Privacy Notice

Account data: your name, email address, password (stored only as a one-way hash), and — if you add them — phone number, postal address, neighborhood, and approximate location.

Marketplace data: listings, photos, reservations, messages, reviews, reports, condition photos, and damage claims you create.

Payment data: payments are processed by our payment provider. We keep transaction identifiers, amounts, status, and, for each saved card, its brand, last four digits, and expiry. When you save a card with us rather than letting our provider hold it, we also store the card number itself — encrypted, with the key held outside the card database — so a later booking can be charged without you re-entering it. We never store a card's security code.

Technical data: session records, the network address a session was issued from (stored in a normalized form, so the same connection is one value), push tokens, and security audit events.

To create and secure your account, show listings near you, process bookings and payments, deliver messages and notifications, run the return inspection and damage-claim process, prevent fraud and abuse, and meet legal, tax, and accounting obligations.

Other members see your display name (or a neighborhood-only fallback), your listing details, reviews, and the messages you send them — never your legal name, email, phone, or exact address.

We share payment data with our payment provider, email and SMS content with the delivery providers that send it, and infrastructure providers that host the service. They process it on our instructions.

We disclose data when the law requires it, to enforce our Terms, or to protect a person's safety.

Account and marketplace records are kept while your account is active and for as long as needed for the purposes above, including resolving disputes and meeting tax and accounting rules. Security audit events and terms-acceptance records are kept for the period needed to evidence compliance.

Deleting your account removes or de-identifies personal data that is not required to be retained. Terms-acceptance records are never rewritten — identifiers may be redacted, but the accepted version and digest remain.

You can edit your profile, change your email through the verified change flow, turn marketing email off in settings, and request access to or deletion of your data by writing to [email protected]. Transactional messages (security codes, reservation updates) are part of the service and cannot be switched off while you have an account.

Passwords are hashed, sessions are bound to the network they were issued from where the deployment can determine it, and sensitive actions require re-verification. No system is perfectly secure; tell us immediately if you believe your account has been compromised.

Olympus Mons Technology LLC (NeighborBox) — [email protected]