Skip to content
Merc Mercado

Privacy Policy

Last updated: May 23, 2026

What we collect

We collect only what's needed to run the marketplace:

  • Account info — email address, display name, handle, neighborhood. Used to identify you on the platform.
  • Phone number — stored as a one-way hash (SHA-256), not in plain text. Used for seller verification only.
  • Listing content — titles, descriptions, photos, prices you publish. This is public by design.
  • Messages — conversations between buyers and sellers. Visible only to participants.
  • Session data — a cookie that keeps you logged in. No tracking cookies, no analytics cookies.

What we don't collect

  • We don't use Google Analytics or any third-party trackers.
  • We don't collect payment information — all payments happen off-platform (Venmo, Zelle, cash).
  • We don't sell, rent, or share your data with anyone.
  • We don't run behavioral advertising.

How we use your data

  • To run the marketplace — display your listings, enable messaging, process verification.
  • To send you email — magic link login, waitlist confirmation, transaction notifications. No marketing spam.
  • To moderate content — we check listings and messages against basic policy rules (no hate speech, scams, etc.).

Where your data lives

Your data is stored on Cloudflare's infrastructure (D1 database, R2 storage), which operates globally with data residency controls. Photos are stored in Cloudflare R2. We do not use AWS, Google Cloud, or other third-party cloud providers for core data.

Data retention

  • Account data — kept while your account is active. Delete your account and it's gone.
  • Listings — archived (not deleted) when you remove them, in case of disputes.
  • Messages — kept for the lifetime of the conversation. Both parties can see the history.
  • Verification data — phone hashes kept indefinitely. Student ID photos deleted after verification.

Your rights

You can:

  • View and update your profile information at any time.
  • Download your data by contacting us.
  • Delete your account by contacting us. We'll remove your data within 30 days.

Cookies

We use one cookie: mm_session. It keeps you logged in. It's httpOnly, secure, and expires in 30 days. That's it. No tracking cookies, no third-party cookies, no cookie consent banners needed.

Children

Merc Mercado is not intended for children under 13. We do not knowingly collect data from children.

Changes

If we change this policy, we'll update this page and the date at the top. No surprises.

Contact

Questions? Email hello@merc.senacolectivo.com.