Draft, not yet in effect
For Darrion and Sean’s review before approval. These draft policies describe planned sales through SRR, not the current demo, where no real money changes hands.
Your account holds your email and a password stored in a form that can’t be read back, plus your name and personal phone if you choose to give them. We do not store your password as plain text.
We do not store a buyer location on your profile. Sign-in sessions can include your IP address and browser information.
To limit sign-in abuse, we also store request counts by IP address for sign-in, sign-up, password-reset requests and verification resends. The daily cleanup deletes counts not updated for more than a day.
Shop names, yard addresses, public emails, optional public phones and listed remnant photos are public. When you order, your name, email and any phone you provide are shared with the selling shop.
Buying history is private to the buyer and admins. Shops see their own sales. Public selling history does not show the buyer or the sold price.
Stripe handles payments and payout onboarding. SRR never sees your card or bank details; we keep payment identifiers and deal records. Cloudflare hosts the site, stores its data and photos, and sends SRR’s email.
SRR uses sign-in cookies, including cookies for an admin acting as an account. The application does not load analytics or advertising trackers. Stripe’s own pages have their own policies.
Admins can act as an account to test and fix problems. Starting and stopping are recorded, and changes record both the admin and the account they acted as.
Deleting an account removes its credentials and sessions and anonymizes its personal account fields. The anonymous account reference, remnant history and deal history remain. This is not erasure of every record. Previously known photo URLs can remain readable.
Check with a lawyer: review anonymize-not-erase deletion, retained histories and accessible photos against deletion rights and required financial-record retention.
Proposed backup retention: up to 30 days, only once backups are running and their retention is verified. Current backup retention and deletion from backups: To be decided by SRR.
Check with a lawyer: settle backup retention and how deletion requests reach backup copies before making a retention promise.
Privacy contact, retention periods for other records, and the process for access or deletion requests: To be decided by SRR. See Contact SRR.
Check with a lawyer: determine whether CCPA or other privacy rules apply, and specify the required notices, rights, request process and provider disclosures.