providers only, each doing a specific job: Supabase (database and authentication), Vercel (hosting), Resend (email delivery), Stripe(payments). We also share where legally required, or to investigate fraud or a threat to someone's safety. If the business is ever sold, member data may transfer — you'd be notified.
How long we keep it
Account data is kept while your account is open. After you close it, we deactivate immediately, keep the record for 14 days so you can change your mind, then anonymise your profile. Completed transaction records are retained indefinitely — they are the ledger the people you traded with relied on, and we need them for tax and dispute purposes. Once anonymised they're no longer linked to you.
Your choices
- Access, correct, or download your data
- Close your account
- Turn off email notifications, individually or entirely
- Hide your profile from logged-out visitors
- Opt out of search-engine indexing
Depending on where you live you may have additional rights under GDPR or the CCPA — email support@exprifi.comand we'll honour them.
Security, children, cookies
We use encryption in transit, row-level database access controls, and payment handling delegated to Stripe. No system is perfectly secure, and we'll tell you promptly if a breach affects you.
Exprifi is not for anyone under 18. We don't knowingly collect data from children; contact us and we'll delete it.
We use cookies that are strictly necessary for sign-in and security. We do not use advertising or cross-site tracking cookies.
Effective July 29, 2026. Last updated July 29, 2026.