Privacy Policy

Last updated: June 9, 2026

The short version:We collect only what we need to run the marketplace — your name, email, listings, and messages. We don't sell your personal information, we don't run advertising trackers, and you can delete your account (and its data) yourself at any time.

1. Who we are

This Privacy Policy describes how NRIBay ("NRIBay", "we", "us") collects, uses, shares, and protects personal information when you use nribay.com (the "Service"). It applies to all visitors and account holders. By using the Service you agree to this Policy.

2. Information we collect

Information you provide

Account information: your name, email address, and password (stored as a one-way hash — we never see your actual password).
Profile information: any optional details you add, such as an avatar or city/state.
Listings: titles, descriptions, prices, photos, and the city/state where the item is located.
Messages: conversations you have with other users through the Service.
Reviews and reports: reviews you leave for sellers and reports you file about listings or users.
Support requests: messages you send through the contact form.

Information collected automatically

Usage and device data: IP address, browser type, pages viewed, and timestamps, collected through standard server logs and our hosting provider for security, rate limiting, and debugging.
Cookies and local storage: used to keep you signed in and remember preferences such as your theme and selected states. See our Cookie Policy.
Approximate location: if you grant the browser geolocation permission, we use your coordinates once to suggest your state. Coordinates are not stored on our servers.

3. How we use your information

To create and manage your account, and to verify your email address;
To operate the marketplace — publish your listings, deliver messages, show reviews, and display your public profile (name, avatar, listings) to other users;
To send transactional emails (verification, password reset, notifications) and, where enabled, service announcements;
To protect the Service and its users — preventing spam, fraud, and abuse, enforcing our Terms, rate limiting, and moderating content;
To respond to your support requests;
To comply with legal obligations.

We do not sell or rent your personal information, and we do not use it for third-party advertising.

4. What other users can see

The Service is a public marketplace. Your name, avatar, reviews, and live listings (including photos and the city/state you enter) are visible to anyone on the internet. Your email address is never shown publicly. Direct messages are visible only to you, the other participant, and authorized administrators handling abuse reports or support issues.

5. How we share information

We share personal information only with:

Service providers that help us run the Service under contractual confidentiality obligations: Supabase (database, authentication, and file storage), Vercel (hosting), Cloudflare (Turnstile bot protection), and Resend (transactional email).
Law enforcement or authorities when required by law, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect the safety or rights of any person or to investigate fraud.
A successor entity in connection with a merger, acquisition, or sale of assets, in which case this Policy will continue to apply.

6. Data retention

We retain your information for as long as your account is active. If you delete your account from your dashboard, your profile, listings, photos, and messages are deleted. We may retain limited records (such as moderation logs or information needed to comply with legal obligations, resolve disputes, or enforce agreements) for a reasonable period afterward.

7. Security

We use industry-standard safeguards: encrypted connections (HTTPS), hashed passwords, row-level security on our database, rate limiting, and bot protection. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. Please use a strong, unique password and never share verification codes.

8. Your rights and choices

Access and update: you can view and edit your profile and listings from your dashboard.
Delete: you can delete individual listings or your entire account from your dashboard at any time.
Email: transactional emails (verification, password reset) are required to operate your account; announcement emails can be disabled where a preference is offered.
Cookies: you can clear or block cookies in your browser, though the Service will not function properly without essential cookies.
"Do Not Track" and Global Privacy Control signals: because we do not track users across third-party websites, do not sell or share personal information, and do not serve targeted advertising, there is no cross-site tracking activity for these signals to opt out of. We treat every visitor the same way regardless of whether such a signal is present. This disclosure is provided in accordance with the California Online Privacy Protection Act (CalOPPA).

9. U.S. state privacy rights (including California)

Depending on your state of residence (including California, Colorado, Connecticut, Texas, Virginia, and others with comprehensive privacy laws), you may have the right to: know what personal information we collect and how we use it (described in this Policy); access a copy of your personal information; correct inaccurate information; delete your information; and not be discriminated against for exercising these rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA). We therefore do not offer a "Do Not Sell or Share" opt-out because there is nothing to opt out of. We do not use or disclose sensitive personal information for purposes requiring a right to limit.

To exercise any right, use your dashboard's self-service tools or contact us through the contact page. We will verify your request using your account email and respond within the timeframe required by your state's law. You may use an authorized agent where permitted, subject to verification.

10. Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.

11. Users outside the United States

The Service is operated from and intended for users in the United States. If you access it from elsewhere, you understand that your information will be processed and stored in the United States.

12. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy here with a new "Last updated" date and, for material changes, provide additional notice. Continued use of the Service after changes take effect constitutes acceptance.

13. Contact

Privacy questions or requests? Reach us through the contact page or by email at [email protected].