Privacy Policy
Last updated: November 4, 2026
We help empower you and other participants of The Buy Nothing Project and BuyNothing to communicate with your communities and share gifts. To do these things, you will sometimes need to share personal data—like your name and email address—with us and select third parties. We are grateful you entrust us with this data and take our responsibility to protect it very seriously.
Please learn more about how we collect, use, and share your personal data by reading this Privacy Policy. Contact us if you have any questions.
Personal Data and The Buy Nothing Project
The Buy Nothing Project supports communities around the planet and we think a right to privacy is an important, global right. For this reason, we treat any data that relates to an identified or identifiable individual or that is linked or linkable to them by us as “personal data,” and we treat this personal data the same no matter where you live. This means data that directly identifies you–like your personal name—or data that could reasonably identify you—like your email address—is personal data. Conversely, aggregated or anonymized data is not personal data.
To enrich our services and better serve our communities, The Buy Nothing Project may link to third parties or integrate their services on our platform (for example, to allow log-in through your favorite social network). This Privacy Policy does not apply to how third parties define or use personal data. We encourage you to read their privacy policies and know your privacy rights.
Personal Data Collected
As you know, The Buy Nothing Project is passionate about gifting, but we don’t believe you should have to gift your personal data. This means we strive to only collect the personal data we need. The type of personal data we collect depends on how you use our services. Listed below are the data categories we collect directly from you.
Personal information. Your name, email address, location or address, and date of birth (if signing up with email/password).
Device information. Data about your device or from which your device could be identified, such as your IP address, browser, operating system, app version and a device identifier. In our web app, the device identifier is a fingerprint worked out from characteristics of your browser, such as how it draws graphics and plays audio, and the fonts it has. In our mobile apps, it is an identifier from your device. We use it to keep the community safe, for example to stop blocked devices from returning. We do not use it for advertising, and we do not sell it. This identifier is part of how we protect the services, so it is not optional.
Contact information. Data such as your real name, email address, and physical address/location.
Payment information. Data about your billing address and method of payment, which is collected by our payment processor, Stripe.
Transaction information. Data about the in-app transactions that we help facilitate through our services.
Photos and personal data you voluntarily post. Photos and personal data you voluntarily post on The Buy Nothing Project, including what is shown in your photos and information your device stores inside a photo file, such as when the photo was taken, the type of device and, if your device records it, where.
Usage information. Data about how you use our services, such as which features you open and how long a screen takes to load. See Cookies and Similar Technologies below.
How The Buy Nothing Project Uses Personal Data
The Buy Nothing Project uses personal data to help you facilitate your gifting, to operate and improve our services, to communicate with you, for security and fraud prevention, and to comply with laws and regulations.
To expand on the above, we use personal data for the following purposes:
To meet or fulfill the reason you provided the information to us, including to help facilitate your delivery or receipt of a gift.
To communicate with you about our services, including updates or new offers.
To provide you with support and assistance.
To create and manage your account or other user profiles.
To personalize the services based on your preferences.
To help you post more easily, by using automated tools to look at the photos you add to a post and suggest a title, description and category that you can use, change or ignore.
To respond to user inquiries and fulfill user requests.
To improve and develop the services, including testing, research, analysis and product development.
To protect against or deter fraudulent, illegal or harmful actions and maintain the safety, security and integrity of our services.
To check photos and posts against our Terms of Use and community standards, using automated tools and, where needed, review by a person.
To comply with our legal or contractual obligations, resolve disputes, and enforce our Terms of Use.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
For any other business purpose stated when collecting your personal data or as otherwise set forth in applicable data privacy laws.
Unless we give you prior notice, we will not collect additional categories of personal data or use personal data we collect except as described in this Privacy Policy.
As noted in the list above, we may communicate with you if you’ve provided us the means to do so. For example, if you’ve given us your email address, we may send you informational offers or important product updates. If you do not want to receive these communications from us, you may unsubscribe from them.
How The Buy Nothing Project Shares Personal Data
Not only do we strive to collect only personal data we need, but we only disclose personal data to third parties as described below.
To select recipients. These are third parties we share personal data with at your direction, including the public (where you choose to post information publicly), other users (as necessary to facilitate a gifting transaction on our services), or social media services (if you intentionally interact with them through your use of our services).
Service providers. These are third parties that help us provide our services, including payment processors, security and fraud prevention providers, hosting and other technology and communications providers (including providers of automated image and text analysis tools), error and performance monitoring providers, analytics providers, and staff augmentation and contract personnel. The specific providers we use are listed under Cookies and Similar Technologies below.
To acquirers. These are parties who acquire your personal data through an acquisition or other change of control. Personal data may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part).
To our affiliated entities. These are our wholly owned entities subject to this Privacy Policy.
Automated Review of Photos and Posts
When you add a photo to a post, automated tools look at what the photo shows. When you post, they also read the words in your post. We use the results to check that photos and posts follow our Terms of Use and to test and improve these checks. As we introduce the feature, we will also use them to suggest a title, description and category, and to label the item (for example its type, color or material) so posts are easier to organize and find. You can use, change or ignore any suggestion.
If a photo or post appears to break our rules, it may be stopped before it is published, held until a member of our team has looked at it, or removed. If you think we got it wrong, contact us at librarian@buynothingproject.org and a person will review the decision.
These tools are Amazon Web Services products (Amazon Rekognition and Amazon Bedrock). They run on our behalf in the United States, in the same hosting account as the rest of our services. We do not use them to recognize faces or to identify the people in a photo, and we do not allow your photos to be used to train artificial intelligence models.
Some photos contain information added by your device, such as when and where the photo was taken and the type of device. We keep your original photo file as you uploaded it. We also record the date, the type of device and an approximate location (to about 1 kilometer, or about half a mile) for up to 12 months, and use them only to help detect fraud and keep our communities safe. Photos added through our mobile apps don’t include a location. Photos added from a web browser may, and at the moment anyone who has the web address of the original file can open it. We are changing this so that only we can open original files.
Cookies and Similar Technologies
Cookies are small data files placed on your computer, tablet, phone, or other device when you use our services. We and a small number of service providers use cookies and similar technologies—including local storage, mobile SDKs, and web beacons—to keep the services running, remember your settings, understand how people use the services, and fix problems.
We do not use cookies for advertising, retargeting, or profiling. We do not sell your personal data, and we do not share it for cross-context behavioral advertising.
We use two categories:
Strictly necessary. Required to operate the services—signing you in, keeping your session secure, delivering messages between community members, and detecting errors and abuse. These cannot be switched off, because the services will not work without them.
Analytics and performance. These help us see which features are used, where people get stuck, and what to improve. They are on in our web app and mobile apps today. A choice for our web app is coming soon.
Your consent and privacy choices
On our website. Our marketing website, buynothingproject.org, places only strictly necessary cookies on your device. It carries no advertising or tracking cookies, and our website analytics measure visits in aggregate without cookies and without following you to other sites. Because there is nothing optional to agree to, we do not ask you to accept cookies to browse our site.
In our web app. Our web app collects product analytics when you use it, including when you are signed out. We are adding a banner that will let you choose. We do not yet act on a Global Privacy Control signal for these analytics.
In our mobile apps. Our iOS and Android apps collect product analytics, including which screens and features you use. The apps do not yet have a setting to turn this off.
From our servers. Our servers also send some activity on your account to our analytics providers, such as profile views, notification reads, parts of onboarding and subscription events, and delivery statistics for messages we send. We send this with a coded version of your user ID, not your name or email address. The choices above control analytics in your browser. They do not control this server activity.
Deleting analytics data. If you would like us to delete analytics data already collected about you, contact us at librarian@buynothingproject.org.
Selling and sharing. We do not sell your personal data and we do not share it for cross-context behavioral advertising—for anyone, in any browser, whether or not you ask us. Because of this, a Global Privacy Control (GPC) signal has no selling or sharing to switch off. We do not respond to older “Do Not Track” browser signals, which never settled on an agreed standard.
Service providers that receive data
These are the third parties that process personal data when you use our services:
PostHog — Product analytics in our web app and mobile apps, and activity sent from our servers
Google Analytics for Firebase — Product analytics in our mobile apps, and message delivery statistics sent from our servers
Google Maps Platform — Maps, place search and address lookup when you use location features — Strictly necessary for those features
Framer — Website analytics for our marketing pages—visits and traffic sources, measured in aggregate without cookies or cross-site tracking
Sentry — Error and crash monitoring—collects technical detail about failures, such as device type, app version, and IP address, and in our mobile apps a screenshot at the moment of the error — Strictly necessary
Ably — Real-time messaging infrastructure—delivers chat and live updates between community members — Strictly necessary
Stripe — Payment processing—collects billing address and payment method where a payment is made — Strictly necessary
RevenueCat — Manages subscriptions bought through the App Store, Google Play and our web app — Strictly necessary for subscriptions
Amazon Web Services — Hosting, storage, email delivery, and the automated photo and post checks described in Automated Review of Photos and Posts — Strictly necessary
Cloudflare — Website address and traffic routing — Strictly necessary
Apple, Google and Facebook — Sign-in, if you choose to use one of these accounts
ThumbmarkJS — Device fingerprint library. For a very small sample of new browsers, the fingerprint, device details and page path go to the provider.
Our service providers process data to provide their services to us. Their own privacy policies describe their practices in full.
Data Security and Retention
Protecting your personal data is extremely important to us and so we seek to protect it from unauthorized access, use and disclosure by using appropriate physical, technical, organizational, and administrative security measures based on the type of personal data we collect and the way we process it. For example, our services use industry standard Secure Sockets Layer (SSL) technology to allow for the encryption of personal data you provide to us.
We retain personal data about you for as long as you have an open account with us or as otherwise necessary to provide you with our services. In some cases, we retain personal data for longer if doing so is necessary to comply with our legal obligations, resolve disputes, or is otherwise permitted or required by applicable law, rule, or regulation.
Records from the automated review of photos and posts have shorter limits. We keep review decisions, and the photo details described in Automated Review of Photos and Posts, for up to 12 months, so that we can respond to questions and appeals. Detailed results, such as suggested text, are deleted after 90 days. Records about photos that are uploaded but never posted are deleted within two days.
Children and Personal Data
Our Terms of Use require everyone who uses our services to be at least 18 years of age. We do not knowingly collect or solicit personal data from anyone under 18.
If you are under 18, please do not attempt to register for or use our services, and please do not send us any personal data. If we learn that we have collected personal data from someone under 18 years of age, we will delete that information as quickly as possible. If you believe that someone under 18 years of age may have provided us personal data, please contact us at librarian@buynothingproject.org.
Account and Personal Data Deletion
You can request to delete your account at any time by accessing your account settings and selecting “Delete Account.” Please note that deleting your account is permanent and will result in the removal of all associated personal data. Click here for a page with instructions for each step of this process.
If you have any questions or would like our help with the deletion of your account and all associated personal data retained by the Buy Nothing Project and BuyNothing, please reach us by email to librarian@buynothingproject.org.
Further Information
This Privacy Policy applies to all services offered by The Buy Nothing Project and its affiliated entities.
We are constantly improving our services and so we may need to change this Privacy Policy from time to time. When we make material changes, we will notify you by placing a notice on The Buy Nothing Project website and/or by sending you an email if we have your address on file. Our use of personal data we collect is subject to the Privacy Policy in effect at the time such information is collected so that you control what you’d like to share.
If you have any questions or comments about this Privacy Policy or the ways in which we collect and use your personal data, please do not hesitate to contact us at librarian@buynothingproject.org.
State Specific Privacy Rights and Disclosures
California Residents
If you are a California resident, you have the rights set forth in this section. If you are a California resident and there are any conflicts between this section and any other provision of The Buy Nothing Project Privacy Policy, the portion that is more protective of personal data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following rights apply to you, please contact us at librarian@buynothingproject.org.
Access
You have the right to request certain information about our collection and use of your personal data over the past 12 months. In response, we will provide you with the following information:
The categories of personal data that we have collected about you.
The categories of sources from which that personal data was collected.
The business or commercial purpose for collecting or selling your personal data.
The categories of third parties with whom we have shared your personal data.
The specific pieces of personal data that we have collected about you.
If we have disclosed your personal data to any third parties for a business purpose over the past 12 months, we will identify the categories of personal data shared with each category of third-party recipient. If we have sold your personal data over the past 12 months, we will identify the categories of personal data sold to each category of third-party recipient.
Account & Personal Data Deletion
You have the right to request that we delete the personal data that we have collected about you. Under the California Consumer Privacy Act, this right is subject to certain exceptions: for example, we may need to retain your personal data to provide you with the services or complete a transaction or other action you have requested. If your deletion request is subject to one of these exceptions, we may deny your deletion request.
Exercising Your Rights
To exercise the rights described above, you must send us a request that (1) provides sufficient information to allow us to verify that you are the person about whom we have collected personal data, and (2) describes your request in sufficient detail to allow us to understand, evaluate and respond to it. Each request that meets both of these criteria will be considered a “Valid Request.” We may not respond to requests that do not meet these criteria. We will only use personal data provided in a Valid Request to verify your identity and complete your request. You do not need an account to submit a Valid Request.
We will work to respond to your Valid Request within 45 days of receipt. We will not charge you a fee for making a Valid Request unless your Valid Request(s) is excessive, repetitive or manifestly unfounded. If we determine that your Valid Request warrants a fee, we will notify you of the fee and explain that decision before completing your request.
You may submit a Valid Request by emailing us at librarian@buynothingproject.org.
You may also authorize an agent to exercise your rights on your behalf. To do this, you must provide your authorized agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your authorized agent when they make a request on your behalf.
Personal Data Sales and Sharing Opt-Out
We will not sell your personal data and have not done so over the last 12 months. We also do not share personal data for cross-context behavioral advertising.
Because we do not sell or share personal data for any user, there is no sale or sharing for an opt-out preference signal such as Global Privacy Control (GPC) to switch off. If your browser sends a GPC signal, you are already covered by our practice of not selling or sharing, and we will not ask you to verify your identity or take any further step.
Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of personal data to third parties for such third parties’ direct marketing purposes; in order to submit such a request, please contact us at librarian@buynothingproject.org.
No Discrimination
We will not discriminate against you for exercising your rights under the California Consumer Privacy Act. We will not deny you our goods or services, charge you different prices or rates, or provide you a lower quality of goods and services if you exercise your rights under the California Consumer Privacy Act. However, we may offer different tiers of our services as allowed by applicable data privacy laws (including the California Consumer Privacy Act) with varying prices, rates or levels of quality of the goods or services you receive related to the value of personal data that we receive from you.
Nevada Residents
We do not sell your personal data as sales are defined in Nevada Revised Statutes Chapter 603A.