Privacy Policy

Our approach

NoBagrets seeks to collect and use information reasonably necessary to operate its private marketplace, manage membership, enable communications and protect members. This policy describes current development practices and explicitly distinguishes planned features. It applies to the website and marketplace, not independent services or arrangements members choose.

1. Information we collect

Account information includes names, usernames, email addresses, password hashes, email-verification and access status, and relevant approval, restriction, invitation and application records. Passwords are stored as one-way hashes, not plaintext account passwords. New registrations also record the time and versions of the Terms and Privacy Policy accepted; pre-existing accounts are not treated as having accepted retroactively.

Marketplace information includes listing descriptions, photographs and possession-proof images, selected brands/categories, condition and exposure disclosures, price or trade preferences, general shipping origin, saved listings, questions and answers, and listing activity. Exact addresses are not requested in listing forms; members may voluntarily exchange them in messages.

Communications include member messages and conversation/read activity, abuse reports and their relevant evidence, access and brand requests, and tester feedback, replies and screenshots. Administrators may add private operational or moderation notes. Technical records include login/logout, failed-authentication and lockout events, known-account identifiers, request IP addresses and bounded browser/user-agent information, authentication sessions, and application/security logs. Feedback can include its originating page path without the query string and a bounded browser description. Infrastructure may also keep operational access/error logs.

Do not upload information about others unnecessarily or include credentials, financial-account secrets or unrelated sensitive information in screenshots, listings or messages.

2. How information is used

We use information to maintain accounts, verify email ownership, evaluate membership and brand requests, operate listings and saved items, enable member communications, administer feedback, provide support, investigate reports, enforce rules, prevent abuse and maintain reliability. Administrators use internal marketplace and authentication statistics for operations and safety. Information may also be used to comply with applicable legal obligations and protect lawful rights.

3. Invitations and optional email updates

The public website accepts membership requests and separate optional marketing subscriptions. Marketplace registration and member login are currently restricted. Membership requests store the submitted name, email address, reason and optional referral for administrator review.

If you explicitly subscribe, we store your email address, consent time and version, and subscription synchronization status. Mailgun processes your email address to maintain the subscriber list and deliver NoBagrets updates. Requesting an invitation does not subscribe you to marketing emails, and subscribing does not request membership. You can unsubscribe through the link in marketing emails or contact [email protected].

Mailgun also delivers transactional invitation and service messages. These are separate from optional marketing consent.

4. Sharing and disclosure

Approved members receive information needed for marketplace features, such as visible listings and Q&A; conversation participants receive messages sent to them. Authorized administrators access account, moderation and operational information according to their responsibilities. Private-message review is limited to reported communications and relevant case context, rather than a general administrator inbox of every member conversation.

Hosting, infrastructure, email-delivery and other necessary service providers may process information to support the service. We may disclose relevant information when required by law, to investigate fraud or protect members and platform rights, or in a legitimate business transfer subject to applicable notice and safeguards. The current application has no integration for selling personal information to data brokers or advertisers and does not sell personal information for those purposes.

5. What other members can see

Approved members can see eligible marketplace listings, photographs, descriptions, listing-owner usernames and visible Q&A author usernames. Conversation participants can see messages and participant usernames; users may choose to include other identifying information in content. Pending or unapproved accounts do not gain marketplace browsing merely by registering.

Account email addresses, password hashes, authentication logs, administrative notes and private account details are not intentionally displayed to other ordinary members. Private drafts and proof photographs have separate protected access; proof photographs are not ordinary marketplace gallery photos. Saved listings are private to their owner. Tester feedback is visible to its submitter and authorized administrators, with internal staff notes restricted to administrators. Choosing to publish personal details in content or share them with another participant makes them visible to that audience.

6. Cookies, sessions and site resources

The site uses essential cookies and server-side sessions for sign-in, remembered authentication where selected, request-forgery protection and reliable navigation. Cookie restrictions in your browser may prevent these features from working. Sessions may contain IP and browser information.

Current analytics are internal operational and login records, not an installed third-party page-tracking or advertising-pixel system. No optional advertising cookies are currently implemented. Some layouts load fonts from Bunny Fonts; requests to that resource provider can disclose technical connection information such as your IP address and browser. Third-party sites you choose to visit can apply their own cookies and practices.

7. Retention

Account, marketplace and communication records are retained while reasonably needed to operate the service, investigate reports, maintain security and auditability, resolve outstanding matters or comply with applicable law. We have not implemented fixed automatic deletion deadlines for messages, authentication history or audit logs. Logs, backups and evidence can remain after content is removed from ordinary views.

Deleting a private draft from My Listings archives it and retains private photos and history. Moderation removal similarly need not erase preserved evidence. Account closure or deletion requests do not guarantee immediate removal of linked listings, conversations, reports or required records. Where appropriate, the operator must assess deletion, restriction or de-identification while preserving legitimate obligations.

8. Account changes, closure and requests

You can edit your name and email in Profile; changing your email requires renewed verification. Profile includes an account-deletion control, but linked marketplace and audit records can prevent automatic deletion. It is not a complete self-service erasure process for all associated information. If the control cannot complete your request, contact the operator through the contact information below.

You may request access to, correction or deletion of your information, or account closure. We may verify your identity before acting and retain information where permitted or required for security, dispute records or legal compliance. Requests are assessed under applicable requirements; no unsupported automatic completion deadline is promised.

9. Security

Current safeguards include password hashing, authenticated and approved-member access checks, model-level authorization, protected photo storage, image validation and re-encoding, and attributable administrative audit records. These controls reduce risk but do not guarantee absolute security.

The public website uses HTTPS. Marketplace messaging is unavailable on the public website.@elsePrivate messages are not end-to-end encrypted. The development preview is currently on a private network and uses HTTP; transport encryption is not claimed for that preview. Members should avoid sharing sensitive details while testing. No security certification, independent audit or blanket compliance certification is represented.

10. Children’s privacy

NoBagrets is intended for adults aged 18 or older and does not knowingly solicit registration from children. If you believe a minor supplied account information, contact the operator so the account and information can be reviewed and handled appropriately.

11. External services and links

Members may link to brand websites, payment services or other independent sites. Those services have their own terms and privacy practices. Member-arranged payment and shipping services are not NoBagrets checkout integrations. NoBagrets does not currently receive payment-card data through a marketplace purchase checkout. Hosting, font and future email providers may process data necessary for their services as described above.

12. Your privacy rights

Depending on applicable law and your circumstances, you may have rights to access, correct, delete or obtain a copy of information, restrict or object to certain processing, or exercise other available rights. Contact the operator to make a request. We will assess applicable requirements and explain any lawful limitations. This policy does not claim blanket compliance with a particular state or international privacy regime or that every right applies in every situation.

13. Updates, operator and contact

Changes to actual practices or this policy will be reflected in its revision date. We will provide notice of material changes where required and obtain additional consent where legally necessary. Registration acceptance acknowledges this policy; it is not blanket consent to future marketing or unrelated processing.

Operator: NoBagrets. State and jurisdiction: Florida, Indian River County. For privacy questions or requests, contact [email protected]. Enabled testers can also use Feedback for platform concerns.