Privacy Policy

This Privacy Policy explains what personal data Explicants ("we", "us", "our") collects when you use PuckYard (the "Service"), why we collect it, how we use it, and the rights you have under the EU General Data Protection Regulation (GDPR), together with the national data-protection law of the country we are established in, Denmark (Databeskyttelsesloven). Your own country's data-protection law may give you further rights. If anything here is unclear, please reach out using the contact details below.

1. Data controller

The data controller for the personal data processed in connection with PuckYard is:

2. What data we collect

We only collect what we need to run the Service. Specifically:

2.1 Account data

• Your email address (your sign-in identity)
• Your optional recovery email (used only if you lose access to your primary email)
• A display name you choose
• A profile photo, if you choose to upload one (optional; you can remove it again on your Account page)
• Your country, postal code and city (defaults for new listings; shown publicly on listings and your profile)
• An optional club you enter (shown publicly on your seller profile, and offered as a handover option on your listings)
• Two preferences you set yourself: whether we email you when someone sends you a message, and the language-and-market edition you last chose while signed in, so the site and our emails open in it
• Account-system metadata: account creation date, last sign-in date

2.2 Listing data

• The information you provide when posting an item: title, description, price and currency, category, condition, brand, size, photos, the listing's country, postal code and city and, where that country has states or provinces, the state the postal code lies in, plus the handover options you tick (public meetup, door pickup, door dropoff, by post, at the club) and the club you name for that option
• Listing lifecycle data: when it was posted, edited, reserved, marked sold, or deleted. When a buyer reserves an item, we record which member holds the reservation, with their display name; on PuckYard the seller of that item sees the name, nobody else does

2.3 Messages

• The content of messages you send or receive through the in-app conversation feature, with timestamps and the other party's identifier

2.4 Trust & safety data

• Reports you submit (and reports submitted about you), with the reason text
• Moderation actions taken by us against your account or content, with reason

2.5 Technical data

• Server logs containing your IP address, request timestamp, browser user-agent, and the URL you accessed — kept for security and abuse-prevention purposes
• An essential sign-in cookie that keeps you signed in (for up to 24 hours by default), and a technical session identifier set by the web-server software (see section 7, Cookies)
• Four essential preference cookies: which shop you are viewing, your chosen language, your chosen language-and-market address (locale), and your chosen currency

We do not collect: full street addresses, phone numbers, payment-card numbers, government-ID numbers, or location data more precise than the postal code you enter. We do not run third-party analytics, advertising trackers, or session-replay tools.

3. Why we collect it (purposes and lawful bases)

3.1 To provide the Service (Article 6(1)(b) GDPR — performance of a contract)

We use your email for OTP sign-in, your listings to make them visible to buyers, your postal code and city to power location filters and map placement, and your messages to deliver conversations between buyer and seller. Without this data the Service cannot function.

3.2 To keep the Service safe (Article 6(1)(f) — legitimate interests)

We use server logs, report data, and moderation history to prevent fraud, abuse, scraping, and harassment, and to investigate violations of our Terms. Our legitimate interest is in keeping PuckYard trustworthy and safe for all users; we balance this against your rights and limit the data to what's needed for the purpose.

3.3 To comply with legal obligations (Article 6(1)(c))

We may process and retain data where we are legally required to — for example, to respond to a valid court order, comply with bookkeeping or tax law, or cooperate with law-enforcement requests made under proper authority.

4. How long we keep it

• Active accounts: as long as the account exists.
• Deleted accounts: account data is removed promptly; messages you sent are kept for the other party's context with your name replaced by "Deleted user".
• Messages: kept as long as either party's account is active. When a party deletes their account, their name in past messages is replaced with "Deleted user" and their account-side copy is removed. When both parties have deleted their accounts, the thread is purged. Messages are not auto-deleted on a time schedule because each thread doubles as the agreed pickup record (time, place) for that listing.
• Listings: live until you mark them sold or delete them. When you delete a listing it disappears from the marketplace immediately, but a copy is moved to an internal archive visible only to moderators (not to other users, not to you) for up to 12 months, so we can review disputes, abuse patterns, and our own moderation decisions. After that the listing is purged.
• Reports and moderation records: retained for up to 36 months so we can recognise repeat behaviour, including bad actors who hop between accounts over longer windows.
• Server logs: retained for up to 180 days, then deleted. This is the EU-norm window for security telemetry; long enough to investigate incidents that surface weeks or months after the fact.
• Contact-inbox emails: kept for 12 months from your last message, or longer if the email relates to an active dispute or legal matter.
• Backups: rolling backups are overwritten on a schedule; deleted data may persist in backups for up to 35 days before being purged.
• Legal holds: where law requires longer retention (e.g. bookkeeping), we keep the relevant data for the legally required period.

5. Who we share it with

We do not sell your personal data. We share it only as follows:

• Publicly on the Service. Your display name, your optional profile photo, your optional club, your listings (incl. photos, price, country, postal code + city, the state where the country has one, and the handover options you offer), and your member-since date are public to anyone visiting your seller profile or a listing. Your email, recovery email, and full address are not public.
• With other users when you contact them. When you start a message thread, the other user sees your display name and your message content. They do not see your email.
• With service providers ("data processors"). We use a hosting provider to run the Domino server, Brevo (Sendinblue SAS, France, servers in the EU) as the email-delivery provider for sign-in codes and notification emails, and Cloudflare both as the security and content-delivery network in front of the site and, through Cloudflare Email Routing, as the router for our contact-us inbox. Cloudflare terminates the encrypted connection and filters malicious traffic, so the traffic between your browser and the site — including page content and messages in transit — passes through its network. They all process data on our written instructions and may not use it for any other purpose. Hosting and email stay within the EU/EEA; for Cloudflare, see section 6.
• With authorities, if compelled by a valid court order or other legally binding request under Danish law.
• In a business transfer. If Explicants is sold, merged, or restructured, your data may be transferred to the new entity. We will notify you before any such transfer affects your data and you will have an opportunity to delete your account first.

6. Where it's stored

Personal data is stored on servers located in the European Union (EU) / European Economic Area (EEA). There are two exceptions. One is the traffic that passes through Cloudflare's global network (section 5): Cloudflare is a US company, and that processing is covered by the EU-U.S. Data Privacy Framework and the European Commission's Standard Contractual Clauses. The other is the map: the map library is fetched from a public CDN (unpkg) when you open the browse page, and the map tiles from OpenStreetMap when a map is shown. They therefore see your IP address, as any website you visit does, but receive no data from us. We do not otherwise transfer your data outside the EU/EEA; if that ever changes, we will update this Policy and rely on the safeguards GDPR requires.

7. Cookies

We use only essential cookies, which do not require your prior consent under EU ePrivacy rules:

• A sign-in cookie that keeps you signed in after OTP verification, for up to 24 hours by default. It is restricted to this site (SameSite=Lax) and cannot be read by scripts (HttpOnly).
• A shop cookie remembering which shop you were browsing, so a link without a shop parameter still takes you to the right one.
• A language cookie remembering the language you picked, on shops that offer more than one.
• A currency cookie remembering the currency you chose to read prices in, on shops that accept more than one. It changes only how prices are displayed to you; it does not change any price, and nothing is recorded against your account.
• A locale cookie remembering the language-and-market address you chose in the header (for example /da-dk/), so the site opens there next time instead of guessing from your connection's country.
• A technical session identifier (SessionID) set by the web-server software on every visit to tell one browser from another. It holds no personal data and we do not use it to identify you.
• Cloudflare may set its own security cookies (such as __cf_bm) to tell people from automated traffic. They are strictly necessary and are not used for advertising.

We do not use analytics cookies, advertising cookies, tracking pixels, third-party social-media embeds, or session-replay tools. Because there are no non-essential cookies, we do not show a cookie banner. If we add any non-essential cookies in the future, we will introduce a compliant consent banner first.

8. Your rights under GDPR

GDPR gives you the following rights over your personal data:

• Access (Art. 15) — get a copy of the data we hold about you.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure (Art. 17, "right to be forgotten") — delete your data.
• Restriction (Art. 18) — limit how we use your data in certain cases.
• Data portability (Art. 20) — receive your data in a machine-readable format.
• Object (Art. 21) — object to processing based on our legitimate interests.
• Withdraw consent at any time, where processing is based on consent (we currently rely on consent only for marketing emails, which we do not send today).

9. How to exercise your rights

You can act on the most common rights yourself, directly from your Account page:

• Access & portability: click Download my data on your Account page. We return a JSON file containing your account, your listings, and your messages.
• Rectification: edit your display name, profile photo, recovery email, default location, club, message-notification preference, and listings yourself. To change the email you sign in with, write to us (below) and we will move your account to the new address once both addresses are verified.
• Erasure: click Delete my account on your Account page. Your profile and listings are removed; messages you sent stay visible to the other party but with your name shown as "Deleted user".

For the other rights — restriction, objection, withdrawal of consent — or if the self-serve tools don't work for your case, please write to us at [email protected]. We will respond within one month of your request (extendable by two months for complex requests, as allowed by Article 12(3) GDPR).

To verify your identity before acting on a request, we may ask you to confirm details we already hold about you (such as recent listing or message activity tied to the email on file).

10. Right to complain

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with a supervisory authority - either the one in the EU or EEA country where you live or work, or the one that supervises us, which is the Danish Data Protection Authority:

A list of the supervisory authority in every EU and EEA country is published by the European Data Protection Board at edpb.europa.eu.

11. Children

PuckYard is not directed to people under 18. If you are under 18, you may use the Service only with the supervision and consent of a parent or legal guardian. If we become aware that we have collected personal data from a person under 18 without verified parental consent, we will delete that data promptly.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes to the Service, our processing activities, or legal requirements. When we do, we will post the updated version here with a new "Last updated" date and, for material changes affecting your rights, notify active accounts by email. We encourage you to review this page periodically.

13. Contact

Last updated: September 25, 2026