Privacy Policy
Last updated: September 18, 2026
We help empower you and other participants of The Buy Nothing Project and BuyNothing to communicate with your communities and share gifts. To do these things, you will sometimes need to share personal data—like your name and email address—with us and select third parties. We are grateful you entrust us with this data and take our responsibility to protect it very seriously.
Please learn more about how we collect, use, and share your personal data by reading this Privacy Policy. Contact us if you have any questions.
Personal Data and The Buy Nothing Project
The Buy Nothing Project supports communities around the planet and we think a right to privacy is an important, global right. For this reason, we treat any data that relates to an identified or identifiable individual or that is linked or linkable to them by us as “personal data,” and we treat this personal data the same no matter where you live. This means data that directly identifies you–like your personal name—or data that could reasonably identify you—like your email address—is personal data. Conversely, aggregated or anonymized data is not personal data.
To enrich our services and better serve our communities, The Buy Nothing Project may link to third parties or integrate their services on our platform (for example, to allow log-in through your favorite social network). This Privacy Policy does not apply to how third parties define or use personal data. We encourage you to read their privacy policies and know your privacy rights.
Personal Data Collected
As you know, The Buy Nothing Project is passionate about gifting, but we don’t believe you should have to gift your personal data. This means we strive to only collect the personal data we need. The type of personal data we collect depends on how you use our services. Listed below are the data categories we collect directly from you.
Personal information. Your name, email address, location or address, and date of birth (if signing up with email/password).
Device information. Data about your device or from which your device could be identified, such as your IP address or device serial number.
Contact information. Data such as your real name, email address, and physical address/location.
Payment information. Data about your billing address and method of payment, which is collected by our payment processor, Stripe.
Transaction information. Data about the in-app transactions that we help facilitate through our services.
Photos and personal data you voluntarily post. Photos and personal data you voluntarily post on The Buy Nothing Project.
Usage information. Data about how you use our services, such as which features you open and how long a screen takes to load. Where this is collected through optional analytics, we collect it only with your agreement. See Cookies and Similar Technologies below.
How The Buy Nothing Project Uses Personal Data
The Buy Nothing Project uses personal data to help you facilitate your gifting, to operate and improve our services, to communicate with you, for security and fraud prevention, and to comply with laws and regulations.
To expand on the above, we use personal data for the following purposes:
To meet or fulfill the reason you provided the information to us, including to help facilitate your delivery or receipt of a gift.
To communicate with you about our services, including updates or new offers.
To provide you with support and assistance.
To create and manage your account or other user profiles.
To personalize the services based on your preferences.
To respond to user inquiries and fulfill user requests.
To improve and develop the services, including testing, research, analysis and product development.
To protect against or deter fraudulent, illegal or harmful actions and maintain the safety, security and integrity of our services.
To comply with our legal or contractual obligations, resolve disputes, and enforce our Terms of Use.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
For any other business purpose stated when collecting your personal data or as otherwise set forth in applicable data privacy laws.
Unless we give you prior notice, we will not collect additional categories of personal data or use personal data we collect except as described in this Privacy Policy.
As noted in the list above, we may communicate with you if you’ve provided us the means to do so. For example, if you’ve given us your email address, we may send you informational offers or important product updates. If you do not want to receive these communications from us, you may unsubscribe from them.
How The Buy Nothing Project Shares Personal Data
Not only do we strive to collect only personal data we need, but we only disclose personal data to third parties as described below.
To select recipients. These are third parties we share personal data with at your direction, including the public (where you choose to post information publicly), other users (as necessary to facilitate a gifting transaction on our services), or social media services (if you intentionally interact with them through your use of our services).
Service providers. These are third parties that help us provide our services, including payment processors, security and fraud prevention providers, hosting and other technology and communications providers, error and performance monitoring providers, analytics providers, and staff augmentation and contract personnel. The specific providers we use are listed under Cookies and Similar Technologies below.
To acquirers. These are parties who acquire your personal data through an acquisition or other change of control. Personal data may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part).
To our affiliated entities. These are our wholly owned entities subject to this Privacy Policy.
Cookies and Similar Technologies
Cookies are small data files placed on your computer, tablet, phone, or other device when you use our services. We and a small number of service providers use cookies and similar technologies—including local storage, mobile SDKs, and web beacons—to keep the services running, remember your settings, understand how people use the services, and fix problems.
We do not use cookies for advertising, retargeting, or profiling. We do not sell your personal data, and we do not share it for cross-context behavioral advertising.
We use two categories:
Strictly necessary. Required to operate the services—signing you in, keeping your session secure, delivering messages between community members, and detecting errors and abuse. These cannot be switched off, because the services will not work without them.
Analytics and performance. Optional, and used only in our mobile apps. These help us see which features are used, where people get stuck, and what to improve. You can turn them off at any time—see Your consent and privacy choices below.
Your consent and privacy choices
On our website. Our website places only strictly necessary cookies on your device. It carries no advertising or tracking cookies, and our website analytics measure visits in aggregate without cookies and without following you to other sites. Because there is nothing optional to agree to, we do not ask you to accept cookies to browse our site.
In the app. The app collects optional product analytics that help us see which features are used and where people encounter difficulty. You can turn this off at any time: open Settings and select Privacy choices. Turning it off takes effect immediately and does not limit your access to the services or change what you can do in your community. Turning analytics off applies from that point forward. It does not undo collection that already took place while it was switched on. If you would like us to delete analytics data already collected about you, contact us at librarian@buynothingproject.org.
Selling and sharing. We do not sell your personal data and we do not share it for cross-context behavioral advertising—for anyone, in any browser, whether or not you ask us. Because of this, there is nothing for a Global Privacy Control (GPC) signal to switch off on our website. If your browser sends one, you are already covered. We do not respond to older “Do Not Track” browser signals, which never settled on an agreed standard.
Service providers that receive data
These are the third parties that process personal data when you use our services:
PostHog — Product analytics in our mobile apps—which features are used and where people encounter difficulty — Optional
Framer — Website analytics for our marketing pages—visits and traffic sources, measured in aggregate without cookies or cross-site tracking — Strictly necessary
Sentry — Error and crash monitoring—collects technical detail about failures, such as device type, app version, and IP address, so we can diagnose them — Strictly necessary
Ably — Real-time messaging infrastructure—delivers chat and live updates between community members — Strictly necessary
Stripe — Payment processing—collects billing address and payment method where a payment is made — Strictly necessary
Each of these processes data on our instructions and is not permitted to use it for its own purposes. Their own privacy policies describe their practices in full.
Data Security and Retention
Protecting your personal data is extremely important to us and so we seek to protect it from unauthorized access, use and disclosure by using appropriate physical, technical, organizational, and administrative security measures based on the type of personal data we collect and the way we process it. For example, our services use industry standard Secure Sockets Layer (SSL) technology to allow for the encryption of personal data you provide to us.
We retain personal data about you for as long as you have an open account with us or as otherwise necessary to provide you with our services. In some cases, we retain personal data for longer if doing so is necessary to comply with our legal obligations, resolve disputes, or is otherwise permitted or required by applicable law, rule, or regulation.
Children and Personal Data
Our Terms of Use require everyone who uses our services to be at least 18 years of age. We do not knowingly collect or solicit personal data from anyone under 18.
If you are under 18, please do not attempt to register for or use our services, and please do not send us any personal data. If we learn that we have collected personal data from someone under 18 years of age, we will delete that information as quickly as possible. If you believe that someone under 18 years of age may have provided us personal data, please contact us at librarian@buynothingproject.org.
Account and Personal Data Deletion
You can request to delete your account at any time by accessing your account settings and selecting “Delete Account.” Please note that deleting your account is permanent and will result in the removal of all associated personal data. Click here for a page with instructions for each step of this process.
If you have any questions or would like our help with the deletion of your account and all associated personal data retained by the Buy Nothing Project and BuyNothing, please reach us by email to librarian@buynothingproject.org.
Further Information
This Privacy Policy applies to all services offered by The Buy Nothing Project and its affiliated entities.
We are constantly improving our services and so we may need to change this Privacy Policy from time to time. When we make material changes, we will notify you by placing a notice on The Buy Nothing Project website and/or by sending you an email if we have your address on file. Our use of personal data we collect is subject to the Privacy Policy in effect at the time such information is collected so that you control what you’d like to share.
If you have any questions or comments about this Privacy Policy or the ways in which we collect and use your personal data, please do not hesitate to contact us at librarian@buynothingproject.org.
State Specific Privacy Rights and Disclosures
California Residents
If you are a California resident, you have the rights set forth in this section. If you are a California resident and there are any conflicts between this section and any other provision of The Buy Nothing Project Privacy Policy, the portion that is more protective of personal data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following rights apply to you, please contact us at librarian@buynothingproject.org.
Access
You have the right to request certain information about our collection and use of your personal data over the past 12 months. In response, we will provide you with the following information:
The categories of personal data that we have collected about you.
The categories of sources from which that personal data was collected.
The business or commercial purpose for collecting or selling your personal data.
The categories of third parties with whom we have shared your personal data.
The specific pieces of personal data that we have collected about you.
If we have disclosed your personal data to any third parties for a business purpose over the past 12 months, we will identify the categories of personal data shared with each category of third-party recipient. If we have sold your personal data over the past 12 months, we will identify the categories of personal data sold to each category of third-party recipient.
Account & Personal Data Deletion
You have the right to request that we delete the personal data that we have collected about you. Under the California Consumer Privacy Act, this right is subject to certain exceptions: for example, we may need to retain your personal data to provide you with the services or complete a transaction or other action you have requested. If your deletion request is subject to one of these exceptions, we may deny your deletion request.
Exercising Your Rights
To exercise the rights described above, you must send us a request that (1) provides sufficient information to allow us to verify that you are the person about whom we have collected personal data, and (2) describes your request in sufficient detail to allow us to understand, evaluate and respond to it. Each request that meets both of these criteria will be considered a “Valid Request.” We may not respond to requests that do not meet these criteria. We will only use personal data provided in a Valid Request to verify your identity and complete your request. You do not need an account to submit a Valid Request.
We will work to respond to your Valid Request within 45 days of receipt. We will not charge you a fee for making a Valid Request unless your Valid Request(s) is excessive, repetitive or manifestly unfounded. If we determine that your Valid Request warrants a fee, we will notify you of the fee and explain that decision before completing your request.
You may submit a Valid Request by emailing us at librarian@buynothingproject.org.
You may also authorize an agent to exercise your rights on your behalf. To do this, you must provide your authorized agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your authorized agent when they make a request on your behalf.
Personal Data Sales and Sharing Opt-Out
We will not sell your personal data and have not done so over the last 12 months. We also do not share personal data for cross-context behavioral advertising.
Because we do not sell or share personal data for any user, there is no sale or sharing for an opt-out preference signal such as Global Privacy Control (GPC) to switch off. If your browser sends a GPC signal, you are already covered by our practice of not selling or sharing, and we will not ask you to verify your identity or take any further step.
Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of personal data to third parties for such third parties’ direct marketing purposes; in order to submit such a request, please contact us at librarian@buynothingproject.org.
No Discrimination
We will not discriminate against you for exercising your rights under the California Consumer Privacy Act. We will not deny you our goods or services, charge you different prices or rates, or provide you a lower quality of goods and services if you exercise your rights under the California Consumer Privacy Act. However, we may offer different tiers of our services as allowed by applicable data privacy laws (including the California Consumer Privacy Act) with varying prices, rates or levels of quality of the goods or services you receive related to the value of personal data that we receive from you.
Nevada Residents
We do not sell your personal data as sales are defined in Nevada Revised Statutes Chapter 603A.