Privacy policy
Last updated October 26, 2026.
What we collect
- Account: your email, password (stored hashed by our auth provider), first name and neighbourhood.
- Hosts: listing details, an optional photo, a map location that is moved 400 to 800 m for neighbours, and a private delivery address shown only to receivers you accept. Shops can choose to show an exact public address.
- Packages: carrier, optional tracking number, description, size, status, optional photo taken by the host, and the fee.
- Messages between a receiver and a host, plus reports, blocks and feedback you send.
- Usage events: page or screen name, a random id that lasts one browser tab, and whether you are on mobile or desktop. No cookies, no IP addresses stored, no advertising trackers.
Who sees what
Host listings are public. Your delivery address is visible only to receivers you accepted. Pickup PINs are visible only to the receiver. Package photos are private to the receiver and the host. Messages are visible only to the two people in the chat and, for reported messages, to our team.
ID verification
To get a Verified badge, you verify your identity with our verification partner Didit (didit.me), using a photo of a government ID and a selfie. Didit processes those images under its own privacy policy. Verification is required before going live as a host and optional for receivers. We never receive or store your ID images or document details. We only store your verification status (for example verified or not), the date, and a Didit session reference.
Where it lives
Data is stored with Supabase in the United States (us-east-1). Maps use OpenStreetMap tiles, which receive your IP address when loading the map.
Deleting your data
Me, Delete my account permanently deletes your account, profile, host listing, private address, packages, PINs, messages, notifications, reviews you wrote and uploaded photos. Payment ledger rows are kept without your identity for host accounting.
Contact
Questions or privacy requests: use our contact form.