Privacy Policy

Effective Date: October 27, 2026

This Privacy Policy explains what information DiscandDeck LLC ("DiscandDeck," "we," "us") collects when you use discanddeck.com and our marketplace services, how we use and share that information, and the choices you have.

If you have any questions or requests regarding your personal information, contact us at [email protected].

1. Information We Collect

Information You Provide Directly

• Account Information: Email address and account password. Account passwords are encrypted and managed securely through our backend authentication provider (Supabase); we never store or view plain-text passwords.
• Public Profile: Username, display name, profile avatar/photo, bio, and general location (such as city and state).
• Listings: Item titles, descriptions, pricing, condition ratings, photos, and ship-from ZIP code. Uploaded listing images are automatically processed to remove hidden metadata (such as EXIF GPS location data) prior to storage.
• Communication & Feedback: Public listing questions, answers, private order messages, user ratings, and reviews.
• Seller Details: PayPal merchant identification details upon account connection; ship-from address and phone number; and integration authorization tokens if you connect a Shippo shipping account.
• Support Messages: Name, email address, message details, and a hashed copy of IP address (used strictly for rate limiting) when submitting a contact form.

Information Collected From Transactions

• Order History: Purchased items, price breakdowns, marketplace fees, sales tax collected, transaction dates, and tracking statuses.
• Shipping Information: Buyer full name and delivery shipping address (provided securely by PayPal upon payment checkout).
• Shipping & Tracking Data: Package tracking numbers, shipping carrier details, and real-time transit/delivery status updates retrieved via integrated shipping carriers or Shippo.
• Payment References: PayPal payment reference IDs. DiscandDeck never receives, processes, or stores your credit card, debit card, or bank account numbers—all sensitive financial processing is executed directly by PayPal.

Automatically Collected Technical Data

• Server Logs: IP address, browser user-agent, device characteristics, operating system, referring pages, and timestamped API requests logged for security auditing, rate limiting, and system troubleshooting.
• Browser Local Storage: Browser local storage used to maintain your signed-in user session and to remember your last shipping ZIP code at checkout, the ship-from ZIP code on your listings, and a last-visited timestamp. This information stays in your browser. DiscandDeck does not deploy third-party tracking cookies or cross-site behavioral advertising cookies.

2. How We Use Your Information

We use the information we collect solely to provide, support, and secure the DiscandDeck marketplace:

• Operating the Marketplace: Displaying listings, processing user offers and orders, enabling direct seller-to-buyer fulfillment, generating shipping labels, and updating order delivery statuses.
• Transactional Email Notifications: Sending automated transactional email receipts, sale notifications, shipping updates, offer alerts, and support responses via Amazon Web Services Simple Email Service (AWS SES). Notification preferences for non-essential alerts (like questions and offers) can be managed in account Settings; essential account and order status emails cannot be turned off.
• Marketplace Safety & Security: Preventing illegal activities, detecting fraud or abusive conduct, verifying seller eligibility, and enforcing our Terms of Service.
• Legal & Tax Compliance: Calculating state marketplace facilitator sales tax, maintaining accounting ledgers, and fulfilling state and federal tax recordkeeping obligations.

3. Who Sees Your Information

• Public Users: Anyone visiting the site can view your public profile (username, display name, profile photo, bio, seller badge level, feedback ratings, and transaction counts), your active listings, and public Q&A posted on listing pages.
• Counterparties in an Order:
  • Sellers receive the buyer’s full name and delivery shipping address to fulfill and ship the order.
  • Buyers see the seller’s name and return address printed on the physical shipping label.
  • Private order messages are visible only to the buyer, seller, and DiscandDeck support administrators when assisting with disputes.
• Infrastructure Service Providers: We rely on trusted third-party cloud service providers to operate DiscandDeck under strict confidentiality standards:
  • Supabase: Core database management, authentication, and user photo asset storage.
  • Cloudflare: DNS routing, web hosting, asset caching, and security edge protection.
  • PayPal: Merchant onboarding, payment checkout processing, and purchase protection claims.
  • Shippo: Shipping label rate quotes, label generation, and carrier tracking updates.
  • Amazon Web Services (AWS SES): Delivery of automated transactional emails and support message routing.
• Legal Compliance & Protection: We may disclose account or order information if required to do so by subpoena, court order, or applicable law, or when we reasonably believe disclosure is necessary to protect the rights, property, or safety of DiscandDeck, our users, or the public.
• Business Transfers: If DiscandDeck LLC is involved in a merger, acquisition, reorganization, or sale of assets, user data may be transferred as part of that business transaction under the same privacy commitments set forth in this policy.

We do not sell, rent, or trade your personal information to third parties, nor do we share your information with third parties for cross-context behavioral or targeted advertising.

4. Data Retention

• Account Data: We retain your account profile and listing data for as long as your account remains active.
• Order & Financial Records: Order records, tax ledgers, transaction references, and payment totals are retained for seven (7) years following transaction completion to satisfy legal, audit, IRS Schedule C, and state sales tax recordkeeping requirements.
• Email Logs: Operational logs for sent transactional emails are purged automatically after 90 days.
• Support Inquiries: Contact form submissions and support correspondence are kept as long as needed to resolve your support request.
• Account Deletion: If you close or delete your account, your public profile and active listings are permanently deleted or anonymized, excluding transaction and tax records we are legally mandated to retain.

5. Your Rights and Choices

• Account Settings: You can review, update, or edit your profile information, display name, bio, photo, and notification preferences at any time in your user Settings dashboard.
• Data Access & Deletion Requests: You may request a copy of the personal information we hold about you, or request that we update or delete your information, by emailing [email protected]. We will verify your identity and respond within thirty (30) days.
• State Privacy Rights: Depending on your state of residence (e.g., California, Virginia, Colorado), you may possess statutory rights to access, correct, delete, or obtain a portable copy of your personal data, and to exercise these rights without discrimination.

6. Security Standards

We implement administrative, technical, and physical safeguards designed to protect personal data, including transit-layer encryption (HTTPS / TLS), role-based database access controls in Supabase, and edge security provided by Cloudflare. However, no online service or data transmission is 100% immune to risk; we encourage you to protect your account by choosing a strong, unique password.

7. Children's Privacy

DiscandDeck is strictly intended for adult users aged 18 and older. We do not knowingly solicit or collect personal information from individuals under the age of 13. If you believe a minor under 13 has provided personal data to DiscandDeck, please contact [email protected] so we can delete the information immediately.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect site changes, legal updates, or service modifications. If material changes are made, we will notify you by email or via a prominent notice on discanddeck.com at least thirty (30) days prior to the effective date.

9. Contact Us

For privacy inquiries, data access requests, or legal questions:

• Privacy Email: [email protected]
• Support Email: [email protected]
• Company: DiscandDeck LLC, Sioux Falls, SD 57105