Privacy Policy

What we collect

When you create an account

Your email address, a display name, and a password. Passwords are stored only as a bcrypt hash, so we never store or see the password itself. If your email ends in .edu, your account is marked "University Verified"; we do not otherwise confirm that you attend any particular school.

When you list an item

Everything you type into the listing form (title, description, price, category, campus, availability, payment preference, and your meetup note), plus the photos you upload. Listings are public. Anyone on the internet can see your photos, your item details, your campus, and the display name attached to the listing. Don't put anything in a listing you wouldn't post publicly, including your phone number or home address.

If you start a listing while logged out, it is saved in your own browser (localStorage and IndexedDB) so you don't lose it while creating an account. That draft never leaves your device until you publish it, and it is discarded after seven days.

When you message someone

Messages between buyers and sellers are stored in our database so the conversation persists. They are not end-to-end encrypted, and we can read them. We may do so to investigate reports of fraud, harassment, or illegal listings.

When you buy something

We store the order amount, the item, the status, and the email address you gave at checkout. We never see or store your card number. Payment details go directly to Stripe, our payment processor. Many listings are paid off-platform in cash or by app between you and the seller; Zwype is not involved in those payments and has no record of them.

Automatically, as you browse

We record anonymous usage events — for example that someone opened the "buy or sell" chooser and which option they picked. These are stored with a random identifier generated by your browser. They contain no IP address, no name, and no account ID, and we cannot use them to work out who you are. We also use Vercel Web Analytics for page views and referrers, which does not use cookies or track you across sites.

Cookies

Zwype sets one cookie, named zwype. It is a signed session cookie holding your user ID and display name so you stay logged in. It expires after 7 days. We do not use cookies for advertising of our own.

Advertising and the Meta Pixel

When we are running ads on Facebook or Instagram, Zwype loads the Meta Pixel. It tells Meta that a visit or an action happened (a page view, viewing an item, creating an account, publishing a listing, starting a checkout, or completing a purchase) so we can tell which ads work and stop paying for ones that don't.

We do not send Meta your email address, your name, your account ID, or your messages. Meta receives the event, the item ID and price where relevant, and the technical information any website receives when your browser loads a resource, including your IP address. Meta may connect that to your Facebook or Instagram account under their own privacy policy, which we do not control. You can limit this in your Facebook Ad Preferences, and browser tracking-protection settings or an ad blocker will also stop it.

Who else receives data

We don't sell your personal information. We use these services to run the site, and each receives only what it needs:

We may also disclose information if the law requires it, or to investigate fraud, safety, or illegal activity on the marketplace.

Photo screening

Photos you add to a listing are checked for explicit content in your browser before upload, using a model downloaded to your device. The photo itself is not sent anywhere for screening. This is a best-effort filter, not a guarantee.

Your choices

You can edit your display name and delete any of your listings at any time from your account. Deleting a listing also deletes its photos.

Zwype does not yet have a self-service "delete my account" button. To get a copy of your data or have your account and its contents deleted, email privacy@zwype.net from the address on the account and we'll take care of it. Some records tied to a completed payment may be kept where we're required to retain them.

Depending on where you live, you may have rights to access, correct, delete, or restrict use of your personal information. Use the same address and we'll honor those requests.

Retention and security

We keep your account and listings until you ask us to delete them. Anonymous usage events are kept for analysis. Passwords are hashed, session cookies are signed and HTTP-only, and traffic is served over HTTPS. No service can promise perfect security, and Zwype is a small, student-run site, so please use a password you don't reuse elsewhere.

Children

Zwype is meant for college students and adults buying on their behalf. It is not directed to children under 13, and we don't knowingly collect their information. If you believe a child has created an account, email us and we'll remove it.

Changes and contact

If this policy changes we'll update the date at the top of this page. Questions, requests, or anything that looks wrong here: privacy@zwype.net.