Privacy Policy
Effective October 29, 2026 · Version 2026-10-29-v3
KeystoneXchange LLC (“KeystoneXchange,” “we,” “us”) runs keystonexchange.com, an online classifieds marketplace. This policy explains what we collect, how we use it, and the choices you have. It applies to everyone in the United States who uses our site.
The short version
- We do not sell your personal information.
- We do not share it for advertising, and we do not use advertising trackers. We use first-party usage analytics to understand and improve the marketplace.
- We collect what we need to run the marketplace and keep it safe, and we apply the retention periods described below.
What we collect
Information you give us
- Account details: your full legal name, email address, town, state, and ZIP code.
- Profile details: optional “about” text.
- Confirmations: that you are 18 or older, and that you accepted our Terms, Privacy Policy, and Community Guidelines, with the date and version.
- Listings: titles, descriptions, prices, condition, category, photos, location, and any required disclosures (for example, for vehicles, animals, or food).
- Messages: messages and photos you send to other members.
- Reviews: ratings and reviews you leave for other members.
- Reports, appeals, and contact requests: whatever you send us, including your name and email.
- Support and moderation records: official support conversations, seller-access requests, internal staff notes, decisions, and records of staff actions associated with your account or request.
- Signup choices: an optional answer about how you heard about us and whether you subscribe to news and feature announcements.
- Notification devices: browser push subscriptions or app device tokens, device labels, preferences, and delivery records when you enable push notifications.
- Saved items and preferences: saved listings, hidden listings, saved searches, and your email and push notification preferences.
- Launch list: if you signed up on our coming-soon page, your email address and the country your signup came from.
Information collected automatically
- Usage information: pages and features used, searches performed (without search words in activity events), listing views, activity times, and technical error categories. We use random browser and session identifiers and may associate activity with your account when you are signed in. Admin analytics summarize this information to help us understand usage and improve the service.
- Time zone: detected from your browser so notifications arrive at the right local time.
- Area: the ZIP code you choose for browsing, saved in a cookie.
- Server logs: our hosting provider records basic request data, such as the pages requested, for security and troubleshooting. We do not store your IP address in our own database.
Photo metadata
When you upload a photo, we remove location and embedded text metadata, including GPS data. We may retain orientation or image-format information needed to display it correctly.
Marketplace listing order
Listings are ordered by your chosen sort and filters. Closest-first results use your selected browsing area, or the default area shown in the browsing controls. You can change the location or choose another sort.
How we use your information
- To create and secure your account and sign you in with one-time codes sent by email.
- To show your listings, profile, and reviews to other members.
- To let members message each other.
- To show listings near you and calculate distances.
- To send the email and push notifications you choose.
- To review listings, administer expedited publishing for eligible sellers, handle reports and appeals, and enforce our rules.
- To measure use of the marketplace and improve its features.
- To prevent fraud, spam, and abuse.
- To suggest a category when you create a listing. Your listing title is processed by an AI model run by our hosting provider, Cloudflare.
- To answer your questions and requests.
- To comply with the law.
What other people can see
- Visitors who are not signed in see your first name and last initial (for example, “John S.”) and your active listings with their town and state. They cannot open member profiles.
- Signed-in members can also see your full name, initials, town and state, “about” text, member-since date, ratings and reviews, and sold count.
- Never shown to other members: your email, ZIP code, exact location, time zone, messages (except to the people in the conversation), saved items, reports, and appeals.
- Any precise pickup location you enter stays private.
Who we share information with
We share information only with service providers that help us run the site, and only for that purpose:
- Cloudflare: website hosting, marketplace records, photos, security, and AI category suggestions from listing titles.
- Logto: authentication and account sign-in.
- Resend: account and notification email delivery.
- Push notification services: browser and device providers, including Apple, Mozilla, and Google/Firebase as applicable, deliver notifications to devices you register.
- Zippopotam.us: ZIP-code lookups to resolve towns and approximate locations.
We may also share information:
- When required by law, such as a valid subpoena or court order.
- To protect the safety of our members or the public.
- If KeystoneXchange is merged or sold, in which case this policy continues to apply to your information.
We do not:
- Sell personal information.
- Share it for cross-context behavioral advertising.
- Use it for targeted advertising.
- Share it with third parties for their own direct marketing.
- Sign-in code emails are required to use your account.
- Marketplace notifications have their own email preferences. You can choose instant delivery, summaries, or turn supported notification topics off in settings or through their unsubscribe link.
- News and feature announcements require a separate subscription and have a separate unsubscribe link.
- Coming-soon launch announcements are sent to people who requested them and have their own unsubscribe link.
- Requested seller-access updates, staff invitations, support replies, and account security messages are handled separately from news subscriptions and marketplace notification preferences.
- We keep email delivery, failure, and complaint records to operate email reliably. We do not use email activity for advertising.
Cookies
We use cookies for sign-in, security, saved browsing area, and first-party usage analytics. Our analytics browser cookie lasts up to 30 days, and the session cookie lasts 30 minutes and is refreshed with activity. We do not use advertising cookies. Device storage also supports app installation and notification preferences.
Our sign-in page, run by Logto, sets its own cookies needed for sign-in.
Do Not Track and Global Privacy Control
We do not sell or share personal information or track you across other websites, so there is nothing for these signals to turn off. We honor Global Privacy Control as a valid opt-out request.
How long we keep information
- Accounts, profiles, listings, photos, preferences, and reviews: kept while needed to provide your account and marketplace history, until you remove supported content or request account deletion. Warnings stay in your account history; their separate audit entries follow the audit retention period below.
- Messages and shared chat photos: deleted after 60 days without a new message about that item. General messages without an item have their own inactivity timer. Reading messages does not restart it. Empty conversations are removed. Listings, accounts, reviews, and moderation reports are separate records.
- Marketplace email outbox and email webhook events: 90 days from creation. The separate launch announcement queue is described below.
- Usage analytics: detailed events and account activity days are eligible for deletion after 90 days; presence records after 30 days without activity; daily aggregate counts after 25 months. Recorded member listing views are eligible after 90 days.
- Official support conversations, internal staff notes, and staff action history: kept for support, account administration, and moderation. These records do not use the member-chat 60-day inactivity schedule. Account-linked support messages and notes are removed through account deletion, subject to the exceptions below.
- Contact requests: 2 years after closing.
- Reports and moderation appeals: 3 years after resolution. Open or reviewing records are not automatically deleted.
- Moderation audit entries: 3 years after closing or completing the action. Entries for open moderation work and active restrictions are retained while that work or restriction remains open.
- Read notifications, including saved-search and account notifications: 90 days after reading. Unread notifications are not automatically deleted by this schedule.
- Staff invitations: 30 days after use or expiry. For a used invitation, the period runs from use.
- Banned email addresses: retained while the ban is active; not automatically deleted, including when the associated account is deleted.
- Coming-soon subscribers and launch delivery records: the original signup list, copied launch subscriber records, unsubscribe status, and announcement delivery records are not automatically deleted by the general email cleanup. They remain until separately removed or a deletion request is handled.
These periods use lifecycle dates for closed, resolved, read, used, or expired records. Where a historical closing date was not recorded, the retention period starts when the new tracking is introduced. Scheduled deletion is permanent and runs in batches, so records are removed after becoming eligible. Provider backup retention is separate, and copies other people have downloaded or received cannot be recalled.
If you previously supplied a phone number or text-message consent while that feature was being prepared, historical records may remain even though text messaging is unavailable. We do not use those records to send texts now. Contact us to request access or deletion; limited suppression records may be retained to honor a request not to be contacted.
Your rights
Depending on your state, you may have the right to:
- Access the personal information we hold about you and get a copy.
- Correct inaccurate information.
- Delete your information and your account.
- Opt out of the sale or sharing of your information, or its use for targeted advertising. We don’t do any of these.
- Not be treated differently for using these rights.
To make a request, email contact@keystonexchange.com from the email address on your account.
- We may need to verify your identity before we act.
- We respond within 45 days and will tell you if we need more time, as the law allows.
- You may use an authorized agent, but we may ask for proof that the agent is authorized.
- If we deny your request, you can appeal by replying to our decision. If you disagree with the result of your appeal, you may contact your state attorney general.
When you delete your account, we remove your profile, listings, photos, messages, and reviews. We may keep limited records where the law requires it or where needed for safety, such as a record of a ban.
Children
KeystoneXchange is only for people 18 and older. We do not knowingly collect information from anyone under 18. If we learn we have, we will delete it.
Security
We protect your information with:
- Encrypted connections.
- Account authentication through our sign-in provider, including one-time codes sent by email.
- Strict access controls.
- Authorized staff may inspect member-to-member conversations to investigate reports, harassment, fraud, and other guideline violations. Official support conversations are available to authorized support staff to respond to you. Staff must record a reason, and every access is logged.
No system is perfectly secure, so please contact us right away if you suspect a problem.
Where we store information
We operate in the United States and use service providers that may store or process information in the United States and other countries. Provider infrastructure and delivery networks determine where particular processing occurs.
Changes
If we make material changes, we will post the new version here and ask signed-in members to accept the updated version before continuing to use their account. The effective date is shown above.
Contact
KeystoneXchange LLC