Privacy Policy

1. Information We Collect

a. Information You Provide

We collect account details (name, email, password, phone number, location), listing info (photos, descriptions, pricing), transaction details, and messages.

b. Automatically Collected Information

We may collect device info (IP, OS), usage data (page views, features used), and location (if enabled).

2. How We Use Your Information

To operate and improve the app, enable transactions, personalize your experience, communicate with you, detect fraud, and comply with legal obligations.

3. Third-Party Services

a. Stripe

We use Stripe to process payments and seller payouts. Stripe receives your name, email and phone number, the card details you type into the payment form, order amounts, the store name and order ID we attach to payments, and the business and identity details a seller enters during payout setup. Stripe's own code runs on our website's checkout, card and payout setup screens and inside our mobile app, and can collect details about your browser or device to help stop fraud. Stripe handles it per their policy.

b. Supabase

We use Supabase to host our database and to handle sign-in and file storage, so it holds your account details, listings, orders, messages and the photos you upload. Supabase handles it per their policy.

c. Twilio

We use Twilio to deliver one-time SMS verification codes. Your phone number is passed to Twilio only to send that code, and is handled per their policy.

d. OpenAI

We use OpenAI to read a listing photo and suggest what it shows, to draft and check listing text, to match help searches, and to check new shelf names. OpenAI receives the photo, the listing details you type (such as the title, tags, category and unit), your help search text, and proposed shelf names. We don't add your name, email or account to these requests. We send these through OpenAI's business API, so OpenAI's consumer privacy policy does not cover them. By default OpenAI does not use API data to train its models. It keeps API data in abuse-monitoring logs for up to 30 days, or longer if the law requires it. Read OpenAI's API data controls.

e. Google Maps Platform

We use Google for maps, address search and travel routes. Our servers send Google the address or place text you type, and map points for routes, such as your starting point, a store's location, delivery stops and the places you pick for your search area. On our website, maps and the use-my-location lookup load from Google in your browser, so Google receives your IP address, your browser details and the area of the map you're viewing and, for that lookup, your device's location. In the Android app, maps are Google Maps, so Google sees the area you're viewing there too. Google handles this per their policy.

f. OpenStreetMap

When a seller types in a store's address by hand, we find its map point with Nominatim, the OpenStreetMap search service, which receives the address text only. If Nominatim can't place the address or doesn't answer in time, we ask Google instead. Nominatim handles it per the OpenStreetMap Foundation's policy.

g. Expo

We use Expo to deliver push notifications and updates to our mobile app. Once you turn notifications on, the app sends Expo your device's push token, an ID for your install of the app, your phone's platform and our app's ID. It sends them again when you open the app if a week has passed or the token has changed, even after you turn notifications off or sign out. For a notification, Expo receives your device's push token and the notification's title and text, which can include names, store names, order items and a reason given for a cancellation. It also receives the IDs of what the notification is about, such as an order ID, and sometimes a link to the buyer's profile photo or to the store's photo. Expo passes them to Apple or Google for delivery. When the app checks for an update, Expo receives your IP address, a random ID for your install of the app, your phone's platform and which version of the app you have. If the app crashes while it's starting, its next update check can also send Expo the error message. Expo handles this per their policy.

h. Cloudflare

We use Cloudflare Turnstile to check that a sign-in request comes from a person. If sign-in asks you to show you're a person, Cloudflare's check runs in your browser or in the app and sends Cloudflare your IP address and browser details. Our server then sends Cloudflare the check's result and your IP address to confirm it. Cloudflare handles them per their policy.

i. Amazon Web Services

We use Amazon Simple Email Service to send dispute decision emails. It receives the buyer's and seller's names and email addresses, the order number and the decision text, and handles them per the AWS policy.

j. US Census Bureau

When a seller saves a store location, we ask the Census Bureau's TIGERweb map service for the water outlines of the area around it. It receives the corners of a map square, roughly 20 to 30 km across, that contains the store, and handles them per the Census Bureau's policy.

k. Apple and Google sign-in and phone services

If you sign in with Apple or Google, that company runs the sign-in and shares your name and email address with us. In our mobile app, when you ask to use your current location, your phone's own lookup service turns it into an address, and that sends the location to Apple on an iPhone and to Google on most Android phones. On an iPhone, maps are Apple Maps, so Apple sees the area you're viewing. Apple handles its part per their policy.

l. Vercel

Our website runs on Vercel. Every request you send to our website passes through Vercel with your IP address and device details. Vercel handles this per their policy.

m. Northflank

Our servers run on Northflank. Every request the app or your browser sends to our servers passes through Northflank with your IP address and device details, and our server request logs record your IP address. Northflank hosts our servers and processes this data on our behalf. Read Northflank's privacy policy.

4. How We Share Your Information

We do not sell your data. We may share info with users (e.g. listings), service providers, authorities if required, and during business transfers.

5. SMS & Text Messaging

When you sign in with your phone number, we send a one-time verification code by SMS through our messaging provider, Twilio. Your mobile number is used to authenticate you and secure your account — we never send marketing texts. You receive one message per sign-in request; msg & data rates may apply. Reply STOP to opt out or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties.

6. Your Choices & Rights

You can edit your profile, delete your account, change app permissions, unsubscribe from emails, and opt out of SMS by replying STOP. In some regions, you have additional rights like access, deletion, and data portability.

7. Data Retention

We keep your data while your account is open, and longer where we need it to meet legal obligations or resolve disputes.

a. When you delete your account

Right away, the name on your account is replaced with "Deleted user", your email, phone number, profile photo and payout setup are removed from it, and your listings are taken down. The delivery address and note in your baskets are cleared. A saved address is deleted, or, if a past order or anything else on the app still points at it, cleared of everything but its map point. Your past orders, reviews and order messages stay, shown under the name "Deleted user", so the other person keeps their record. A store's public details stay too, because past orders show them. A store also keeps its private address and its exact map point for past orders, while a pickup address it shared only with buyers who paid loses its street, city, state and zip but keeps its exact map point.

b. About four months later

About four months (120 days) after an order closes, we clear what you added to it. If you were the buyer, that includes the delivery address and note you gave and where a drop-off photo of it was taken. Either way, it includes the text you wrote in its order messages, review, reply and dispute, and your photos on it. The order itself stays: who bought what, when and for how much. An order isn't cleared while a dispute or a card chargeback on it is open, and the four months count from when the order closed or when its last dispute or chargeback was settled, whichever is later. If a chargeback ends with the bank giving the buyer their money back, the order is never cleared, unless it was refunded while the bank was deciding.

c. Photos

Photos you uploaded can stay in our storage after your account is deleted.

d. Fraud checks

When an account is deleted we keep a one-way hash of its email and phone number, and the IDs of its Stripe account and Stripe customer record, so we can recognize an account that was closed for fraud.

e. What else stays

Some things stay as they are: your follows, favorites and saved lists, any unfinished Express listing drafts with their text and photos, the notifications in your account, the start and end points of trips you planned at checkout, and any report you made about a store, a listing, a review or a message, with the words you wrote in it. Messages and notifications the app already wrote can still show your details, such as pickup instructions that include your first name, or the other person's notification of a new order from you or of a reason you gave for cancelling. A review from before reviews were linked to orders isn't cleared later.

8. Security

We use best practices to secure data but cannot guarantee complete security.

9. Children's Privacy

EZHomesteading is not intended for users under 13 (or 16 where applicable). We do not knowingly collect data from children.

10. Cookies and Similar Technologies

We use cookies and similar technologies (such as local storage) only where necessary to operate and secure our app and website. These technologies help authenticate users, maintain session state, and protect against unauthorized access.

We do not use cookies for advertising, analytics, or tracking purposes.

If we expand our use of cookies in the future for additional purposes, such as improving user experience or gathering usage insights, we will update this policy accordingly and, where required by law, obtain your consent.

11. Changes to This Policy

We may update this policy. Material changes will be communicated through the app or email.

12. Contact Us

📧 privacy@ezhomesteading.com 📍 2400 Hampton Blvd, Norfolk, VA 23517