Privacy Notice

Last updated: October 25, 2026

This notice explains what Thames Coast Market (market.thamescoast.com) stores about you, why, who else sees it, how long we keep it, and what you can ask us to do. The market is run by ELEVARESTUDIO LLC, Groton, Connecticut (“we”, “us”). Questions or requests: elevarecreativ@gmail.com.

The short version

• We store your email, the name and town you choose, your listings, bids and orders, and a few security records.
• We don't see or store card numbers. Payments happen in Square's checkout on the seller's own Square account.
• No analytics, no ads, no tracking pixels, no selling or sharing your data for advertising.
• The only cookies are the ones that keep you signed in.
• Buyers and sellers get each other's email address only after a sale is paid.

What we store, and why

• Your account. Your email address, the display name and town you enter, a random handle we create for you (like “harbor1234”), when you joined, any strikes, and whether the account is banned and why. We use this to sign you in, show sellers' names on listings (with the town they gave as a small badge beside the name), and run the market's rules.
• Sign-in. Supabase Auth, our sign-in provider, keeps your email and sign-in history so it can send one-time links and codes and keep your session.
• Listings. Title, description, category, condition, town, pickup or shipping, price, photos, auction times and status. Listings are public.
• Sales (PCS / moving, yard and estate sales). The title, description, town, sale days and times, an optional move-out date, an optional take-the-lot price, photos, and the street address you enter. We look the address up once on OpenStreetMap to place it on the map, and store that point plus a copy rounded to about a kilometre. If you choose to hide the address, only the town and the rounded point are shown until the sale starts; after that the address and exact point are public on the sale page and the map.
• Photos. The sell form re-saves every photo in your browser as a new, smaller JPEG before it uploads, and our server removes the EXIF block from any JPEG it receives. That strips hidden data such as GPS location and camera details. Photos are stored in a public folder, so anyone with a photo's web address can open it.
• Sunday night auctions. If you host one: the title, description, town, date and time, the gap between lots, and the pickup place and time you enter. All of it is public on the night's page. If you bid on a lot in one, the night's live feed shows your bid amount and time with your masked name (like “J***n”), the same as a lot's own bid history; never your max or your email.
• Bids. Every bid you place, including your max, with the time. Bid records are never edited after they're made, so the history of each auction stays accurate.
• Orders. What was bought, the price, our fee, the payment deadline, the order's status, and the Square order, payment and checkout-link IDs we use to confirm payment, the order's pickup code, and when the seller confirmed the pickup. The pickup code is shown only to the buyer (and emailed to them) once they've paid.
• Ratings. The stars and comment a buyer leaves for a seller after a paid sale.
• Reports. When you report a listing: the reason, any note you add, and your account if you were signed in.
• Sellers' Square connection. Your Square merchant ID, the location payments go to, your Square business name, and the access keys Square gives us. The keys are encrypted before they're stored. We use them only to create checkouts for your sales and to check whether a buyer has paid.
• Security records. To stop spam and abuse, we count recent requests by IP address, by email address (for sign-in emails and codes) and by account (for listing, bidding, uploads and reports). See how long these are kept below.
• Email records. A short record that a given notice was sent, so you don't get the same email twice. It holds order and listing IDs, not message text.

Shipping addresses. If a buyer picks shipping, we copy the ship-to name, address and any phone number from the Square payment once it is paid, and show it only to that order's seller so they can ship and print a label. A seller who prints labels saves a return address, which only they see. Tracking numbers sellers enter are emailed to the buyer.

Apart from that, we don't collect your phone number, home address, date of birth, payment card details, precise location, or any government ID.

What other people can see

• Anyone: your listings and photos, your display name (or your handle if you haven't set one) as the seller, the town on each listing, and your average star rating and number of ratings. Pages for items that sold or ended stay up, with the final price. For a sale you post: its details, town and rough map point, and the street address once it's public (straight away, or from the start of the sale if you chose to hide it).
• Bid history: shows a shortened handle (like “h***4”), the amount and the time. It never shows your name, email or max.
• Rating comments are stored with the rating and may be shown publicly, without the buyer's name.
• The other person in a sale: after the buyer pays, we email the buyer and the seller each other's email address and name so you can arrange pickup or shipping. It also shows on the order page.
• The seller's Square account: when a buyer opens the checkout, we pass the buyer's email to Square to fill in the form. Because the checkout belongs to the seller's Square account, the seller may see it in Square. Your card details go to Square, never to us. A shipping address you enter there goes to Square and the seller, and we keep a copy on the order for the seller (see Shipping addresses above).
• The people who run the market can see account emails, strikes, bans, reports and orders, to handle reports and keep the market safe.

Companies that handle data for us

• Supabase: our database, sign-in and photo storage. Holds everything listed above.
• Vercel: hosts the website and runs our server code. Like any web host, it handles your IP address, browser details and the pages you request, and keeps standard request logs.
• Resend: sends our emails. It receives your email address and the content of each email we send you.
• Square (Block, Inc.): processes every payment, on the seller's own Square account, under Square's own terms and privacy policy. We send Square the item name, price, our fee and the buyer's email. Square collects card details and any shipping address directly.
• OpenStreetMap (Nominatim): when you post a sale, our server sends its street address and town to OpenStreetMap's free address lookup to get a map point. Nothing about your account is sent with it. When you open the map on the sales page, your browser loads the map pictures straight from OpenStreetMap's tile servers, which see your IP address like any website you visit; we send them nothing else.
• Google Maps and Apple Maps: "Plan Saturday" only builds a link. If you tap it, the map points of the sales you picked go to Google or Apple, and their own privacy policies apply. We don't share your location; the maps app uses it on your phone.

We don't sell your personal information, share it for targeted advertising, or use it for profiling that affects you. We may disclose information if the law requires it, to respond to a valid legal request, or to protect people from fraud or harm.

Emails we send

We only send emails about your own activity on the market. There are no newsletters or marketing emails. They are:

• Sign-in links and codes you ask for.
• Outbid alerts (at most one per item every 15 minutes).
• Auction wins and second-chance offers, with your 48-hour payment deadline.
• For sellers: an item sold, an auction ended with no bids, and a payment confirmed.
• Payment confirmations for both sides, with the other person's email address.
• A notice if you get a strike for a missed payment, and when 2 strikes switch off bidding.

Our emails don't contain tracking pixels.

Cookies and storage on your device

• Sign-in cookies. Supabase Auth sets cookies on this site that keep you signed in. They're needed for the site to work, so there's nothing to opt into. Signing out removes your session.
• Listing draft. While you fill in the sell form, your browser saves a draft on your device so you don't lose your work. It stays on your device and is cleared when you post the listing. Clearing your browser data also removes it.
• Offline page. The site saves one plain “you're offline” page on your device. It doesn't save listings or account pages.

We don't use analytics, advertising or tracking cookies.

How long we keep things

• Your account, listings, bids, orders, ratings and reports are kept for as long as the market runs, unless you ask us to delete your account. Nothing in this group is deleted automatically.
• Photos stay stored even after a listing is taken down, hidden or sold, and photos uploaded for a listing you never posted are not cleared automatically. Ask us and we'll delete them.
• Security records (the IP address, email and account counters) are deleted automatically within about two days.
• Square connection: the encrypted keys are deleted as soon as you disconnect Square from your account. Records of a seller's past orders stay.
• Square-connect requests are deleted when used, and unused ones older than an hour are cleared the next time anyone connects Square.
• Email-sent records are kept for as long as the market runs.
• Supabase, Vercel, Resend, Square and Google keep their own logs under their own policies.

Deleting your account

Email elevarecreativ@gmail.com from the address you sign in with and ask us to delete your account. We will:

• delete your sign-in record and your profile details (email, name, town),
• disconnect and delete your Square connection,
• take down your active listings and delete their photos, and
• delete any security counters tied to your email or account.

We can't delete an account while one of your sales or purchases is waiting for payment. Records of sales and bids you were part of stay, with your name and email removed, because the other person's records depend on them and we may need them for tax, fraud or dispute questions. Square keeps its own payment records.

Your rights

Whatever state you live in, you can ask us to:

• tell you what personal information we have about you, and give you a copy you can take elsewhere,
• correct something that's wrong (you can change your name and town yourself on your account page),
• delete your personal information, as described above, and
• not sell your information or use it for targeted advertising or profiling. We don't do any of those.

Connecticut residents have these rights under the Connecticut Data Privacy Act, and California residents have similar rights under the California Consumer Privacy Act. We give them to everyone, and we won't treat you differently for using them.

To make a request, email elevarecreativ@gmail.com from the address you sign in with, so we know it's you. We'll answer within 45 days. If we turn down your request, you can appeal by replying with the word “appeal”. We'll answer the appeal within 60 days. If we still say no, you can contact the Connecticut Attorney General at portal.ct.gov/AG.

Security

Only our server can read or write the database; your browser never talks to it directly. Square access keys are encrypted. Sign-in uses one-time links and codes, so there are no passwords to leak. No system is perfectly secure, so keep your email account safe, because it's the key to your market account.

Children

The market is only for people 18 and older. We don't knowingly collect information from anyone younger. If you think a child has an account, email elevarecreativ@gmail.com and we'll delete it.

Changes to this notice

This is version 1 of this notice. If we change what we collect or who we share it with, we'll update this page and the date at the top before the change takes effect.

Contact

ELEVARESTUDIO LLC, Groton, Connecticut. Email: elevarecreativ@gmail.com. See also the terms and How it works.