Privacy Notice

Applicability

Published by Dravara, LLC. This notice describes the scope and practices stated below. Publication does not activate an unavailable service or, by itself, establish a user's agreement to a contractual provision.

A contractual provision requiring your agreement applies only where there is a legally effective agreement and only to the extent permitted by applicable law. Nothing published here makes privacy rights, other nonwaivable rights or Dravara's legal obligations depend on your accepting a contractual provision.

Third-party names and marks remain their owners' property, and their appearance does not imply affiliation, sponsorship, endorsement or participation. A partnership, acquisition, licensing or other commercial relationship requires a separate written agreement.

What we handle today

• Account and sign-in. You can sign in with a one-time code sent to your email address or, where offered, with your Google account; WorkOS is our identity provider for both. With a code, we process your email address and the code. With Google, you are redirected through Google and WorkOS, and we receive your email address, the name on your Google account, a reference Google uses to identify your account, which we store as a keyed digest, and the sign-in method used. In both cases we create a session and keep security evidence about it. We use this to create and access your account, keep you signed in and protect the account from misuse; it is handled by Dravara, by WorkOS, and by Google when you choose Google; account information is kept for the life of the account and any legally required period, an unfinished sign-in expires after ten minutes, and session records are kept until you sign out or the session ends or is revoked; you may close your account through the methods in Privacy Requests.
• Sign-in rate-limit records. A keyed digest of the email address and of the network address, derived when you request a code, used only to limit repeated attempts; held by Dravara; the record is reset or superseded when its window passes, and a scheduled deletion batch for spent records is defined but is not enabled in this release; no choice applies because the control is a security measure.
• Essential request and security records. Request metadata needed to operate and secure the service, from your browser; held by Dravara and its hosting provider; kept for the period needed for security and legal purposes; no choice applies because these records are necessary to provide the service.
• Support and contact submissions. The contact details and message you send, from you, used to respond to and handle your request; held by Dravara and the provider that delivers the message; kept for the period needed to handle the request and any legally required period; you choose what to send.
• Saved drafts and account content. Content you enter into an available feature, from you, used to provide that feature; held by Dravara; kept while the account or draft exists; you may delete content the feature allows you to delete.
• Your profile and handle. The display name, short bio, general area, language and currency you set, and the handle you choose, from you. We use them to show your public profile and to let people find you. They are handled by Dravara, and your profile is public where you make it so. When you change your handle, your previous handle is held for 30 days so no one else can take it straight away. We keep your profile and handle history while your account exists. Closing your sign-in access doesn’t delete them. You can change them at any time.
• Organization handles. If you claim a handle for an organization, we receive the handle and the domain you name, and we check a record you publish in that domain’s DNS. We use them to confirm that you control the domain. They are handled by Dravara, and the check reads public DNS through the DNS resolvers we use. We keep the claim and its checks while your account exists. When a claim expires, its check code is cleared.
• Shopping agents you allow. The limits and approvals you set for agents that shop for you, from you. We use them to let an agent act only within what you approved, and to show what it did. They are handled by Dravara. We keep this record of what you allowed, and when, permanently, as a record of your instructions. It cannot be changed afterwards.
• Notifications and their settings. Your notification choices, the notices we show you, and whether you have read them. We use them to tell you about your orders, offers, messages and selling. They are handled by Dravara, and by the provider that delivers our email for the ones sent by email. We delete a notification 365 days after it last changed, once it has been delivered by email; marking it read counts as a change. Notifications shown only in the app are kept while your account exists. We keep your notification choices while your account exists.
• Who you follow and block. The sellers you follow and the people you block, from you. We use them to show you the sellers you follow and to keep blocked people from contacting you. They are handled by Dravara. Unfollowing or unblocking takes effect at once. We keep the record of the relationship while your account exists.
• Saved listings and searches. The listings and searches you save, from you. We use them to show them back to you. They are handled by Dravara. We keep each until you delete it, which you can do at any time.
• Closing your sign-in access. When you ask to close your sign-in access, we record the request and its progress. We use the record to carry it out and to show that we did. It is handled by Dravara and by our identity provider. We keep the record permanently. Closing your sign-in access closes your sign-in and deletes your sign-in contact information. Your profile, follows, settings and listing records are not currently deleted automatically. To request deletion of eligible personal information, use Privacy Requests.
• Your listings and photos. The listings you create, their details, photos and your shop logo, from you. We use them to show your listings to buyers. They are handled by Dravara, by our storage provider, and by our media scanning provider, which checks each photo. Listings you publish are public. A photo you remove from a draft, or a logo you remove or replace, is deleted within minutes. When you ask to delete a listing, we take it down and keep it, archived and private. We keep published listings and their photos while your account exists.
• Browser choices and theme. Your privacy choices and theme preference, stored in your browser rather than sent to Dravara as a profile; see the Cookie and Storage Notice for the exact records and how to clear them.
• Optional analytics is not enabled. Analytics ships disabled for this property in this release, so no analytics identifier is set and no PUPMKT analytics provider receives information. Page views are counted by Cloudflare Web Analytics, which the hosting platform runs for this site; it is cookieless, stores nothing on your device and does not follow you to other websites. The Cookie and Storage Notice describes it. If a later release enables it, we will revise this notice before that processing begins.
• Inactive checkout, tax, payout, advertising, affiliate-attribution, session-replay, precise-location and AI-provider features are deliberately absent from this table. They are not processing information today, and a policy describing one does not activate it.

How we use providers, and how we protect information

• We use service providers for the functions identified above, and they may handle personal information only to perform those functions for Dravara. Separately, we disclose personal information when required by law, and we may disclose it where necessary to investigate or address a specific security incident, suspected fraud, or an actual or threatened legal claim. Public content is visible only when a feature actually publishes it; a private account record or saved draft is not public merely because PUPMKT has received it. We keep information for the periods or criteria stated above, including any necessary legal hold, and take reasonable measures to protect it. No method of storage or transmission is completely secure.
• Privacy Choices explains current browser storage and measurement, and how to contact us about your information. To ask about your information or make a privacy request, use the methods in Privacy Requests. Rights depend on applicable law; requesting assistance does not require agreeing to optional tracking. We publish material changes and preserve prior notices in the Policy Archive. Where additional notice or consent is legally required, we provide it before the affected processing begins.

Sale and sharing

• We do not sell personal information. We share personal information only as needed for the purposes described in this notice or as required by law. We do not share personal information for cross-context behavioral advertising. There is no advertising, affiliate-attribution or session-replay technology in the shipped build, and optional analytics is disabled, so there is no such flow to opt out of. If that changes, we will revise this notice and provide the applicable choice before the processing begins.