Effective date: September 3, 2026
Operator: Hudson AI Consulting LLC, contact us by email (below)
Contact: asafgreenfield21+brownshop@gmail.com
We collect your school email, the profile and listings you create, the messages and offers you send,
your orders, and a push token if you turn notifications on. Card numbers go straight to Stripe — we
never see them. We do not sell your data, we do not run ads, and we do not track you across other
apps. You can delete your account from Settings.
You give us:
| Data | Why |
|---|---|
School email address (@brown.edu / @risd.edu) | Sign-in, verifying you belong to the community, transactional email |
| Password | Sign-in. Stored only as a hash by our auth provider; we never see it |
| Username, display name, bio, profile photo | Your public shop page |
| Listings: photos, title, description, category, size, condition, price | Showing your item to buyers |
| Messages and offers | Delivering them to the other person |
| Reviews you write | Public reputation for the person reviewed |
| Reports you file | Reviewing abuse |
| Blocks | Enforcing them |
Derived automatically:
| Data | Why |
|---|---|
Your school (brown or risd) | Derived from your email domain; shown on your badge |
| Order records: item, price, fee, payout, timestamps, meetup slot and location | Running the transaction, refunds, receipts, disputes |
| Push notification token, if you allow notifications | Sending you a notification about an offer, message, or meetup |
| Basic device/app information and error logs | Diagnosing crashes and abuse |
Handled by Stripe, not by us:
Card numbers, bank details, and the identity documents Stripe requires from sellers (Stripe Connect
onboarding) go directly to Stripe and are covered by
Stripe's privacy policy. We receive only: whether your payout account
is enabled, whether a payment succeeded, and an opaque payment/transfer identifier.
What we do not collect: location (the meetup spots are a fixed list you pick from, not GPS),
contacts, biometrics, advertising identifiers, or your browsing outside the app.
your own activity.
We do not use your data for advertising, and we do not sell or rent it.
Other users see everything you make public: your username, display name, bio, photo, school
badge, listings, ratings and reviews. Someone you are trading with additionally sees the messages
and offers you send them and the order details you share.
Service providers, only as needed to run the app:
| Provider | What it handles |
|---|---|
| Supabase | Database, authentication, file storage, hosting |
| Stripe | Payments, seller payouts, identity verification for sellers |
| Expo | App builds and over-the-air updates |
| Apple (APNs) / Google (FCM) | Delivering push notifications |
Supabase (transactional email) | Sending verification and password-reset email |
Law enforcement and legal process: we will disclose data when legally required, and we may
disclose it if we believe in good faith that someone is at risk of serious harm.
A future sale of the business would transfer data as part of the assets; we would tell you first.
Data is stored in the United States on Supabase infrastructure.
"Deleted user." Financial records are retained for at least 7 years for tax and accounting
reasons; Stripe keeps its own records under its own policy.
In the app: Profile → Settings → Delete account, then type DELETE to confirm. You cannot delete
while you have orders in flight — finish or cancel them first, so the other person is not left
hanging.
Deletion removes your profile details, listings, likes, and push token, and anonymises you to
"Deleted user" everywhere your name previously appeared. Backups roll off within 30 days. If
you would rather do it by email, write to asafgreenfield21+brownshop@gmail.com from your school address.
For anything else, email asafgreenfield21+brownshop@gmail.com.
deletion, portability, objection, non-discrimination), you have them and we will honour them.
Traffic is encrypted in transit (HTTPS). Your login session is stored on your device encrypted with
a key held in the device's secure hardware (iOS Keychain / Android Keystore). Access to data in the
database is enforced per-user by row-level security. Passwords are stored only as hashes by our auth
provider, and card data never touches our servers.
No system is perfect. If we discover a breach affecting your data, we will notify you and any
regulator that requires it.
Brown Bazaar is for people 17 and older. We do not knowingly collect data from anyone under 13, and
we will delete such an account if we learn of it.
If we change this policy materially we will tell you in the app or by email before it takes effect.
The effective date at the top always reflects the current version.
asafgreenfield21+brownshop@gmail.com · contact us by email (below)