Privacy Policy

Effective September 16, 2026

This policy explains how FlyGearExchange handles information when you browse the marketplace, create an account, list equipment, communicate with members, or contact support. Contact the service operator at help@flygearexchange.com with privacy questions.

Information we collect

• Account information: email address, display name, optional location, authentication records, and marketplace rule acceptance. Passwords are handled by our authentication provider.
• Marketplace activity: listings, uploaded photos, equipment details and disclosures, saved items, messages, reviews, reports, support requests, and moderation decisions.
• Order information: buyer and seller references, a snapshot of the listing at checkout, amounts, payment status and provider references, shipping details, tracking, refunds, and disputes when checkout is enabled.
• Technical information: cookies needed for sign-in and demo sessions, browser session preferences, request metadata, and hosting/security logs. Authentication rate limits use hashed identifiers derived from email addresses and IP addresses.

How we use information

We use information to provide accounts and marketplace features, process orders when available, deliver service messages, prevent abuse, review reports, resolve support requests, maintain security, and meet applicable legal obligations. We do not use private conversations to create public listings or reviews.

What other members can see

Your display name, public location, published listing details and photos, relevant verification status, and eligible transaction reviews can be visible to other users. Saved items are private. Messages are shown to conversation participants. Order and delivery information is available to the relevant buyer and seller and authorized support staff. Do not include home addresses, identity documents, bank details, or full sensitive identifiers in public listings.

Service providers and disclosures

We use Vercel for hosting and Supabase for authentication, database storage, and uploaded files. Cloudflare Turnstile evaluates browser and network signals to detect automated abuse during signup and password recovery. We validate the result on our server. Cloudflare also provides domain services and forwards support emails to our operator’s mailbox hosted by Namecheap Private Email. Resend is the configured integration for account emails when email delivery is enabled. These providers process information needed to operate their services.

When enabled, Stripe handles payment details, seller onboarding, and optional identity checks. We store payment and verification references and statuses, rather than full payment card numbers or copies of identity documents and selfies. Stripe may collect and retain information directly under its Privacy Policy. Test integrations do not establish real identity verification. If automated carrier tracking is enabled, tracking details are shared with the tracking provider to retrieve shipment status.

We may disclose relevant information to comply with applicable law or valid legal process, investigate fraud, protect people and the service, or complete a business transfer subject to appropriate privacy protections. We do not currently sell personal information or use advertising trackers for cross-site targeted advertising.

Cookies and browser storage

Essential cookies keep you signed in, support password recovery, and isolate demo workspaces. Browser session storage remembers the selected demo role. Blocking or clearing these can sign you out or reset your demo. The app does not currently install optional advertising or analytics cookies. External services you visit, including Stripe, apply their own cookie policies.

Retention and security

We retain account and marketplace records while needed to provide the service, resolve disputes, prevent abuse, and satisfy applicable recordkeeping requirements. Some transaction, fraud-prevention, and legal records may need to remain after an account closes. Demo workspaces expire after seven days and are scheduled for cleanup after an additional 24-hour grace period; failed cleanup may delay deletion. Provider backups and logs follow their own retention cycles.

We use access controls and protected storage, but no service can guarantee absolute security. Report suspected unauthorized access to support. Do not send passwords, login codes, card numbers, or identity documents by email or marketplace message.

Your choices and privacy requests

You can edit profile details in Account and manage your listings. To request access, correction, deletion, or account closure, email help@flygearexchange.com from your account address. We may verify your control of the account before acting. Requests are reviewed manually; deletion is subject to legitimate transaction, security, and legal retention needs. Depending on your location, additional privacy rights may apply, including a right to complain to your local privacy regulator.

Age and international processing

The service is intended for adults aged 18 or older. If you believe a child has provided personal information, contact us. Our providers may process information in the United States and other locations where they operate, which may have different data-protection rules.

Changes and contact

We will update the effective date when this policy changes and provide additional notice of material changes when required. For questions or requests, use Help & support.