Privacy Policy

1. What we collect

• Account details: your email address, a display name, and a password (stored only as a one-way hash, so we cannot see it).
• Your church choice: the church board you pick as "your church", so we can remember it. Before you sign up this is stored in a cookie on your device; after you sign up it is saved with your account.
• Listings: titles, descriptions, prices, category, status, and any photos and captions you upload. Listings are public by design.
• Church affiliation: if you verify with a church-domain email or accept a church's invitation, we record that link so we can show the verified check.
• Technical logs: IP address, browser type, pages requested, and timestamps, kept briefly for security and debugging.
• Photo details: uploaded photos are resized on your device and on our server; we may read basic image data (dimensions, format) to display them. We do not run facial recognition.

2. How we use it

• To run the site: show listings, remember your church, let you sign in, and let you manage your posts.
• To send transactional email: account confirmation, password resets, and notices about your listings. We use Resend to deliver these emails, which means your email address and the message contents pass through their servers for delivery.
• To keep the community safe: detect abuse, spam, and fraud, and enforce our Terms of Service.
• To understand usage in aggregate (for example, which categories are popular) so we can improve Arklist.

Messages between users

Messages between users are stored on arklist. They stay stored for safety and as evidence if there is a dispute. We may keep them for about 90 days even after message content is removed or an account is deleted.

Arklist staff may review messages tied to a listing when that listing is reported or removed by moderation.

3. What we do not do

• We do not sell or rent your personal information to anyone.
• We do not show your email address to other users. Contact happens only through features you choose to use.
• We do not use your data for advertising profiles, and we do not share it with data brokers.

4. Who can see what

Your listings, photos, display name, and (if applicable) verified check are public. Anyone on the internet can see them, and search engines may index them. Your email address, password, and church choice are private to you and Arklist.

We share data with a small number of service providers only as needed to run Arklist: our hosting provider (server in the European Union operated by Hetzner), Cloudflare (network security and email routing), and Resend (transactional email delivery). Each is bound to use the data only to provide their service. We may also disclose information if required by law or to protect the safety of users.

5. Cookies

Arklist uses a small number of cookies: a session cookie to keep you signed in, a cookie that remembers the church you picked, and a security token that protects forms from tampering. These are necessary for the site to work. We do not use advertising cookies. If we add analytics in the future it will be privacy-respecting and described here.

6. How long we keep it

Your account and listings stay until you delete them or ask us to. Archived and expired listings are hidden from the public but may be kept for a reasonable time for safety, dispute, and backup purposes. Technical logs are kept for a short period and then discarded. Backups roll over on a regular schedule.

7. Your choices and rights

• You can edit active listings and mark them sold or archived from your account. Sold and archived listings are kept as posted.
• You can ask us to correct or delete your account and personal information by emailing [email protected] from the address on the account. We will act within 30 days, subject to any legal duty to retain records.
• You can ask for a copy of the personal information we hold about you.
• California residents have additional rights under the CCPA/CPRA, including the right to know, delete, and not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined in California law.

8. Security

Connections to Arklist are encrypted (HTTPS). Passwords are hashed. Access to the server is restricted. No system is perfectly secure, so please use a strong, unique password and tell us right away at [email protected] if you suspect a problem.

9. Children

Arklist is for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, email us and we will remove it.

10. Changes to this policy

We will update this page when our practices change and update the effective date at the top. Meaningful changes will be announced on the site or by email where practical.