Thrift Trader LLC DBA PorchPickups.com ("PorchPickups," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what information we collect, how we use it, how we share it, and your choices regarding your data when you use the PorchPickups platform at www.porchpickups.com and any associated mobile applications (collectively, the "Platform").

By using the Platform, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform. This Privacy Policy should be read in conjunction with our Terms of Service.

1. Information We Collect

1.1 Information You Provide Directly

• Account Registration: Full name, email address, password, zip code, city, state, and account role (buyer or seller).
• Profile Information: Profile photo, banner photo, bio, and phone number (optional).
• Auction Listings: Item titles, descriptions, photos, categories, pricing, shipping details, and pickup locations.
• Payment Information: Credit/debit card details and banking information are collected and processed by our third-party payment processor, Stripe. PorchPickups does not directly store your full payment card numbers.
• Communications: Messages sent through our in-app messaging system, live event chat messages, and any correspondence you send to our support team.
• Live Event Content: Video and audio transmitted during live auction events hosted through the Platform.

1.2 Information Collected Automatically

• Device and Browser Information: IP address, browser type and version, operating system, device type, and screen resolution.
• Usage Data: Pages viewed, auctions visited, bids placed, items watched, search queries, click patterns, and time spent on the Platform.
• Location Data: Approximate geographic location derived from your zip code, IP address, or browser geolocation (if you grant permission). We use this to show you nearby auctions and calculate distances.
• Cookies and Similar Technologies: We use cookies, local storage, and similar technologies to maintain your session, remember your preferences, and improve your experience. See Section 7 for more details.
• Push Notification Tokens: If you opt in to push notifications, we store your device's push subscription endpoint (Firebase Cloud Messaging registration token on Android; APNs token on iOS; Web Push endpoint on browsers) to deliver notifications.
• Mobile Device Identifiers (mobile apps only): On Android and iOS, we read the application build / version code (via Capacitor's App.getInfo()) so the in-app update prompt can compare it to the latest published version. We do not collect the Android Advertising ID, the iOS IDFA (Identifier for Advertisers), or any other resettable advertising identifier, and we do not request the App Tracking Transparency permission on iOS.
• Biometric Authentication (mobile apps only): If you enable biometric sign-in (Face ID, Touch ID, Android Biometric), your fingerprint or facial template is stored only on your device's secure hardware (Apple Secure Enclave / Android Keystore). PorchPickups never receives, stores, or has access to your biometric data — we only receive a yes/no "authentication succeeded" signal from the operating system. Your account password is stored locally in the device keychain solely so the biometric unlock can sign you in.
• Camera, Photo Library, and Microphone (mobile apps only): When you grant the relevant permission, the application accesses your camera and photo library to capture and upload listing images, and your microphone for hosting live auction events. Permissions can be revoked at any time in your device settings. Captured images and audio are uploaded to our image storage and live-streaming providers (see Section 3); they are not used for facial recognition, advertising, or any purpose other than the feature you invoked.

1.3 Information from Third Parties

• Payment Processor: Stripe may provide us with limited information about your transactions, such as payment status, last four digits of your card, and transaction IDs.
• Geolocation Services: We use third-party geocoding services to convert zip codes into geographic coordinates for distance calculations.
• Shipping Carriers (Shippo): When a seller enables shipping on a listing, our shipping partner Shippo may share carrier rate, tracking, and delivery confirmation data with us.
• Mobile App Stores: The Google Play Store and Apple App Store provide us with aggregated, non-identifying installation and crash metrics. We do not receive your individual app-store account information.

1.4 Mobile SDKs and Libraries

The PorchPickups mobile applications include the following software libraries that may process device data on your device:

• Capacitor (Ionic): The runtime that bridges the web application to native iOS and Android features (camera, network, app version, etc.). Capacitor itself does not transmit data to any third party.
• Firebase Cloud Messaging (Google): Used to deliver push notifications on Android. FCM generates a per-install token that we receive and associate with your account so we can address notifications to you. Subject to Google's privacy policy.
• Apple Push Notification service (APNs): Used to deliver push notifications on iOS. APNs is operated by Apple under its privacy policy.
• Google Play In-App Updates SDK: Used to download and install newer versions of the Android app when you tap "Update" in the in-app update prompt. This SDK communicates only with Google Play and does not transmit personal data to PorchPickups.
• Capacitor Biometric Auth & Secure Storage: Used to authenticate your sign-in via Face ID/Touch ID/Android Biometric and to store your encrypted credentials in the device's secure hardware. Data is held on-device only.
• LiveKit Mobile SDK: Used for live auction streaming (video/audio) when you choose to host or watch a live event. Stream data flows directly between participants and LiveKit's servers.

We do not bundle any third-party advertising SDK, behavioral-analytics SDK, or cross-app tracking SDK in the mobile applications. We will update this section if that changes.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Platform Operations: To create and manage your account, process bids, facilitate transactions between buyers and sellers, and provide customer support.
• Personalization: To show you relevant auctions near your location, suggest sellers to follow, and customize your activity feed.
• Communications: To send you transactional emails (bid confirmations, win notifications, password resets, order updates), daily auction digest emails (if opted in), and push notifications (if opted in).
• Safety and Security: To detect and prevent fraud, enforce our Terms of Service, protect the rights and safety of our users, and comply with legal obligations.
• Analytics and Improvement: To understand how users interact with the Platform, monitor performance, identify bugs, and improve features and user experience.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• With Other Users: Your public profile information (name, profile photo, city, state, bio) is visible to other users. When you place a bid, your name may be visible to the seller and other bidders. When you win an auction, your name and contact information necessary to complete the transaction are shared with the seller.
• Service Providers: We share information with trusted third-party service providers who assist us in operating the Platform, including:
  • Stripe — Payment processing (card data, payouts, tax calculation)
  • SendGrid — Transactional and marketing email delivery
  • LiveKit — Live video/audio streaming infrastructure
  • Cloudinary — Image and media hosting
  • Shippo — Shipping label generation, rates, and tracking
  • Google Firebase / FCM & Apple APNs — Push-notification delivery
  • Google Play & Apple App Store — App distribution and update delivery (mobile only)
  • Twilio — SMS notifications (where enabled by user)
  These providers are contractually obligated to use your data only for the services they provide to us.
• Legal Requirements: We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change.
• With Your Consent: We may share information for other purposes with your explicit consent.

4. Data Retention

• Account Data: We retain your account information for as long as your account is active. If you request account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., transaction records for tax compliance).
• Transaction Records: Auction histories, bid records, and payment records are retained for a minimum of 7 years for tax, legal, and compliance purposes.
• Communications: In-app messages and chat logs are retained for the duration of your account and for 90 days following account deletion.
• Analytics Data: Aggregated, non-personally-identifiable analytics data may be retained indefinitely for platform improvement purposes.

5. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: You can view and download your profile information, bid history, and transaction records through your account settings.
• Correction: You can update your profile information at any time through the Edit Profile page.
• Deletion: You can request deletion of your account and all associated personal data at any time via our self-service deletion page at porchpickups.com/account-deletion-request. After you confirm via email, your account is deactivated immediately and your personal data is permanently anonymized after a 30-day grace period (during which you can cancel and restore your account). Transaction records are retained in anonymized form for up to 7 years for tax and legal compliance (see Section 4). You may also email admin@PorchPickups.com if you prefer to make the request manually.
• Notification Preferences: You can manage your push notification and email preferences in your Notification Settings. You can opt out of the daily auction digest email at any time.
• Push Notifications: You can disable push notifications through your device settings or browser permissions at any time.
• Cookies: You can manage cookie preferences through your browser settings. Note that disabling cookies may affect Platform functionality.

To exercise any of these rights, contact us at admin@PorchPickups.com. We will respond to your request within 30 days.

6. Security

We implement reasonable administrative, technical, and physical security measures to protect your personal information, including:

• Encrypted data transmission (HTTPS/TLS) across the entire Platform.
• Passwords are hashed using industry-standard bcrypt algorithms and are never stored in plaintext.
• Payment information is processed through PCI-DSS compliant Stripe infrastructure — we never see or store your full card numbers.
• Access to personal data is restricted to authorized personnel on a need-to-know basis.
• Regular monitoring for security vulnerabilities and unauthorized access attempts.

While we strive to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Essential Cookies: Required for the Platform to function. These include session tokens, authentication cookies, and CSRF protection. Cannot be disabled.
• Preference Cookies: Remember your settings, such as notification preferences, dismissed banners, and display preferences.
• Analytics Cookies: Help us understand Platform usage patterns. We may use aggregated analytics data to improve our services.

We do not currently use third-party advertising cookies or trackers. If this changes in the future, we will update this policy and provide appropriate notice and opt-out mechanisms.

8. Children's Privacy & Child Safety (CSAE)

Age requirement. PorchPickups is not intended for, marketed to, or designed for use by individuals under the age of 18. Users must be 18 or older to register or use the Platform.

No knowing collection from minors. We do not knowingly collect personal information from children under 18. If we discover that we have collected personal data from a child under 18, we will delete that information promptly and terminate the associated account. If you believe a child under 18 has provided us with personal information, please contact us at admin@PorchPickups.com.

Zero tolerance for child sexual abuse and exploitation (CSAE). PorchPickups has a zero-tolerance policy for content that depicts, promotes, solicits, or facilitates child sexual abuse or exploitation, including child sexual abuse material (CSAM). Any such content discovered on the Platform — whether through user reports, proactive review, or automated screening — is:

• Removed from the Platform immediately upon discovery.
• Reported to the National Center for Missing & Exploited Children (NCMEC) CyberTipline and to applicable law-enforcement authorities, as required by U.S. federal law (18 U.S.C. § 2258A) and equivalent obligations in other jurisdictions.
• The associated account is permanently terminated and the account holder banned from the Platform.
• Relevant information may be preserved and disclosed to authorities in support of investigation and prosecution.

Reporting CSAE on the Platform. To report suspected child sexual abuse or exploitation on PorchPickups, email admin@PorchPickups.com with the subject line "CSAE Report" and a URL or screenshot of the content. CSAE reports are prioritized and reviewed within 24 hours. You may also report directly to NCMEC at report.cybertip.org.

Compliance. PorchPickups complies with all applicable child-safety laws, including the Children's Online Privacy Protection Act (COPPA), 18 U.S.C. § 2258A (reporting obligations), and the EU Digital Services Act provisions on the protection of minors.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• No Sale of Personal Information: We do not sell personal information as defined by the CCPA.

To exercise your CCPA rights, contact us at admin@PorchPickups.com or submit a request through your account settings.

10. International Users

PorchPickups is operated from the United States. If you access the Platform from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Platform, you consent to this transfer and processing.

11. Third-Party Links and Services

The Platform may contain links to third-party websites or services that are not owned or controlled by PorchPickups. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you interact with.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Provide notice through the Platform (e.g., a banner or notification).
• For significant changes, send an email notification to registered users.

Your continued use of the Platform after changes take effect constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Thrift Trader LLC DBA PorchPickups.com
Email: admin@PorchPickups.com