Privacy
Covers the Barterbox website, marketplace, AI tools, and Reddit community app.
On this page · 11 sections
Account and profile data
When you create an account, we process identifiers and contact details such as your name, email address, authentication identifier, profile details, and account settings. We use them to authenticate you, operate your account, protect the service, and communicate about activity or support.
Listings, trades, and messages
We process the item text, photos, condition, price, category, listing status, offers, trade details, and messages you submit. Public listing fields are visible to marketplace visitors; account, draft, negotiation, and transaction records are limited to the people and service operators who need them. Avoid putting secrets or unnecessary personal information in a public listing.
AI and service providers
Text, photos, listing details, and relevant conversation context may be sent to configured AI inference, search, storage, observability, and browser-automation providers to perform the feature you request. We limit production traces so they do not intentionally include prompts, tool payloads, images, secrets, or direct identifiers. We use provider and operational data to deliver the service, measure usage, prevent abuse, and diagnose failures. We do not sell personal information or build advertising profiles.
Location data
Marketplace features use the city, region, postal area, search point, pickup area, or shipping address you choose to provide. Nearby search may send coordinates to the search service without adding them to your public listing. When you use Google-assisted meetup features, the selected meetup place or address text may be sent to Google Maps for suggestions, place details, geocoding, and address validation. Google handles information it receives under the Google Privacy Policy. Public listing output uses a deterministic coarsened containing circle and never exposes the trader's stored point; exact meetup facts and provider identity remain participant-private.
Google public-label coordinate cache entries use a 29-day expiry and are never served after their 29-day expiry. Participant-private Google meetup coordinates use the same 29-day availability boundary and are likewise unavailable after expiry, without removing participant-confirmed agreement facts or legal actions. Healthy hourly maintenance targets physical cleanup before day 30. After a delayed or failed run, physical deletion of cache coordinates and clearing of meetup provider coordinates are verified only after the next successful maintenance run and readback.
Raw predictions, autocomplete session tokens, and full address-validation responses are not retained. A server-only one-use digest derived from an autocomplete session is valid for at most ten minutes and is removed by the next successful hourly maintenance run; it contains no raw token, query, or address. OIDC assertions and Google OAuth access tokens are in-memory authentication material and are not persisted or logged. Raw Places, Geocoding, Address Validation, and unused upstream payloads are not persisted or logged. An opaque Google Place ID and the place facts participants confirm may be retained where Google policy permits. These are Barterbox retention controls; Google's handling is governed by the Google Privacy Policy.
Address validation is advisory and does not prove a place is safe, public, or accepted, verify identity, or replace the second participant's acceptance. You can always use a custom, unverified meetup location without Google assistance. Public listings should use a coarse area, not a home address. We use shipping addresses only to arrange a requested transaction, label, delivery, or related support. The Reddit tagging path uses only an explicitly written coarse region code; it does not geocode text or infer location from an IP address.
Payments and shipping
Payment providers process card or bank details; Barterbox receives transaction identifiers, status, amount, fee, credit-balance, and reconciliation records rather than full payment-card numbers. Shipping providers receive the contact, address, parcel, and tracking information needed to quote, buy, and manage a label. Their privacy policies also apply to information they process.
Reddit community app
The Reddit app watches activity only in communities where moderators install it. When a qualifying post or comment invokes Barterbot, the app sends the item’s title, body, identifiers, community name, and permalink to the authenticated reply service to generate one public, visibly AI-attributed response. The shipped installation is forr/barterbot.
Reddit retention and controls
Redis stores an opaque Reddit item identifier for up to seven days to prevent duplicate replies. A normalized trade-tag record may keep the post identifier, finite intent or category, explicit coarse region, delivery scope, source, and timestamp for up to 180 days; it does not store the post body, title, author name, precise location, or permalink. Moderators can disable automatic replies or tagging, Reddit deletion events remove related control records, and removing the app stops new processing by that installation.
Retention, security, and sharing
We retain records for as long as needed to operate the feature, maintain transaction and security history, meet legal obligations, resolve disputes, and enforce agreements. We share data with counterparties when you direct a transaction, with service providers acting for us, or when required to protect users, the service, or the law. We use access controls, encryption, and monitoring appropriate to the data, but no system is perfectly secure.
Your controls
You can update account and listing details in the product. You may ask us to access, correct, or delete personal information, subject to records we must retain for security, transactions, disputes, or legal obligations. Disconnecting an integration stops new access through it but does not automatically erase records already needed for those purposes.
Facebook connection and deletion
If you choose to connect Facebook, Supabase links that identity to your Barterbox account. If you then choose to find friends, we use the permission you grant to match friends who also use our Facebook app to Barterbook profiles you can see. We do not store an imported friend list, post to Facebook, or send friend requests automatically. You can remove Barterbox from Facebook's Apps and Websites settings to stop future access. To request deletion of data associated with your Facebook connection or your Barterbox account, email support@barterbox.app from your account email, with the subject “Facebook data deletion”. Do not include your password or access tokens. Records needed for transactions, disputes, security, or legal obligations remain subject to the retention limits described above.
Contact
For a privacy question or deletion request, email support@barterbox.app. Include only the account, listing, transaction, or Reddit identifier needed to locate the relevant record.