DRAFT — not yet reviewed by a lawyer. This page is a draft pending lawyer review and must be reviewed before it is submitted for App Store review (see docs/LEGAL-REVIEW.md).
Privacy Policy
This Privacy Policy explains what personal information Jukebaxx ("Jukebaxx", "we") collects when you use the Jukebaxx website and app, why we collect it, who we share it with, and the choices you have. Contact: privacy@jukebaxx.com, Block 08, Apartment 190, McIntyre Villa, Kingston 16, Jamaica.
1. What we collect
| Data | Why |
|---|---|
| Account data: email address, password (stored only as a salted hash by our authentication provider), display name, handle, country | Create and secure your account, send service emails |
| Profile and crate content: avatar, background image, bio/signature, location text you choose to add, records and photos you upload, wants list | Show your profile and listings to other members |
| Marketplace activity: listings, bids (including your maximum bid), purchases, sales, shipping status, disputes, ratings/trust events | Run auctions, deliver goods, resolve disputes, prevent fraud |
| Shipping address and phone/email given at checkout | Let the seller ship to you; shown only to the seller of that order |
| Payment data: handled by Stripe (card details never reach our servers). We store Stripe identifiers, payment status and amounts. Sellers also provide identity and bank details directly to Stripe to receive payouts. Sellers who choose PayPal payouts give us their PayPal email address, which we store (visible only to the seller and to us) and send to PayPal with the payout amount so PayPal can pay them. | Take payments, verify bidders, pay sellers, tax and accounting |
| Safety data: reports you make or receive, members you block, moderation actions | Keep the community safe |
| Legal acceptances: which document version you accepted and when; confirmation that you are 18+ | Show we obtained your agreement |
| Technical data: IP address and device/browser information in server logs, security events | Security, debugging, abuse prevention |
We do not use advertising trackers and do not sell your personal information. We do not collect precise location. The app does not use third-party analytics at the time of writing.
Optional first-party usage analytics
Added 14 October 2026: the Usage analytics checkbox is off by default. If you enable it, we store a random identifier on this browser or app installation and count visits, signup attempts/completions, checkout starts and confirmed-payment returns. These counters contain no account identifiers, email addresses, form contents, payment details, browsing URLs or advertising identifiers. They are stored in our Supabase database. Reports exclude counters older than 90 days; those counters are removed when a new usage event arrives, so a dormant database may retain them until the next event. Returning-visitor and completion counts cover consenting installations only. Turn the checkbox off to stop future events and remove the local identifier. Do Not Track and Global Privacy Control suppress these events. Our hosting providers may still receive normal network information as described above.
2. Who we share it with (service providers)
- Supabase — database, authentication and file storage (hosting region: Canada (Central), AWS ca-central-1).
- Stripe — payment processing, bidder verification, seller payouts, tax calculation and fraud screening. Stripe is an independent controller for some of this data; see Stripe's privacy policy.
- PayPal — seller payouts for members who choose PayPal (PayPal Payouts): we send the seller's PayPal email address and the payout amount. PayPal is an independent controller of the data it holds about your PayPal account; see PayPal's privacy statement.
- Vercel — website and API hosting.
- Resend — sending service emails (outbid, payment, shipping, moderation notices).
- The other party to a sale (shipping name/address for the order) and, where required by law, authorities.
3. Public information
Your handle, display name, profile content, crate and active listings are visible to other members. Your email, address and payment details are not.
4. How long we keep data
We keep account and profile data while your account is open. When you delete your account we remove your profile, crate content, photos, wants, notifications and saved payment verification, delete your Stripe customer record and close your Stripe connected account where possible, and anonymise your identifiers. We keep transaction, payment and payout records (with your identity removed and shipping address redacted) for 7 years from the transaction date as needed for accounting, tax, fraud prevention and legal claims.
5. Your choices and rights
- Access / portability: Account → Safety & privacy → Export my data downloads your data as JSON.
- Deletion: Account → Safety & privacy → Delete account (type DELETE to confirm).
- Correction: edit your profile in the app, or contact us.
- Blocking and reporting: available on listings and profiles.
- Depending on where you live (e.g. EU/UK GDPR, California CCPA) you may have further rights, including to object or complain to a regulator. Contact privacy@jukebaxx.com; we respond to privacy requests within 30 days.
6. Security
Data is encrypted in transit (HTTPS). Access to the database is restricted by row-level security and server-side checks. No system is perfectly secure; tell us if you notice a problem.
7. International transfers
Our providers may process data in countries other than yours, including the United States, using appropriate safeguards where required.
8. Children
Jukebaxx is for people aged 18 and over. We do not knowingly collect information from anyone under 18; if you believe a minor has an account, contact us and we will remove it.
9. Changes
We will update this policy as the service changes and ask you to re-accept where a change is material. Current version: see above.
10. Contact
privacy@jukebaxx.com · Block 08, Apartment 190, McIntyre Villa, Kingston 16, Jamaica