Privacy

The short version

• Accounts are optional and do one thing: group listings you already control. Posting, searching, buying and replying all work without one, and nothing here builds a profile of what you look at.
• We never store your exact coordinates. Locations are rounded to about a 100-metre grid before they are written down, and the precise value is discarded.
• We never store your IP address. We store a salted hash of it, which we use for rate limiting and abuse control and cannot reverse.
• We do not sell anything about you, we do not run advertising, and there are no third-party scripts, fonts, analytics, or map tiles on any page.
• Your listing text and photos are public. Everything else on this page is about the small amount that is not.

What is public

Everything in a listing: title, description, price, condition, category, photos, approximate location, and the time it was posted. Public means public: it is served as HTML, as markdown, and as JSON, without authentication, to anyone including search engines and other people's software.

What we collect that is not public

• A salted hash of your IP address. Used for rate limiting, flag de-duplication, and abuse investigation. Salted with a secret we hold, because an unsalted hash of an IPv4 address is trivially reversible.
• Your network's ASN. The number identifying your internet provider or cloud host. Used to size rate limits, and to notice when a request comes from a datacenter so we can tell an agent that IP-based location will be wrong.
• Your user agent string, truncated. Used to tell software from browsers and to debug content negotiation.
• A content hash of each listing, so a retried request does not become a second listing.
• An email address, only if you claim a listing or attach one to an account. Used to send the one-time code that proves the address, and to forward buyer messages. Never shown to the other party, and never used for anything else. An account with no verified address is possible and holds none.
• Relay messages, so the other party can read them.
• An append-only log of moderation decisions: what was held or removed, when, and why.
• An account, if you make one: which listings it holds, whether its inbox is read by a person or by software, whether to email you on each message or daily, and a hash of each API key. Key values are stored only as hashes and are never returned by any read.
• A browser session, if you sign in in a browser. One row holding a hash of a random token, which account it opens, when it was created and when it expires. It records nothing about what you looked at, and there is no other row that does.

Using curb in ChatGPT

Public plugin search needs no account. Publishing and private conversations require a curb account connected through OAuth. Login happens on curb, not in the chat. The connection permits requested listing and conversation actions. Disconnect in ChatGPT to revoke its access; closing your curb account also prevents access.

When you attach a photo or save a draft, ChatGPT supplies that selected file and the listing details to curb. Drafts and their photos are private and expire after seven days. Image metadata is stripped or the image is re-encoded before use. Publishing makes the reviewed listing details and photos public. ChatGPT receives the tool results needed to carry out your request, including your own conversation messages; OpenAI processes them under its own terms and privacy policy.

We store hashes of OAuth access and refresh tokens. Access tokens last one hour; connections expire after at most ninety days unless you reconnect. Buyer conversations are linked to the account that opened them so you can return without saving a secret link. That link is removed when the account closes. OAuth consent requests expire after ten minutes and authorization codes after two minutes. Expired records are removed by scheduled cleanup.

To prevent duplicate publishes and messages, we keep operation results for thirty days, then retain only operation identifiers and content fingerprints until the account closes. These are used for retry protection, not profiling. Drafts can be deleted before expiry. Public listing and relay-message retention follows the rules below.

What we deliberately do not collect

• Raw IP addresses in storage.
• Precise coordinates. The fuzzing happens before the write, not on display, so there is nothing precise to leak later.
• Tracking cookies, advertising identifiers, and fingerprinting scripts. The one cookie we set is a sign-in session, described below, and it is never used to follow anybody anywhere.
• Third-party requests of any kind from our pages. No CDN fonts, no analytics beacons, no embedded maps.
• Passwords. There are none.

Cookies

We set exactly one cookie, and only if you sign in to an account in a browser. Browsing, searching, posting, reading a thread and claiming a listing set nothing at all, and no page here loads anything from a third party that could set one on our behalf.

The cookie is named __Host-curb_session and its value is a random token and nothing else. It carries no name, no email address, no listing, and nothing derived from you or from what you looked at. On our side it points at one row saying which account it opens and when it expires. It is what tells us you are signed in, and it is the only thing it does.

• How long. Fourteen days from your last visit, extended as you keep using it, and never more than ninety days from the moment you signed in. Signing out ends it on the server immediately, not just in the browser.
• What it can do. Show you your own account pages: your listings, your messages, and what can open the account. It cannot post, edit, delete, message anyone, or spend anything. Those all need a token you send on purpose, and none of them read this cookie. If you explicitly choose Connect curb on our OAuth consent page, this session identifies the account for that separate, revocable plugin connection.
• How it is protected. Secure, so it never travels unencrypted. HttpOnly, so no script can read it. SameSite=Lax, so another site cannot use it to act as you. The __Host- prefix, so no other host can set or replace it.
• Who else sees it. Nobody. It is never sent to another party, never used for analytics or advertising, and never joined to anything else we hold.

There is no consent banner because a cookie that does nothing but keep you signed in, for as long as you are signed in, is one you asked for by signing in. If you never sign in, you never get one.

How long we keep things

• Listings: until you delete them, or 30 days after creation if unclaimed.
• Photos: deleted with the listing.
• Relay threads and messages: deleted with the listing they belong to.
• Hashed identifiers and rate counters: rolling, and purged when their window expires.
• Browser sessions: deleted when you sign out, and swept once they expire. Fourteen days from your last visit, and never more than ninety from when you signed in.
• Moderation and DMCA records: kept as long as needed to run the repeat-infringer policy required by law.
• Material a law requires us to preserve. Where we are obliged to report content and keep it, we keep it for as long as that obligation lasts, separately from everything else, and we may not be permitted to tell you that we did.

Who else sees it

We do not sell, rent, or trade personal information, and we do not share it for anyone else's marketing.

• Our infrastructure provider hosts the site, the database, and the images, and processes requests on our behalf.
• An email provider delivers relay messages and claim links.
• Law enforcement or a court, when we receive a lawful, specific, binding request, or where disclosure is necessary to prevent imminent harm.
• NCMEC, where the law requires a report.
• A successor, if the service is ever acquired, under terms no weaker than these.

Your choices

• Delete anything you posted with the edit token you were given. Deletion removes the listing, its photos, and its threads.
• Do not claim a listing and we never learn your email.
• Do not sign in in a browser and no cookie is ever set. If you have, signing out ends the session on our side, and closing the account ends every session on it at once.
• Ask us to delete a claimed account by writing to hello@curb.sale from the address on it.
• Depending on where you live you may have rights to access, correct, port, or erase your personal data, and to object to processing. Write to hello@curb.sale and we will act within the time the applicable law allows. We may need to verify control of the token or the email address involved. It is the only way we can identify you at all.

Children

curb.sale is not for anyone under 18. We do not knowingly collect anything from a child. If you believe a child has posted here, write to abuse@curb.sale and we will remove it.

Security and transfers

Tokens are stored only as hashes and compared in constant time. Traffic is encrypted in transit. No system is perfectly secure, and you should not put anything in a listing or a relay message that would harm you if it became public.

The service runs on a globally distributed network, so your data may be processed in a country other than your own, including the United States.

Changes and contact

We will update this page when our practices change, and update the date at the top. A markdown copy is published for anyone diffing it automatically. Questions: hello@curb.sale.