Privacy Policy

Local Loop connects people who live near each other so they can buy and sell secondhand goods. Running that safely means we hold a modest amount of information about you: who you are, roughly where you are, what you have listed, what you have said to other neighbors, and what you have bought or sold.

Three commitments shape everything below. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. There are no advertising or analytics trackers in the Local Loop app or on this website. And we ask for the least precise version of a fact that still works: a ZIP code instead of your street address, a verification result instead of your ID document.

This policy covers the Local Loop mobile apps for iOS and Android and the Local Loop website. It does not cover a third-party site you reach by following a link from Local Loop.

Account information

Sign-in is handled by identity software we run ourselves on Google Cloud, rather than by a third-party login provider. When you create an account we store your email address, your display name, and the account identifier that identity server assigns you. If you set a password it is kept only as a cryptographic hash — never in plain text — and the Local Loop marketplace application never receives it. If you sign in with Apple or Google instead, we hold no password for you at all and receive only what that provider releases to us.

Profile information

Your display name, your profile photo if you add one, the neighborhood label shown on your profile, whether you told us you are here to buy or to sell, and when you finished setting up your account.

Location

We store a five-digit home ZIP code, plus the latitude and longitude of that ZIP code’s center, which we look up from a public ZIP code table. We do not store your device’s GPS coordinates. See Location, in detail below.

Listings and photos

The title, description, price, category, condition, and ZIP code of anything you list, along with your delivery preferences and the photos you upload. Photos go straight from your device to a private Google Cloud Storage bucket using a signed upload link that expires in 15 minutes. The bucket is not publicly readable: images are served back only through signed links that expire after seven days. While such a link is live, anyone who has the link can open the image without signing in, so treat a copied image link the way you would treat the photo itself. When you pick a photo, our app asks the photo picker not to return the file’s EXIF metadata, so the camera details and any GPS coordinates your camera embeds are not passed to us.

Messages

The full text of messages you send to other neighbors, who sent them, and when. Messages are stored as ordinary text in our database. They are not end-to-end encrypted. A small number of Local Loop staff can read them when investigating a safety report, a payment dispute, or a support request, or when we are legally required to.

Purchases, offers, and payouts

For each transaction we store the amount, the item, the buyer and seller, the status, and the Stripe payment identifier that lets us reconcile it. If you choose delivery instead of pickup, we store the delivery address you enter and share it with that seller. We also store the offers and counter-offers you make. Where auctions are enabled we store the bids you place, and any strike or suspension recorded against you for not paying for an auction you won. Where item rentals are enabled we store your bookings, the dates, the deposit and any damage claim, and the free-text note you send the owner with a booking request.

We never see or store card numbers, bank account numbers, or routing numbers. Payment details go directly to Stripe. If you set up as a seller, Stripe collects the information it needs to pay you, including your legal name, date of birth, address, tax identifier, and bank account. All we keep is your Stripe account identifier and two flags recording whether Stripe has enabled charges and payouts for you.

Identity verification

Local Loop asks members to verify their identity, which is what the verified badge means. Verification runs through Stripe Identity: you photograph a government ID and take a selfie inside Stripe’s flow, and those images go to Stripe, not to us. We send Stripe only our internal identifier for your account so it can report the result back. We store the session reference and the date you were verified. We never receive or store your ID document, your selfie, or the data extracted from them.

Push notification tokens

If you allow notifications, we store the push token your device issues and the platform it came from, one row per device you sign in on. When we notify you about a new message, the notification carries the sender’s display name and the first 80 characters of the message. That preview travels through Expo’s push service and then Apple or Google to reach your lock screen. Turning off notifications in your device settings stops those previews.

Technical and diagnostic information

• Your IP address, used as a rate-limiting key. It is held in Redis as a short-lived counter that expires after 60 seconds. Once you are signed in, the counter keys on a fragment of your access token instead.
• Application logs recording what the service did — for example that an order changed status — used to operate and debug it. Our hosting provider separately produces infrastructure request logs that can include IP addresses.
• Crash and error reports sent to Sentry when something goes wrong, including error messages, stack traces, and device or platform details. Reports from the mobile app are tagged with your Local Loop user identifier, and Sentry may record the IP address the report came from.
• A device-integrity attestation from Apple App Attest or Google Play Integrity, sent by the app with its API requests so we can tell genuine app traffic from automated abuse. It does not identify you.
• On the website, a session cookie set by our sign-in flow to keep you signed in. We set no advertising or analytics cookies. On mobile, your sign-in tokens are held in the device keychain or keystore, not in a cookie.

Local Loop is built around neighborhoods, so it needs to know roughly where you are. It is deliberately built not to know precisely.

• What we store is a five-digit ZIP code. The coordinates saved alongside it are the center point of that ZIP code, taken from a reference table of ZIP codes. They are not your device location.
• On mobile, if you grant location permission during setup, the app reads your position once and sends those coordinates to our API for the sole purpose of resolving which ZIP code you are in. Only the ZIP code that comes back is saved to your profile; the coordinates themselves are never written to your account. You can decline the permission and type a ZIP code instead. Nothing else in the app asks for your location.
• Listings carry a ZIP code, never a street address. Distances between you and a listing are calculated between ZIP code centers, which is why they are approximate.
• The one exception is delivery. If you choose to have an item delivered, you enter a delivery address at checkout and we share it with that seller so they can bring you the item. Pickup orders never involve an address.

• To run the marketplace: create your account, show you listings near you, and let you list, offer, message, buy, and sell.
• To process payments: hold funds in escrow through Stripe until a sale completes, release payouts to sellers, and issue refunds.
• To establish trust: run identity verification, show verified badges, and publish the ratings and reviews members leave for each other.
• To notify you: message alerts, offer updates, and transaction status, on the channels you have enabled.
• To keep the service safe: investigate reports, detect fraud and abuse, enforce our rules, and rate-limit automated traffic.
• To support and improve the product: answer your emails, diagnose crashes, and fix what is broken.
• To meet legal obligations: tax and accounting records for transactions, and responses to lawful requests.

We do not use your information to build advertising profiles, and we do not run automated decision-making that produces legal effects about you.

We share information with the service providers listed below, each of which processes it on our behalf for the stated purpose and under its own privacy policy. This is the complete list of third parties that handle Local Loop user data.

We also share information with other members when you use the product, as described in the next section, and we will disclose information when we are legally required to, when we need to enforce our terms, or when we believe in good faith that disclosure is necessary to prevent harm. If Local Loop is ever acquired or merged, account information may transfer as part of that transaction; we would tell you before your information became subject to a different privacy policy.

Our servers and database run in the United States. If you use Local Loop from elsewhere, your information is processed in the United States.

Local Loop is a community, so parts of your account are visible to other members. Visible to anyone signed in: your display name, your profile photo, your neighborhood and home ZIP code, whether you are verified, whether you are set up to sell, your star rating, your review count, the reviews written about you, and when you joined.

Your email address is never exposed through our public API. Your exact address is never shown, and neither is your phone number, which we do not collect. Your standing in any auction dispute is visible only to you.

Anything you publish is visible: your listings, their photos and descriptions, and the reviews you write. Reviews use a blind reveal: a review stays hidden until the other party has also reviewed the transaction, or until 14 days after the transaction completes, whichever comes first. Messages are visible only to the two people in the conversation, and to Local Loop staff in the limited circumstances described above.

• Account, profile, listing, message, and review data is kept for as long as your account is open.
• Rate-limiting counters in Redis expire automatically after 60 seconds.
• Signed links to your photos expire after seven days and are regenerated on demand; the underlying files are kept while the listing or profile they belong to exists.
• Transaction records — orders, bookings, bids, the amounts, and any delivery address attached to an order — are kept after an account is closed for as long as tax, accounting, anti-fraud, and dispute-resolution obligations require. Stripe keeps its own copy of payment and payout records under its own retention schedule, and we cannot delete those on your behalf.
• Crash and error reports in Sentry age out on that service’s retention schedule.

See and correct your information

You can view and edit your display name, photo, neighborhood, and home ZIP code in the app or on the website at any time. Your email address is managed through the sign-in flow. To request a copy of the information we hold about you, or to correct something you cannot edit yourself, email support@localloopshop.com.

Location

Location permission is optional and can be revoked at any time in your device settings. Without it, you set your ZIP code by hand and the app works the same way.

Notifications

Turn push notifications off in your device settings, or email us and we will delete the device tokens we hold for you.

Rights under privacy laws

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, and to object to or restrict certain processing. We honor these requests from anyone who asks, regardless of where you live, and we will not treat you differently for exercising them. Email support@localloopshop.com to make a request. We may need to verify that you control the account before we act.

You can ask us to delete your Local Loop account and the data attached to it at any time, and you do not need to have the app installed to do it. Our account deletion page walks through how to submit a request, exactly what gets deleted, what we are required to keep, and how long it takes.

Traffic between your device and Local Loop is encrypted with TLS. Our database and file storage providers encrypt data at rest. Listing and profile images live in a private bucket that grants no public access and are reachable only through expiring signed links. Service credentials are held in Google Secret Manager rather than in code. API requests are rate-limited, and app traffic carries a device-integrity attestation so we can identify and block automated abuse. Passwords are never stored in plain text: our sign-in database holds only a cryptographic hash, and the marketplace application never receives your password. If you sign in with Apple or Google, we hold no password for you at all.

No system is perfectly secure, and we cannot guarantee that your information will never be accessed without authorization. If we become aware of a breach affecting your personal information, we will notify you as required by law.

Local Loop is not directed to children. Buying and selling on Local Loop requires a payment account and identity verification, which are only available to adults, and the service is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has created an account, email support@localloopshop.com and we will delete it.

We will update this policy when our practices change. The date at the top always reflects the current version. If a change materially affects how we handle your information, we will give you notice in the app or by email before it takes effect.

Questions about this policy, or about the information we hold about you? Email support@localloopshop.com and a person will answer.