Privacy policy

Who this site is for

You must be at least 13 years old to create an account. If you're in the EU or UK, you must be at least 16. We don't knowingly collect personal information from anyone under those ages. If you believe a minor has signed up, contact us and we'll remove the account.

What we collect

• Your email address - for sign-in, password reset, and notifications you opt into.
• Profile info - the username, bio, location (city + state), avatar, banner, and tank info you choose to set. All of it is public by default.
• Posts and content - threads, replies, listings, build journals, contest entries, event RSVPs, photos you upload, and private messages you send.
• If you sign in with Google - your Google email and basic profile info Google returns. We don't see your Google password.
• If you set a site password - we store a bcrypt hash of it (cost 12). We never see the plaintext password.
• IP address - briefly stored alongside sign-in and post attempts to power rate limiting. Auto-pruned within ~2 hours.
• Cookies - an httpOnly session cookie so you stay signed in, plus a small UI cookie that remembers if you dismissed the “set a password” nudge. No tracking cookies.

What we don't collect

• No third-party advertising trackers or marketing pixels.
• No precise device location.
• No payment info - the For Sale marketplace is hobbyist-to-hobbyist. Buyers and sellers arrange payment between themselves; we never see it.

How we use what we collect

To operate the site: deliver notifications, display your posts to other members, send password-reset and sign-in emails, prevent spam and abuse, and surface basic aggregate stats (e.g. how many people viewed a listing). We don't sell or share your data with advertisers.

Subprocessors

Other companies handle small pieces of the infrastructure. None of them sell your data either.

• Vercel - hosting, edge requests, and aggregate analytics (page views, anonymized country, Core Web Vitals). No cross-site tracking.
• Vercel Postgres - the database where your account and posts live.
• Vercel Blob - storage for photos you upload.
• Google - if you use “Continue with Google” for sign-in.
• Resend - sends sign-in links, password resets, and notification emails.

Your controls

• Edit your profile and bio anytime in Settings.
• Manage your password and disconnect Google in Settings → Security.
• Toggle email notifications in Settings → Preferences.
• Block other users in Settings → Privacy.
• Request account deletion via Contact. We typically process deletions within 7 days.

California residents (CCPA / CPRA)

If you live in California, you have additional rights:

• Right to know what personal information we hold about you. Most of it is on your public profile and in your settings.
• Right to delete your data. Email us to request deletion.
• Right to correct inaccurate information. You can edit most of it yourself; email us for anything you can't.
• Right to opt out of sale or sharing. We don't sell or share your personal information with third parties for advertising. There's nothing to opt out of, but you have the right anyway.
• Right to non-discrimination for exercising these rights. We won't treat you any differently.

To exercise any of these rights, contact us. We'll respond within 45 days.

Data retention

• Active accounts: kept indefinitely while you use the site.
• Deleted accounts: your profile and content are removed on deletion. Some content may persist briefly in nightly backups (up to 30 days) before being overwritten.
• Rate-limit logs: auto-pruned within ~2 hours.
• Email logs at Resend: retained per Resend's standard policy (around 30 days for deliverability monitoring).

Security

Passwords are hashed with bcrypt. Sessions are tied to httpOnly, Secure cookies. The site is served over HTTPS with HSTS. We rate-limit sign-in attempts and password-reset requests to slow brute-force attacks. No system is perfect - if you spot a security issue, please email us before disclosing publicly.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be announced on the site.