Privacy Policy (United States)

This Privacy Policy explains what personal information Explicants ("we", "us", "our") collects when you use PuckYard (the "Service") from the United States, why we collect it, how we use it, who we share it with, and the choices and rights you have. Two sets of rules apply to us at once. Explicants is established in Denmark, so the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act govern everything we do with your data, wherever you live; that is a protection you keep as a US user, not one you lose. In addition, the privacy law of your state may give you rights of its own. We honor the rights described in section 10 for every US user, whether or not a particular state law applies to a business of our size. If anything here is unclear, please reach out using the contact details below.

This Policy applies when you use the Service in its United States market (the addresses that begin with /en-us/). Our Danish market has its own Privacy Policy, which applies there.

1. Who we are

The data controller for the personal information processed in connection with PuckYard (the "business", in the words of US state privacy laws) is:

We have no office, staff, or servers in the United States. The Service is run from Denmark and hosted in the European Union.

2. What information we collect

We only collect what we need to run the Service. Specifically:

2.1 Account information

• Your email address (your sign-in identity)
• Your optional recovery email (used only if you lose access to your primary email)
• A display name you choose
• A profile photo, if you choose to upload one (optional; you can remove it again on your Account page)
• Your country and ZIP code, with the city and state the ZIP resolves to (defaults for new listings; shown publicly on your listings and your profile)
• An optional club or team you enter (shown on your public seller page and offered as a handover option on your listings)
• Two preferences you set yourself: whether we email you when someone sends you a message, and the language-and-market edition you last chose while signed in, so the site and our emails open in it
• Account-system metadata: account creation date, last sign-in date

2.2 Listing information

• The information you provide when posting an item: title, description, price and currency, category, condition, brand, size, photos, the listing's country and ZIP code with city and state, the handover options you tick (public meetup, door pickup, door dropoff, by post, at the club), and the club you name for that option
• Listing lifecycle data: when it was posted, edited, reserved, marked sold, or deleted. When a buyer reserves an item, we record which member holds the reservation, with their display name; on PuckYard the seller of that item sees the name, nobody else does

2.3 Messages

• The content of messages you send or receive through the in-app conversation feature, with timestamps and the other party's identifier

2.4 Trust and safety information

• Reports you submit (and reports submitted about you), with the reason text
• Moderation actions taken by us against your account or content, with reason

2.5 Technical information

• Server logs containing your IP address, request timestamp, browser user-agent, and the URL you accessed, kept for security and abuse-prevention purposes
• An essential sign-in cookie that keeps you signed in (for up to 24 hours by default), and a technical session identifier set by the web-server software (see section 8)
• Four essential preference cookies: which shop you are viewing, your chosen language, your chosen language-and-market address (locale), and your chosen currency

We do not collect: street addresses, phone numbers, payment-card numbers, Social Security or other government-ID numbers, precise geolocation (nothing more precise than the ZIP code you type), or any category US state laws call "sensitive personal information" (such as racial or ethnic origin, religion, health, sexual orientation, citizenship, or biometric data). We do not run third-party analytics, advertising trackers, or session-replay tools, and we do not build profiles of you.

2.6 The same information, in the categories US state laws use

• Identifiers: email address, recovery email, display name, IP address.
• Commercial information: the items you list, their price, and their lifecycle (posted, reserved, sold).
• Internet or network activity: server logs of the pages you request.
• Geolocation data: ZIP code, city, and state only. Not precise geolocation.
• User-generated content: listing text, photos, messages, reports.
• Audio, electronic or visual information: your optional profile photo.
• Other information you give us: the optional club or team and the two preferences in section 2.1.
• Inferences, sensitive personal information, biometric, employment, or education information: none collected.

We have collected these categories in the preceding twelve months for the purposes in section 4, we disclose them for business purposes only to the service providers in section 6, and we have not sold or shared any of them.

3. Where it comes from

• From you, when you sign in, fill in your account, post a listing, or send a message.
• From your browser or device, automatically, when it requests a page (the technical information in section 2.5).
• From other users, when they send you a message or report you or your content.

We do not buy information about you, do not receive it from data brokers, and do not combine it with information from other websites.

4. Why we use it (purposes and legal bases)

4.1 To provide the Service (Article 6(1)(b) GDPR, performance of a contract)

We use your email for one-time-code sign-in, your listings to make them visible to buyers, your ZIP code, city, and state to power location filters, the State filter, and map placement, and your messages to deliver conversations between buyer and seller. Without this information the Service cannot function.

4.2 To keep the Service safe (Article 6(1)(f), legitimate interests)

We use server logs, report data, and moderation history to prevent fraud, abuse, scraping, and harassment, and to investigate violations of our Terms. Our legitimate interest is in keeping PuckYard trustworthy and safe for all users; we balance this against your rights and limit the data to what is needed for the purpose.

4.3 To comply with legal obligations (Article 6(1)(c))

We may process and retain information where we are legally required to, for example to respond to a valid court order, comply with bookkeeping or tax law, or cooperate with law-enforcement requests made under proper authority.

4.4 What we do not use it for

We do not use your information for targeted advertising, for profiling, or for automated decisions that have legal or similarly significant effects on you. We do not sell it, and we do not share it with anyone for their own marketing.

5. How long we keep it

• Active accounts: as long as the account exists.
• Deleted accounts: account information is removed promptly; messages you sent are kept for the other party's context with your name replaced by "Deleted user".
• Messages: kept as long as either party's account is active. When a party deletes their account, their name in past messages is replaced with "Deleted user" and their account-side copy is removed. When both parties have deleted their accounts, the thread is purged. Messages are not auto-deleted on a time schedule because each thread doubles as the agreed handover record (time, place, or shipping details) for that listing.
• Listings: live until you mark them sold or delete them. When you delete a listing it disappears from the marketplace immediately, but a copy is moved to an internal archive visible only to moderators (not to other users, not to you) for up to 12 months, so we can review disputes, abuse patterns, and our own moderation decisions. After that the listing is purged.
• Reports and moderation records: retained for up to 36 months so we can recognize repeat behavior, including bad actors who hop between accounts over longer windows.
• Server logs: retained for up to 180 days, then deleted. This is long enough to investigate incidents that surface weeks or months after the fact.
• Contact-inbox emails: kept for 12 months from your last message, or longer if the email relates to an active dispute or legal matter.
• Backups: rolling backups are overwritten on a schedule; deleted data may persist in backups for up to 35 days before being purged.
• Legal holds: where law requires longer retention (for example bookkeeping), we keep the relevant information for the legally required period.

6. Who we share it with, and what we never do with it

We do not sell your personal information, and we do not share it for cross-context behavioral advertising (as those terms are defined in California law), and we have not done so in the preceding twelve months. We do not disclose it to third parties for their own direct marketing, so there is nothing to report under California's "Shine the Light" law. We share it only as follows:

• Publicly on the Service. Your display name, your optional profile photo, your listings (including photos, price, country, ZIP code, city, state, and the handover options you offer), your optional club or team, and your member-since date are public to anyone visiting your seller profile or a listing. Your email, recovery email, and IP address are not public.
• With other users when you contact them. When you start a message thread, the other user sees your display name and your message content. They do not see your email.
• With service providers (in GDPR terms, "data processors"). We use a hosting provider to run the server in the EU; Brevo (Sendinblue SAS, France, servers in the EU) as the email-delivery provider for sign-in codes and notification emails; and Cloudflare, Inc. (United States) both as the security and content-delivery network in front of the site and, through Cloudflare Email Routing, as the router for our contact inbox. Cloudflare terminates the encrypted connection and filters malicious traffic, so the traffic between your browser and the site, including page content and messages in transit, passes through its network. All of them process information on our written instructions, may not use it for any other purpose, and are bound by contracts that meet the GDPR's requirements for processors.
• With authorities, if we are compelled by a valid court order or other legally binding request under the law that applies to us. A US authority that wants information held in Denmark must use the legal channels that Danish and EU law recognize; we do not hand information to any authority on an informal request.
• In a business transfer. If Explicants is sold, merged, or restructured, your information may be transferred to the new entity. We will notify you before any such transfer affects your information and you will have an opportunity to delete your account first.

7. Where it is stored: your data leaves the United States

Your personal information is stored on servers located in the European Union / European Economic Area, principally in Denmark. When you use the Service from the United States, your information is therefore transferred to and processed in the EU. There, it has the full protection of the GDPR, and US law does not prevent this transfer. If that arrangement is not acceptable to you, please do not use the Service.

There are two exceptions to the EU-only storage. One is the traffic that passes through Cloudflare's global network (section 6), which may be handled at a Cloudflare location in the United States; that processing is covered by the EU-U.S. Data Privacy Framework and the European Commission's Standard Contractual Clauses. The other is the map: the map library is fetched from a public CDN (unpkg) when you open the browse page, and the map tiles from OpenStreetMap when a map is shown. They therefore see your IP address, as any website you visit does, but receive no data from us. The table that turns a ZIP code into a town and state is built from GeoNames.org data (licensed CC BY 4.0) and runs on our own server; your ZIP code is never sent to GeoNames.

8. Cookies, Do Not Track and Global Privacy Control

We use only essential cookies. No US or EU law requires consent or a banner for cookies that are strictly necessary to run a site, and we set no others:

• A sign-in cookie that keeps you signed in after code verification, for up to 24 hours by default. It is restricted to this site (SameSite=Lax) and cannot be read by scripts (HttpOnly).
• A shop cookie remembering which shop you were browsing, so a link without a shop parameter still takes you to the right one.
• A language cookie remembering the language you picked, on shops that offer more than one.
• A currency cookie remembering the currency you chose to read prices in, on shops that accept more than one. It changes only how prices are displayed to you; it does not change any price, and nothing is recorded against your account.
• A locale cookie remembering the language-and-market address you chose in the header (for example /en-us/), so the site opens there next time instead of guessing from your connection's country.
• A technical session identifier (SessionID) set by the web-server software on every visit to tell one browser from another. It holds no personal information and we do not use it to identify you.
• Cloudflare may set its own security cookies (such as __cf_bm) to tell people from automated traffic. They are strictly necessary and are not used for advertising.

We do not use analytics cookies, advertising cookies, tracking pixels, third-party social-media embeds, or session-replay tools, and we do not track you across other websites. Because there are no non-essential cookies, we do not show a cookie banner. If we add any non-essential cookies in the future, we will introduce a compliant consent mechanism first.

Do Not Track and Global Privacy Control. Some browsers send a "Do Not Track" header or a Global Privacy Control (GPC) signal. Because we do not sell or share your personal information and do not track you across sites, there is nothing for these signals to opt you out of: the answer is already no for everyone. We treat a GPC signal as a valid opt-out request all the same, and it changes nothing about how we process your information.

9. Your rights under GDPR

Because Explicants is established in the EU, the GDPR gives you the following rights over your personal information regardless of where you live:

• Access (Art. 15): get a copy of the information we hold about you.
• Rectification (Art. 16): correct inaccurate or incomplete information.
• Erasure (Art. 17, "right to be forgotten"): delete your information.
• Restriction (Art. 18): limit how we use your information in certain cases.
• Data portability (Art. 20): receive your information in a machine-readable format.
• Object (Art. 21): object to processing based on our legitimate interests.
• Withdraw consent at any time, where processing is based on consent (we currently rely on consent only for marketing emails, which we do not send today).

10. Your US state privacy rights

Several states (among them California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana) have consumer privacy laws. Most of them apply only to businesses above a certain size or revenue, and PuckYard is well below those thresholds today. We nevertheless honor the following rights for every US user, because they overlap almost entirely with what the GDPR already requires of us:

• Right to know and access: what categories and specific pieces of personal information we have collected about you, where it came from, why we collected it, and with whom we shared it. Sections 2 to 7 are that disclosure; section 11 explains how to get your own copy.
• Right to correct inaccurate personal information.
• Right to delete the personal information we hold about you, subject to the exceptions the law allows (for example, information we must keep to complete a request you made, to detect fraud, or to comply with a legal obligation) and to the retention rules in section 5.
• Right to data portability: a copy of your information in a portable, machine-readable format.
• Right to opt out of the sale of your personal information, of its sharing for cross-context behavioral advertising, of targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects. We do none of these things, so this right is honored for everyone by default and there is no "Do Not Sell or Share" link because there is nothing to switch off.
• Right to limit the use of sensitive personal information: we collect none.
• Right to non-discrimination: we will not deny you the Service, charge you a different price, or provide a different level of service because you exercised a privacy right. The Service is free and the same for everyone.
• Right to appeal: if we decline to act on a request, we will tell you why, and you may appeal by replying to our answer. We will respond to the appeal within 45 days and explain the outcome. If you are still not satisfied, you may contact your state's Attorney General (section 14).

We do not knowingly sell or share the personal information of anyone, including consumers under 16. We do not offer financial incentives in exchange for personal information.

11. How to exercise your rights

You can act on the most common rights yourself, directly from your Account page:

• Access and portability: click Download my data on your Account page. We return a JSON file containing your account, your listings, and your messages.
• Correction: edit your display name, profile photo, recovery email, default location, club or team, message-notification preference, and listings yourself. To change the email you sign in with, write to us (below) and we will move your account to the new address once both addresses are verified.
• Deletion: click Delete my account on your Account page. Your profile and listings are removed; messages you sent stay visible to the other party but with your name shown as "Deleted user".

For the other rights (restriction, objection, withdrawal of consent, or an appeal), or if the self-serve tools do not work for your case, please write to us at [email protected]. Requests are free of charge. We will respond within one month of receiving your request, which is within the 45 days US state laws allow; for a complex request we may extend this and will tell you why, as Article 12(3) GDPR permits.

Verification. Before acting on a request we need to be reasonably sure it comes from you. The simplest way is to write from the email address on your account; we may also send a one-time code to that address, or ask you to confirm details we already hold (such as recent listing or message activity). We will not ask for more information than we need to verify you, and we use it only for that.

Authorized agents. Where your state's law allows, you may have someone else submit a request on your behalf. We will ask the agent for your signed written permission and will confirm the request with you directly at your account email before acting on it.

12. Children

PuckYard is not directed to children. Users must be 18, or 13 to 17 with a parent's or guardian's permission and supervision (see our Terms). Children under 13 may not use the Service, and we do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, as the Children's Online Privacy Protection Act (COPPA) requires, we will delete it promptly. A parent or guardian who believes a child has given us information can write to us at the address in section 16 and we will remove it.

A user under 18 who posted something on the Service can remove it at any time: delete the listing, or delete the account from the Account page. If you need help doing so, write to us.

13. Security and data breaches

Connections to the Service are encrypted (HTTPS), there are no passwords to steal because sign-in uses one-time codes, access to the systems that hold your information is limited to the people who run the Service, and the sign-in cookie cannot be read by scripts. No system is perfectly secure. If a breach of security affects your personal information, we will notify you and, where required, the Danish Data Protection Authority as the GDPR requires (within 72 hours of becoming aware, where the breach is likely to result in a risk to you), and we will also give the notice your state's data-breach law requires.

14. Complaints

If you are not satisfied with how we handle your personal information, please write to us first; we will do our best to put it right. You also have the right to complain to the authority that supervises us, the Danish Data Protection Authority:

In the United States you may also report a privacy concern to the Federal Trade Commission at reportfraud.ftc.gov, or to the Attorney General of your state, who enforces your state's privacy law.

15. Changes to this Policy

We may update this Policy from time to time to reflect changes to the Service, our processing activities, or legal requirements. When we do, we will post the updated version here with a new "Last updated" date and, for material changes affecting your rights, notify active accounts by email. We encourage you to review this page periodically.

16. Contact

Last updated: September 25, 2026