Privacy Policy

We collect what we need to run the Service — nothing more. Your birth year is never public. Your exact GPS coordinates are stored but only an approximate area (within ~1 km) is shown on listings. We don't sell your data. You can ask for a copy or deletion at any time.

Okanagan Marketplace (“we”, “us”) is a community-owned online marketplace based in Kelowna, British Columbia. For privacy questions, our point of contact is at the bottom of this page.

We only collect what's needed to run the marketplace:

• Email — to log you in, send verification messages, and contact you about your account.
• Password — stored as a one-way bcrypt hash. We never see, store, or transmit your plain password.
• Name & profile photo — shown publicly on your listings, reviews and messages so neighbours know who they're dealing with.
• Birth year — used only to verify you are 18+. Never shown publicly. We don't use it for advertising.
• Approximate & exact location — neighbourhood (text) plus optional latitude/longitude. Exact coordinates power the distance filter on browse; only an approximate area (within ~1 km) is shown on a listing's map.
• Your listings, messages, reviews, favourites, and reports — to run the marketplace itself.
• Technical info — basic logs (IP address, browser, timestamps) needed to operate the Service and detect abuse.

By creating an account, you consent to us collecting and using your information as described in this policy. You can withdraw consent at any time by deleting your account — this will end your access to the Service.

We'll ask for separate, explicit consent before we collect any new category of data not covered here.

Public to everyone:

• Your name, profile photo, neighbourhood (text), join date.
• Your listings, including photos, price, title, description, category.
• Reviews you give and receive.
• Approximate map location of your listings (within ~1 km).

Private to you:

• Email address, password hash, birth year, exact GPS coordinates.
• Messages between you and other users (visible only to the two parties; admin/moderators can review reported threads).
• Favourites / saved listings.
• Reports you file against listings.

We don't sell your data. We don't share it with advertisers. Limited disclosure happens only in these cases:

• To service providers we use to run the platform (e.g. database hosting, file storage, email delivery) under privacy obligations.
• When required by Canadian law, court order, or to protect the safety of our community.
• If we transfer the Service to a new operator, your data may move with it, subject to the same privacy commitments.

We keep your data while your account is active. When you delete your account:

• Your profile, listings, and favourites are removed within 30 days.
• Messages and reviews remain visible to the other party but are anonymised on your side.
• We may keep minimal records (e.g. audit logs, fraud/abuse history) for up to 24 months where required by law or to protect the community.

Under Canadian privacy law (PIPEDA) you have the right to:

• Access a copy of the personal information we hold about you.
• Correct inaccurate information — you can update most of this directly from your Profile page.
• Delete your account and associated personal data.
• Withdraw consent by deleting your account.
• Complain to us or to the Office of the Privacy Commissioner of Canada.

Email us using the contact below and we'll respond within 30 days.

We take reasonable steps to safeguard your information:

• Passwords are stored as bcrypt hashes — never in plain text.
• Traffic between your device and the Service is encrypted over HTTPS.
• Authentication uses signed, expiring JWT tokens.
• Database access is restricted and audited.
• Sensitive data such as your exact GPS coordinates and birth year is never returned in public API responses.

No internet service is 100% secure. If we discover a data breach that puts your account at real risk, we'll notify you promptly as required by Canadian law.

We use a single first-party cookie (and a localStorage fallback) to keep you signed in. We don't run third-party analytics, ad networks, social-media trackers, or fingerprinting scripts.

OpenStreetMap tiles on listing maps are fetched from tile.openstreetmap.org — that request includes your IP address (standard for any map service) but no account identifiers.

The Service is for adults only. You must be at least 18 to create an account. We don't knowingly collect personal information from anyone under 18. If you believe a minor has created an account, please report it and we'll remove it immediately.

Your data is processed and stored in Canada and, where necessary, on cloud infrastructure provided by Canadian or US-based vendors operating under appropriate privacy commitments. By using the Service you understand that your information may be transferred outside the province of British Columbia for processing.

We may update this Privacy Policy from time to time. We'll post the new version here and update the “Last updated” date. Material changes will be flagged in your account.

Privacy questions, access requests, deletion requests, or complaints: owen.acker@gmail.com

You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada.