At Thriftly, we value and respect your privacy. This Privacy Policy explains how Thriftly LLC ("Thriftly," "we," "us," or "our") collects, uses, stores, shares, and protects your personal information when you access or use the Thriftly platform and related services (collectively, the "Services"). By using our Services, you consent to the practices described in this Privacy Policy. If you do not agree, you must not use our Services.
This Privacy Policy is incorporated into and forms part of our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.
We collect information you provide directly, information generated through your use of the Services, and information from third-party partners.
Account Information: When you register, we collect your legal first and last name, university or college email address, password, and profile picture.
Listings and Photos: When you post a listing, we collect item descriptions, photos, pricing, and category information.
Messages: We store messages sent between users through the in-app messaging feature.
Payment Information: When you make or receive payments, our payment processor Stripe, Inc. ("Stripe") collects your payment card details, bank account information (for sellers), and billing information. Thriftly does not directly store raw payment card numbers. All payment data is handled by Stripe in accordance with their Privacy Policy and PCI-DSS compliance standards. We do store transaction records, including amounts, dates, item references, and transaction status.
Identity Verification: Sellers connecting a Stripe Connect account may be required by Stripe to provide government-issued identification and other verification information. This information is collected and stored by Stripe, not Thriftly.
Communications: If you contact us for support or submit a dispute, we collect the contents of your communications and your contact information.
Usage Data: We collect information about how you interact with the Services, including pages or features accessed, search queries, listing views, and timestamps.
Device Information: We may collect device type, operating system, browser type, IP address, and unique device identifiers.
Cookies and Similar Technologies: We use cookies and similar tracking technologies to maintain session state, remember preferences, and analyze usage patterns. You can control cookie settings through your browser, though disabling cookies may affect the functionality of the Services.
Stripe: We receive transaction status updates, payout confirmations, and fraud signals from Stripe in connection with payment processing.
University Verification: We use your university or college email address to verify your enrollment status. We do not receive data directly from your institution.
We use the information we collect for the following purposes:
To provide the Services: Creating and managing your account, enabling listings, facilitating messaging, and processing transactions including escrow and payouts.
To process payments: Transmitting payment information to Stripe, holding funds in escrow, releasing funds upon transaction completion, and processing refunds.
To verify eligibility: Confirming that users are enrolled students with a valid university or college email and are at least 18 years of age.
To ensure safety and prevent fraud: Monitoring for prohibited content, fraudulent transactions, abuse of the Verification Code system, and other violations of our Terms of Service.
To communicate with you: Sending transaction confirmations, Verification Codes, dispute updates, policy change notices, and support responses.
To improve the Services: Analyzing usage data and feedback to troubleshoot issues, develop new features, and improve platform performance.
To comply with legal obligations: Retaining records as required by applicable law, responding to lawful requests from government authorities, and reporting illegal content such as CSAM to the appropriate authorities.
We do not sell your personal information. We share your information only in the following circumstances:
Stripe: We share payment-related information with Stripe to process transactions, manage escrow, and facilitate seller payouts. Stripe's use of your information is governed by Stripe's Privacy Policy, available at stripe.com/privacy.
Other Users: Your public profile information (name, profile picture, listings) is visible to other verified Thriftly users on your campus. Messages you send are visible to the recipient. Your identity is not disclosed to other users beyond what you choose to share on your profile.
Service Providers: We may share information with trusted third-party vendors who assist us in operating the Services, such as cloud hosting, analytics, and customer support tools. These providers are contractually obligated to protect your information and may not use it for their own purposes.
Legal Requirements: We may disclose your information if required to do so by law, court order, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Thriftly, our users, or the public.
Child Safety Reporting: We are required by law to report child sexual abuse material (CSAM) and related content to the National Center for Missing and Exploited Children (NCMEC) and applicable law enforcement. This may involve sharing account information associated with such content.
Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.
Thriftly uses Stripe to handle all payment processing. Stripe is a PCI-DSS Level 1 certified payment processor, which is the highest level of certification available in the payments industry. This means:
Thriftly does not store, process, or transmit raw payment card numbers on our servers.
All card data is tokenized and handled directly by Stripe's secure infrastructure.
Thriftly retains only transaction metadata (amounts, dates, status, and item references) necessary to operate the escrow and buyer protection systems.
For more information on how Stripe handles your payment data, please review Stripe's Privacy Policy at stripe.com/privacy.
We retain your personal information for as long as necessary to provide the Services and fulfill the purposes described in this Privacy Policy, including:
Account Information: Retained for the duration of your account and for up to 3 years after account deletion, as required for legal and dispute resolution purposes.
Transaction Records: Retained for a minimum of 5 years to comply with applicable financial recordkeeping requirements.
Messages: Retained for the duration of your account and for up to 1 year after account deletion, unless earlier deletion is requested and legally permissible.
Listings: Active listings are visible while your account is active. Inactive or removed listings may be retained in our systems for up to 1 year for audit and dispute purposes.
After the applicable retention period, we will delete or anonymize your information in accordance with our internal data management procedures.
We implement reasonable technical and organizational measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (TLS), secure cloud storage, access controls, and reliance on Stripe's PCI-DSS compliant infrastructure for all payment data.
However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.
Depending on your location, you may have the following rights regarding your personal information:
Access: You may request a copy of the personal information we hold about you.
Correction: You may update or correct inaccurate account information directly within the app or by contacting us.
Deletion: You may request deletion of your account and associated personal data. Note that we may be required to retain certain information for legal or financial compliance purposes as described in Section 5.
Data Portability: You may request a copy of your data in a machine-readable format where technically feasible.
Opt-Out of Non-Essential Communications: You may opt out of promotional communications by following the unsubscribe instructions in any email we send. Transactional communications (e.g., Verification Codes, dispute updates) are necessary for the Services and cannot be opted out of while your account is active.
Cookie Preferences: You can manage cookie settings through your browser or device settings.
To exercise any of these rights, please contact us at thriftly.help@gmail.com. We will respond to verified requests within 30 days.
California residents have the following additional rights:
Right to Know: You have the right to know what personal information we collect, use, disclose, and sell (we do not sell personal information).
Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
Right to Correct: You have the right to request correction of inaccurate personal information.
Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
To submit a CCPA request, contact us at thriftly.help@gmail.com. We will verify your identity before processing your request and will respond within 45 days as required by law.
Thriftly is intended exclusively for users who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will promptly terminate their account and delete their personal information. If you believe a minor has created an account on Thriftly, please contact us immediately at thriftly.help@gmail.com.
The Services may contain links to third-party websites or integrate with third-party services such as Stripe. This Privacy Policy applies only to information collected by Thriftly. We are not responsible for the privacy practices of any third-party services, and we encourage you to review their privacy policies before providing any personal information.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where feasible, notify you through the app or via the email address associated with your account. Your continued use of the Services after any changes constitutes your acceptance of the updated Privacy Policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Thriftly LLC
Email: thriftly.help@gmail.com