Privacy Policy

Last updated: 2026-05-21

What we collect

Account identity. When you sign in with your Lawrenceville Google account we receive your @lawrenceville.org email and the display name on your Google profile. We use this to enforce the school-domain gate and to label your listings, messages, and reviews.
Content you create. Listing titles, descriptions, media you upload, direct messages, comments, and reviews are stored so they can be shown to other Lawrentians.
Limited network metadata. Your IP address is used transiently for rate limiting and abuse prevention. We do not persist IPs alongside your account.
Operational logs. Standard server logs (route, status code, error message) are captured for debugging. PII in request bodies and headers is scrubbed before being sent to our error monitor (Sentry).

How we use it

Operate the marketplace: render listings, deliver messages, and connect buyers with sellers.
Send transactional email notifications (new message, new comment, new follower, new listing from someone you follow). You can disable any of these in Settings.
Detect and respond to abuse — for example, content moderation keyword scans, fresh-account cooldowns, and the report / block flow.
Compute aggregate statistics (e.g. school-wide savings totals).

We do not sell your data, share it with advertisers, or use it for cross-site tracking.

Retention

Direct messages: retained for ~180 days from the last activity in a thread, then eligible for purge.
Listings and profile data: retained for the lifetime of your account.
Deletion: when you delete your account from Settings, your profile, listings, and direct messages are removed. Counterparty messages in shared threads are kept (so the other student sees the conversation wasn't deleted from underneath them) but show as “Deleted account.”

Your rights

Access / export: you can see everything we store about you on your profile page and in Settings. Contact the admin (below) to request a structured export.
Correction: edit your profile, listings, and notification preferences in Settings.
Deletion: use “Delete account” in Settings, or contact the admin.
Report:the Report button on a user's profile or in any DM thread sends an anonymous flag to moderators. Use unfollow to remove a user's listings from your feed.

Questions or requests: email the marketplace administrator (the school's IT contact for this site). A specific contact address is published in Settings.

Cookies and tracking

We use one first-party cookie set by Supabase to keep you signed in. We do not use third-party analytics cookies, advertising pixels, or cross-site trackers. Vercel Analytics, used for traffic counts, runs cookieless.

Security

All traffic is served over HTTPS. Sign-in uses Google OAuth (no passwords stored on our side). Sensitive content is protected by row-level security policies in the database. We follow current best practices for rate limiting, CSRF protection, content sanitization, and image upload validation. No system is perfectly secure; we will notify affected users in the event of a material breach.