Privacy Policy

This policy explains what we do with personal information when you use Honest Phones as a buyer, seller, or visitor. The controller of that information is Honest Phones LLC; you can reach us at contact@honestphones.com (see section 17), and our postal address for legal notices is in section 23 of our Terms of Service.

• Account information: email address, password (stored only as a secure hash by our authentication provider), display name, and your seller status.
• Listing information: the device details you enter, including make, model, structured condition fields, and the device IMEI/serial number, plus the photos you upload.
• Transaction information: orders, bids, amounts, fees, shipping address and phone number, tracking, delivery and inspection events, disputes, and reviews. Card details and bank details are collected and stored by Stripe, our payment processor — not by us.
• Identity verification: where required for sellers or higher-volume accounts, identity information is collected and verified through Stripe Identity. We receive the verification result and limited confirmation data, not the underlying documents.
• Communications: messages you send us (for example, support or dispute correspondence).
• Technical and usage data: IP address, device and browser information, and log data generated as you use the Service, and strictly necessary cookies used to keep you signed in.
• Aggregate analytics: we use Vercel Web Analytics, a privacy-friendly measurement tool, to understand overall traffic — page views, the page you came from, approximate location by country, and device and browser type. It is cookieless: it sets no cookies on your device, does not track you across other websites, and does not build a profile of you. It does not receive your name, email, or any listing or order details.

We do not run advertising trackers or behavioural profiling, and we do not use analytics to target advertising at you.

• To operate the marketplace: create listings, run auctions, process orders, hold and release escrow, and enable payouts.
• For trust and safety: to screen device IMEIs against a blacklist before publishing, verify seller identity, detect and prevent fraud and abuse, and enforce our Terms and Prohibited Items Policy.
• To resolve disputes and provide support.
• To send transactional messages (confirmations, shipping, bid, dispute and account notices).
• To comply with legal obligations, including tax, and to respond to lawful requests — including, where a device is reported stolen or its IMEI is flagged, sharing information with the relevant authorities or reporting bodies.
• To maintain, secure, and improve the Service.

We do not use your personal information to train machine-learning models, and we do not make decisions producing legal or similarly significant effects about you by automated means alone — a person reviews listing approvals, suspensions and dispute outcomes.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only as needed to run the Service:

• With the other party to a transaction: a buyer and seller receive the information necessary to complete an order — the buyer’s shipping address and phone number are provided to the seller for shipping; the seller’s display name, rating and identity-verification status are shown to the buyer. Buyers and sellers do not receive each other’s email address from us.
• Service providers who process data on our behalf under contract and confidentiality obligations. Currently: Stripe (payments, escrow, payouts, identity verification), Supabase (database, authentication, file storage), Vercel (hosting, logs, and cookieless Web Analytics), Resend (transactional email), and our IMEI screening provider for the blacklist check.
• Authorities and third parties where required by law, to enforce our Terms, to address fraud or a stolen-device report, or in connection with a merger, acquisition, or sale of assets. If ownership changes, we will tell you before your information becomes subject to a different policy.

Stated in the terms US state privacy laws use. Over the past 12 months we have collected these categories, from you directly and generated through your use of the Service, and disclosed them for a business purpose to the service providers named above:

• Identifiers — name/display name, email, IP address, account ID. Used to operate your account, authenticate you, and contact you about transactions.
• Customer records and commercial information — shipping address, phone number, orders, bids, payouts, disputes. Used to complete transactions and resolve disputes.
• Internet or network activity — log and device data, and cookieless aggregate analytics. Used for security, fraud prevention, debugging, and understanding overall traffic.
• Government identifiers and verification data — handled by Stripe Identity; we receive only the result and limited confirmation data. Used to satisfy fraud and payments obligations. Where this counts as sensitive personal information, we use it only for those permitted purposes and never to infer characteristics about you.
• Device provenance data — IMEI/serial numbers and screening results. Used for the blacklist check and stolen-device reporting. This is information about a device, but it can tie to you as its seller, so we treat it as personal information.

Payment card and bank information is collected and processed by Stripe under Stripe’s own terms and privacy policy. We receive confirmation of payment, payout, and identity-verification status and limited related data, but we do not receive or store your full card number.

We use strictly necessary cookies only — to keep you signed in and to keep the Service secure. We do not use advertising or third-party tracking cookies. Our traffic analytics (Vercel Web Analytics) is cookieless — it measures aggregate visits without storing anything on your device or tracking you across sites — so you are not asked to consent to any cookies. Blocking the necessary cookies will stop you from signing in.

We keep information for as long as your account is active and as long as needed to provide the Service, then:

• Transaction and dispute records — at least 7 years after the transaction, for tax, accounting and dispute-defence purposes.
• IMEI and screening records — retained indefinitely, because a device’s provenance history is exactly what makes a later stolen-device report answerable.
• Account and profile data — deleted or anonymised within 90 days of account closure, except what is covered above.
• Server and security logs — typically 30 to 90 days.

We protect data with access controls, database row-level security, scoped service credentials, and encryption in transit, and we rely on Stripe and Supabase for payment and infrastructure security. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to know how it is used and shared, to limit the use of sensitive personal information, and to object to or restrict certain processing. We will not discriminate against you for exercising them.

To make a request, email contact@honestphones.com from the address on your account, or write to us at the address in section 17. We will verify your identity before acting — usually by confirming control of the account email — and respond within the time the applicable law requires (45 days under most US state laws, extendable once; one month under the GDPR). An authorized agent may submit a request on your behalf with written proof of authority.

If we refuse a request, you may appeal by replying to our decision with “Appeal” in the subject. We will respond to the appeal within 45 days with our reasoning, and tell you how to complain to your state Attorney General if you remain unsatisfied.

Some information must be retained even after a deletion request — for example transaction, tax, and fraud-prevention records, and IMEI history tied to a device’s provenance, as set out in section 8.

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children. We do not sell or share the personal information of anyone under 16. If you believe a minor has created an account, contact contact@honestphones.com and we will delete it.

Where the GDPR or UK GDPR applies, we process personal information on these bases: to perform our contract with you (operating your account and transactions); our legitimate interests in running a safe marketplace (fraud prevention, IMEI screening, security, and improving the Service); compliance with legal obligations (tax, accounting, responding to lawful requests); and your consent where we ask for it. You may object to processing based on legitimate interests, withdraw consent at any time, and lodge a complaint with your local supervisory authority.

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, the rights in section 10 are available to you under that law, including the rights to confirm and access, correct, delete, and obtain a portable copy, and to opt out of sale, targeted advertising, and profiling. We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use it for targeted advertising or profiling — so there is nothing for you to opt out of, and no “Do Not Sell or Share My Personal Information” link is required. California residents may also request the specific pieces of information we hold and the categories of third parties to whom we disclosed it.

We and our service providers (including Stripe, Supabase, Vercel and Resend) are based in or process data in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States and other countries whose data laws may differ from yours. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses for those transfers.

If a security incident affects your personal information, we will notify you and the relevant authorities where and as required by applicable law, without undue delay.

We may update this policy; we will change the version and effective date when we do. If a change is material we will ask you to accept it before you next list, bid or buy, and the record of which version you accepted is kept with your account.

Privacy questions and requests: contact@honestphones.com. Write from the address on your account where you can, so we can verify the request quickly. If you need to reach us by post, the notice address is in section 23 of the Terms of Service.