Privacy Policy

Collection of Information

We collect personal information from you when you visit our website, use our services, fill out a contact form, or contact us by phone or email. The personal information we collect may include, but is not limited to, your name, email address, phone number, and IP address. Please note that providing personal data is only required to manage shipments, and it is not necessary to provide it to use the rest of our services.

Use of Information

We use the personal information we collect to provide our services, manage our website, respond to your requests, provide customer support, and manage shipments. We do not use personal information for other purposes and do not share it with third-party services that track user behavior.

Sharing of Information

We do not share personal information with trackers or third-party services that collect user data for purposes of advertising or analysis. We may share personal information with competent authorities in response to binding information requests required by law.

Protection of Information

We take reasonable security measures to protect the personal information we collect from unauthorized access, misuse, disclosure, alteration, or destruction.

Cookies

We use cookies to improve the user experience on our website. Cookies are small text files that are stored on your computer when you visit a website. We use cookies to collect information about the use of our website, such as the pages you visit and the features you use.

Collection and Use of Data

We collect personal data only to manage shipments and provide our services. We do not use personal data for advertising, marketing, or other purposes. We do not use services like Google Analytics, Facebook, or Instagram to collect user data and do not integrate our services with social media platforms. We only publish news from the platform's own accounts on Mastodon and Bluesky: we never publish personal data of users and we do not use tracking tools of those services.

Listings sorted for you

When you are signed in, the home page shows first the listings that match what you do on the site: the listings you open, your wishlist, your purchases, your saved searches, the categories of your posts and of your listings, the people you follow or are connected with and the area of your address. The same order is used for the email with the listings that may interest you, if you have turned it on. Everything is calculated on our servers: no data is sent to third parties and no decision with legal effects is taken. The listings you open are linked to your account for 180 days, then only an anonymous count remains. You can turn this off at any time from the privacy settings: the home page goes back to the most recent listings and the listings you have opened are made anonymous straight away.

Chat, photos and voice messages

Our chat lets users exchange messages, photos and voice messages. Messages of a normal chat are stored on our servers so that both participants can read them again: we do not use them for advertising or analysis and we do not show them to other users. Photos are re-encoded when they are sent and the location, date and device details contained in the image are removed. Photos and voice messages are kept in a private area that cannot be reached from the web and are shown only to the two participants. When you delete a message, its photo or voice message is deleted as well. We may send you an email to tell you that you have unread messages, with the names of the senders and the number of messages but never their content: you can turn it off at any time from the privacy settings.

Voice message transcription

A participant can ask for the transcription of a voice message they sent or received. The transcription is produced by a speech-recognition service that runs on our own servers: the audio is not sent to third parties. The resulting text is saved with the message and is visible to both participants. Transcription is never done automatically.

Suggestions from listing photos

When you publish a listing you can press Suggest from photos: the photos you have just chosen are reduced, stripped of their metadata (such as the place and the device where they were taken) and analysed by an image-recognition model that runs on our own servers, which proposes a title, a category, a description and the condition of the item. The photos and the proposal are not saved and are not sent to third parties; only the fields you leave empty are filled in, and you decide what to publish. The analysis is never done automatically.

Invitations

If you sign up from a friend's invitation link, a technical cookie remembers the invitation for up to 30 days and we record who invited you. Your friend sees only your username, the date and whether the invitation was rewarded. To prevent abuse we compare, without showing them to anyone, the registration IP address, the email and the address of the two accounts. The invitation is deleted together with either account.

Gadgets

If you receive a gadget (for your first listing or for a donation to the crowdfunding), we ask for your name, shipping address and, optionally, a telephone number for the courier, only to send it. For donations we receive your email, name and amount from the crowdfunding platform. To give one gadget per person we compare email, address and registration IP address of the requests, without showing them to anyone. These details are deleted a few months after the gadget is shipped.

Private encrypted chats

If both users agree, they can open a private chat that is encrypted end to end: messages, photos and voice messages are encrypted on your device and can be read only on the devices of the two participants. We, our service providers and anyone who gains access to our servers, database or backups see only encrypted data and cannot read the content. What remains visible is the technical information needed to deliver the chat: who took part, when a message was sent and the size of the files. Private chats are handled by our own server, are not shared with other services and are not used for advertising or analysis. For the same reason we cannot transcribe, translate, scan or moderate their content, and the unread-messages email does not exist for them. The encryption keys stay on your devices: to read your private chats on a new device you need the recovery key that you create the first time you use them, and if you lose it older messages cannot be recovered by us. Closing a private chat or blocking the other user ends it; if you report a user, only what you choose to send us is examined. As with any website, the code that performs the encryption is delivered by our servers: the protection therefore assumes that our servers are not compromised at the moment you use the chat, and it does not protect you from a device that is already compromised.

Alternative access via Matrix

If you choose to link an external Matrix ID, we store the ID and the date it was linked, verify it with a one-time code and use it only to send you access codes and, if you ask, support messages. The codes are stored only as a non-reversible hash with an expiration and cannot be read by us. The Matrix ID is a personal datum: you can remove it from your account settings, and it is erased together with your account. Our bot and the Matrix server necessarily see the ID and the content of the messages they deliver; the support room is public and unencrypted, so do not write sensitive data there.

Public listings on social channels

Only public listings (title, category, link and cover photo) may be published on our official Mastodon and Pixelfed accounts, automatically or after approval by an operator. We do not send personal data, orders, chats, addresses or non-public listings. The content remains public on our Site and on the social channel; you can ask for its removal from the social channel through the contact form, but removal is not immediate. We do not use social trackers or pixels.

Your rights, your data and deleting your account

At any time and free of charge you can download all the data we hold about you (profile, listings, purchases and sales, Happycoin movements, feedback and chat messages) and delete your account permanently from the delete account page. When you delete your account we erase your profile, contact details, addresses, photos, listings, chats and notifications, and your email address, telephone number and username become free again. We keep only what we must: the records of the purchases and sales you completed stay, without your personal data, for the people you traded with and for the time required by legal obligations; a statistical record with the reason you gave and a few totals, which contains no personal data; and, only for a limited time, we may keep a non-reversible code derived from your email address, used to recognise repeated abusive sign-ups. For your other rights (access, rectification, objection, complaint to the data protection authority) use the contact details below.

Abuse prevention and security

To protect the platform and its users from fraud and abuse, when you sign up we record the IP address you used, and our staff can block IP addresses, email addresses or domains that are used abusively. The IP address is kept only for this purpose, is visible only to authorised staff, is erased when you delete your account and is included in the data download. Our staff may also read a conversation or a message only when it has been reported or to examine a specific abuse, with a recorded reason (never in private encrypted chats). When we use an automated analysis or an issue tracker to fix errors, the texts we send are first stripped of email addresses, IP addresses, tokens and long numbers.

Contact

If you have questions about this Privacy Policy, do not hesitate to contact us by sending an email to info@gratisforgratis.com or by filling out the contact form on the contact page.