Privacy Policy

• We collect the minimum we need to run a marketplace: your email, what you post, who you message, and basic device info.
• We do not sell your personal information.
• We use a small number of trusted vendors (Supabase, Vercel, Resend, OpenAI, Stripe, and others) — see the list below.
• You can delete your account and your listings at any time.
• Email privacy@listdmarket.com if you want a copy of your data or want it deleted.

From you

• Account info: email address; display name, avatar, bio, and location you choose to add to your profile.
• Listings: titles, descriptions, photos, prices, categories, and any details you put in your posts.
• Messages: the contents of conversations you have with other users through Listd.
• Support communications: emails you send us.

Automatically

• Device and log data: IP address, browser type, pages visited, timestamps, referring URLs, and crash diagnostics.
• Cookies and similar tech: required cookies to keep you signed in, plus a referral cookie (listd_ref) when you click an invite link. We do not use third-party advertising cookies.

From sign-in providers

• If you sign in with Google, we receive your email and (if shared) your name and profile picture. We do not receive your Google password.

• To create and operate your account;
• To display your listings and profile to other users;
• To deliver messages between users;
• To send transactional emails (sign-in links, new-message notifications, account alerts);
• To generate AI-assisted listing descriptions when you opt in to that feature;
• To enforce our Terms and investigate abuse, fraud, or safety issues;
• To improve the Service (analytics on which features are used, where errors happen);
• To comply with legal obligations and respond to lawful requests.

We do not sell your personal information and we do not share it with third parties for their own marketing.

We share information only as needed to run the Service:

• Other users: anything you post publicly (listings, profile, comments) is visible to other users and the public web. Your email address is never shown to other users.
• Service providers (“processors” / “sub-processors”): the full authoritative list, updated whenever we add or remove a vendor, is at /subprocessors. As of the effective date above:
  • Supabase — database, authentication, file storage.
  • Vercel — web hosting and edge compute.
  • Resend — outbound email delivery.
  • OpenAI — AI-assisted listing descriptions and image analysis (only content you submit to those features is sent).
  • Stripe — payment processing, Stripe Identity KYC, and rental payouts via Stripe Connect (only if and when you use a paid feature). Stripe Identity session IDs are retained for as long as the account is active.
  • Twilio — SMS text-message delivery (only if you verify a phone number for text alerts).
  • Cloudflare — DNS, edge security, and Cloudflare Turnstile bot-detection on public form submissions. Turnstile receives your IP, User-Agent, and a signed challenge from the browser.
  • PostHog (EU Cloud) — product analytics. Anonymous event data plus an authenticated distinct_id per logged-in user.
  • Firebase Cloud Messaging — push notification delivery on iOS and Android. FCM sees a device token and message payload envelope, never the message contents.
  • Apple — Sign-In with Apple. Apple sees the app bundle ID and your Apple ID at authentication time.
  • Discord and Slack — internal operator alerting via webhooks. We send anonymized event signals (e.g., “new concierge request submitted”, “listing published”) to Listd’s internal ops channels. No user PII is sent.
  • Listd server (self-hosted) — Rental Non-Return Evidence Packet PDFs generated for non-return cases are rendered on our server and stored transiently in Supabase Storage before delivery to the owner.
• Legal and safety: we may disclose information if required by law, valid legal process, or to protect the rights, property, or safety of Listd, our users, or the public.
• Business transfers: if Listd is acquired or merges, your data may transfer to the new entity, subject to this Policy.

If you verify a mobile phone number on Listd, we use it to send you transactional text messages (verification codes, new-message alerts, rental and payout notifications). Your mobile information, including phone number and opt-in status, is shared only with our SMS provider Twilio for the sole purpose of delivering those messages and is never sold or shared with third parties for marketing purposes. Reply STOP to any message to opt out, or turn SMS off in your account settings. Message frequency varies based on your activity on Listd (typically a few messages per week when you have active listings or rentals). Message and data rates may apply.

• Account data: retained while your account is active.
• Listings: retained until you delete them or close your account.
• Messages: retained while either participant’s account is active.
• Logs and security data: typically up to 12 months.
• After deletion: we may keep backup copies for a short period and may retain data longer if required by law or to resolve disputes.

• Access / data export: email privacy@listdmarket.com and we’ll return a machine-readable copy of your data (JSON) within 30 days. Include the account email you signed up with in the message body.
• Correction: edit your profile and listings any time; email us for anything you can’t edit yourself.
• Deletion: delete your account at any time from your account page, or email privacy@listdmarket.com. Requested deletions complete within 30 days, excluding data we’re required to retain by law or to resolve open disputes.
• Sign-In with Apple: if you signed up with Apple, you can revoke access under Settings → Sign in with Apple on your device at any time, which also triggers account deletion on Listd within 30 days.
• Opt out of marketing email: we don’t send marketing email today; if that changes, every message will include an unsubscribe link.
• California (CCPA/CPRA): California residents have additional rights, including the right to know, delete, correct, and to be free from discrimination for exercising rights. Email privacy@listdmarket.com to exercise them.
• EU/UK (GDPR): our lawful bases for processing are contract performance, legitimate interests in running and securing the Service, and consent where required.

We protect your data with TLS encryption in transit, encrypted storage at rest through our hosting providers, row-level security rules on our database, restricted access for our team, and 2FA on admin accounts. No system is ever 100% secure — if you suspect unauthorized access, email privacy@listdmarket.com immediately.

Listd is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, email privacy@listdmarket.com and we will delete it.

Listd is operated from the United States. If you use the Service from another country, your information will be transferred to and processed in the U.S. By using Listd, you consent to that transfer.

We may update this Policy from time to time. The effective date at the top will change when we do. For material changes, we’ll notify you by email or a notice on the Service at least 7 days before the change takes effect.

Privacy questions, requests, or complaints: email privacy@listdmarket.com.

Data controller: Listd LLC, a Pennsylvania limited liability company. Business address: 100 Alton Rd, Palmerton, PA 18071, USA.