This policy explains what personal information SecondKoat (“we”, “us”) collects through secondkoat.com and the SecondKoat apps, why, and the choices you have.
1. What we collect
- Account: name, email and/or mobile phone number, password (stored hashed by our authentication provider), and, if you use them, the name, email and ID shared by Apple, Google or Facebook sign-in.
- Listings: photos and details you enter. We re-encode photos and remove hidden metadata such as GPS location before they’re shown.
- Approximate location: the city and a location rounded to about 1 km for your pickup area, and (if you allow it) your device’s approximate location to show items near you. We never show your exact address.
- Messages: chats between buyers and sellers, which we may review to keep people safe, resolve disputes and prevent fraud.
- Orders and payments: what you bought or sold, amounts, fees, and status. Card details are collected and stored by Stripe; we never see your full card number. Sellers’ identity verification and bank details are collected by Stripe.
- Safety: reports, blocks, and moderation decisions.
- Device: push notification token if you allow notifications, and standard technical logs (IP address, device type, times) kept by our providers for security.
The website does not use advertising or analytics cookies.
2. How we use it
- to run your account, show listings, match buyers with nearby items, and send messages and notifications;
- to process payments, pickup confirmations, payouts and refunds;
- to review listings, investigate reports, prevent fraud and enforce our Terms;
- to meet legal, tax and accounting obligations.
We do not sell your personal information or use it for targeted advertising.
3. Who we share it with
- Other users: your display name, approved listings and pickup city are visible. The other person in an order sees your messages. Your email and phone number are never shown.
- Stripe processes payments and payouts and verifies sellers’ identity, under the Stripe Privacy Policy.
- Service providers: Google Firebase (accounts, database, storage, SMS codes, hosting of our servers in Canada), Netlify (website), Expo (push notifications), and Apple, Google or Facebook if you sign in with them. Some providers process data in the United States.
- Legal: if required by law, to respond to chargebacks, or to protect people’s safety.
- Business transfers: in a merger or sale, under this policy.
4. How long we keep it
We keep account information while your account is open. When you delete your account we delete your profile, listings and photos, close your conversations (the other person keeps their copy, shown as “Deleted user”), and delete your payout account with Stripe where possible. We keep order and payment records for up to 7 years, as tax and accounting laws require, and anonymised reports so safety reviews can finish.
5. Your choices and rights
- Update your name in the app; turn location and notifications on or off in your phone’s settings.
- Delete your account in the app (Account → Profile & account → Delete account) or see our data deletion page.
- Depending on where you live (for example under PIPEDA, Quebec’s Law 25, or U.S. state laws such as California’s), you can ask to access, correct, delete or port your information, or complain to a regulator such as the Office of the Privacy Commissioner of Canada.
SecondKoat is for adults (18+). We don’t knowingly collect children’s information.
6. Security
We use encrypted connections, access controls, server-side security rules, and an audit trail for staff actions. No service is perfectly secure; please use a strong, unique password.
7. Changes
We’ll post changes here and update the date above, and tell you in the app or by email if a change is significant.
8. Contact
support@secondkoat.com. We aim to reply within 30 days.