Privacy Policy

Sofiaslist is built to collect as little personal data as possible. We don't run ad networks, sell your information, or build profiles on you. This policy explains exactly what we do collect and why, in plain language.

• When you post a listing: your contact email, the listing content (title, description, photos, price, city), and approximate location if you choose to add one.
• When you message a seller: the message text and a link to your account. Messages live in your inbox and the seller’s inbox; we store them only so both sides can keep the conversation. We do not read them, share them, or use them to train AI.
• When you create an account (required to post or message): your email address, and if you sign in with Google or X (Twitter), the basic profile info that provider returns (name, profile photo, provider user ID). We do not request friend lists, contacts, posts, or anything beyond what's needed to identify you. Authentication is handled by Supabase Auth; we never see or store any password.
• When you change your display preferences: your chosen UI language, avatar color, and notification toggles. These live in your account metadata and are only used to render the site for you.
• Automatically: standard server logs: IP address, browser type, pages visited, and timestamps. We also count listing views so sellers can see how much interest their post is getting. We do not use advertising trackers.

• To display your listing to other users and send you the management link.
• To deliver transactional emails: posting confirmation, expiry reminders, and saved-search alerts you explicitly signed up for.
• To run automated safety checks on listing titles and descriptions before publication, to detect potential scams. These checks run locally on our servers using a rules-based pattern matcher; no listing content is sent to any third-party AI provider for the scam check itself.
• To support optional AI features you explicitly opt into (drafting a description, suggesting a title, analyzing a photo). When you tap these features, the relevant inputs you provide (the title, photo, or notes you typed) are sent to the AI providers listed below. We do not send your contact email, IP address, or account identifiers along with them.
• To respond to support requests and feedback you send us.
• To produce anonymous, aggregated usage statistics so we can improve the service. We never sell or share individual-level data with third parties for marketing purposes.

• Supabase: stores listing data, user accounts, and uploaded photos (hosted on AWS). See supabase.com/privacy.
• Resend: sends transactional emails on our behalf. Your email address is shared with Resend solely to deliver messages you requested.
• Vercel: our hosting provider. Standard server logs may be retained per Vercel's policy.
• OpenStreetMap / Nominatim: if you use the location picker, your search query or approximate coordinates are sent to Nominatim for geocoding. OSM's usage policy applies.
• Cloudflare Turnstile: on forms that send messages or create reports, Turnstile collects a browser fingerprint and your IP address to verify you're human. No content of the form is shared.
• Cloudflare CSAM scanning: every photo uploaded to a listing is automatically scanned against the National Center for Missing & Exploited Children's known-hash database before it goes live. We are legally required to report confirmed matches to NCMEC. The hash check happens server-side; we do not share photo content with any other party as part of this scan.
• Google OAuth and X (Twitter) OAuth: if you sign in with one of these providers, we receive the basic profile fields they return (email, name, profile photo, provider user ID). No scope beyond identity is requested. Sessions are managed through Supabase Auth.
• Stripe: loaded on pages where a payment could occur (the job-posting flow). If you complete a checkout, your payment details are processed by Stripe under their own privacy policy; we never see your card number.
• Sentry: when something errors on the site we send an error report to Sentry to help us debug. Reports include the URL you were on, your browser, and the technical stack trace. They do NOT include form field values or your email address.
• Upstash Redis: rate-limit counters keyed by IP address, so we can stop abuse. The counter is short-lived and not joined to your account.
• Web push providers (Apple Push Notification service, Google Firebase Cloud Messaging, Mozilla autopush): if you opt in to push notifications, the browser registers an endpoint with the appropriate provider; we store that endpoint to deliver notifications.
• AI providers (optional, on-demand only):
  • Groq: when you ask us to draft a description, suggest a title, or analyze a photo (the Quick Post flow), the prompt and photo are sent to Groq for inference.
  • Hugging Face: when you ask us to classify a listing into a category, the title is sent for zero-shot classification.
  • MyMemory: when you tap the “translate this listing” button, the listing text is sent to MyMemory and may be cached publicly per their terms.
  These are only invoked when you explicitly tap the relevant action. Routine browsing, posting, and messaging do not send anything to AI providers.

• We use a single authentication cookie (set by Supabase Auth) if you sign in. This cookie is strictly necessary for your session.
• We use browser localStorage to save your in-progress listing as a draft so you don't lose work if you close the tab. This data never leaves your device.
• We do not use third-party advertising cookies, tracking pixels, or analytics SDKs that report back to external services.

• Listings expire automatically after 30 days and are removed from public view.
• You can remove your listing at any time from the management link in your confirmation email, or from My listings in your account.
• You can delete your account yourself: Settings → Danger zone. This permanently removes your listings, messages, favorites, saved searches, notification preferences, and account record. We confirm by asking you to re-type your account email.
• If you prefer email or need help with a deletion that the self-serve flow won't cover, contact privacy@sofiaslist.com; we respond within 30 days.
• Server logs are retained for up to 90 days.
• Soft-deleted listings (those you mark deleted from My listings) are kept in the database for up to 30 days for audit and undelete, then permanently erased.

Depending on where you live, you may have rights under GDPR, CCPA, or similar laws, including the right to access, correct, or delete your personal data, and to object to certain processing. To exercise any right, contact us at privacy@sofiaslist.com.

Sofiaslist is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us personal data, please contact us so we can delete it.

We use industry-standard measures to protect your data: HTTPS in transit, encrypted storage, and access controls limiting who can see your information. No system is perfectly secure, but we take reasonable steps to protect yours.

If we make material changes we will update the effective date at the top of this page and, where appropriate, notify account holders by email. Continued use of the site after any changes constitutes acceptance of the updated policy.