Privacy Policy

1. Information we collect

We may collect:

• Account data: name, email, password (hashed), and profile details you provide.
• Order data: shipping and billing address, phone number, items purchased, amounts, and order history.
• Payment data: payment method details are typically processed by third-party processors; we generally receive limited payment tokens, status, and last-four digits rather than full card numbers.
• Communications: messages, authenticity claims, return requests, and support correspondence (including photos you send of items).
• Device and usage data: IP address, browser type, pages viewed, referring URLs, approximate location, and cookies or similar technologies.
• Marketing data: newsletter signup preferences and campaign engagement if you opt in.

2. How we use information

We use personal information to:

• process orders, payments, shipments, returns, and refunds;
• create and secure accounts;
• evaluate authenticity claims, fraud, chargebacks, and policy abuse;
• provide customer support and service messages;
• improve the site, catalog, inventory decisions, and user experience;
• send marketing if you opt in (you may unsubscribe anytime);
• comply with law, enforce our Terms, and protect rights, safety, and property;
• detect, prevent, and investigate security incidents.

3. Legal bases (where required)

If GDPR or similar law applies, we rely on one or more of: performance of a contract; legitimate interests (such as security, fraud prevention, and service improvement); consent (such as certain cookies or marketing); and legal obligation.

4. Cookies and similar technologies

We and our providers may use cookies, pixels, and local storage for login sessions, cart continuity, analytics, fraud prevention, and (if enabled) advertising. You can control cookies through browser settings; some features may not work if cookies are blocked.

5. How we share information

We may share information with:

• service providers (hosting, database, email, analytics, customer support, authentication tooling);
• payment processors and banks;
• shipping carriers and logistics partners;
• professional advisors (lawyers, accountants) under confidentiality;
• authorities or third parties when required by law, subpoena, or to protect rights and safety;
• a buyer or successor in connection with a merger, acquisition, financing, or sale of assets;
• third-party authenticators or experts when investigating an authenticity or fraud dispute, limited to what is needed for that review.

We do not sell your personal information for money. We do not share it for cross-context behavioral advertising unless we disclose that practice and provide required opt-outs.

6. Retention

We keep information as long as needed for the purposes above, including order records, tax/accounting, dispute resolution, and legal compliance. Retention periods vary by data type and legal requirements. When no longer needed, we delete or de-identify information where feasible.

7. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is 100% secure. You use the Services at your own risk regarding residual security risk.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, export, or restrict certain personal information, or to object to certain processing, and to appeal a denial. You may also have the right to opt out of “sale” or “sharing” of personal information if we engage in activities that laws define that way.

To exercise rights, contact us via the Contact page. We may verify your identity before fulfilling a request. You may designate an authorized agent where law allows. Marketing emails include an unsubscribe link.

9. Children

The Services are not directed to children under 13 (or under 16 where a higher digital-consent age applies). We do not knowingly collect personal information from children. If you believe we have, contact us and we will take appropriate steps to delete it.

10. International transfers

If you access the Services from outside the country where we process data, your information may be transferred to and processed in the United States or other countries that may have different data protection laws. Where required, we use appropriate transfer safeguards.

11. Third-party links

The Services may link to third-party sites or services. Their privacy practices are their own; review their policies before providing information.

12. Authenticity disputes and evidence

If you submit an authenticity or returns claim, we may retain photos, messages, shipping records, and related evidence to investigate fraud, protect Thrift Sharks, and resolve disputes, including accidental listings of non-genuine items. This information may be shared with payment networks, carriers, insurers, or advisors as needed.

13. Changes

We may update this Policy by posting a revised version with a new “Last updated” date. Material changes may be highlighted on the site or emailed when appropriate. Continued use after the effective date means you accept the updated Policy where permitted by law.

14. Contact

Privacy requests and questions: use our Contact page with the subject line “Privacy Request.”