Sign inJoin free

Last reviewed July 2026. These policies may be updated as Battarbox grows.

Privacy Policy

Last reviewed July 2026. These policies may be updated as Battarbox grows.

1. What we collect

  • Account data: email address and password hash (managed by Supabase Auth).
  • Profile data you publish: display name, handle, bio, interests, profile photo, an approximate location label you write yourself, and your local/online preference.
  • Precise location (optional): if you tap “Use my current location,” we store your coordinates privately to power distance filters. They are never shown to anyone — other members only ever see bucketed distances such as “1-5 mi.”
  • Activity: posts, photos, offers, messages, saves, follows, blocks, reports, and legal consents (with document versions).
  • Support payments: if you make a one-time or recurring platform support payment, Stripe processes your payment for OMS2. We store Stripe customer, recurring support, invoice, receipt, supporter contact, and support payment amount records needed for support, accounting, and acknowledgments — never card numbers.
  • Invites: if you invite a friend, we store the invitee email address, invite status, and timestamps so we can send and manage the invitation.
  • Advertising data: if ads are enabled, third-party vendors including Google may use cookies, web beacons, IP addresses, or similar technologies to serve, measure, personalize, and protect ads.

2. What we do with it

We use your data to run barter discovery (distance filters, search), messaging, safety features (blocks, reports, moderation), invites, platform support payments, and clearly labeled advertising placements when enabled. We do not sell personal data or use your content to train AI models.

3. Who can see what

  • Public: your profile (name, handle, bio, photo, interests, approximate location label, follower counts) and your active posts.
  • Participants only: offers, offer history, and messages are visible only to the two members in the thread, enforced by database row-level security.
  • Only you: precise coordinates, email, saved posts, block list, support payment history, and legal consents.
  • Moderators: reports and reported content, for review.

4. Processors

We rely on Supabase (database, authentication, storage), Stripe (payments), Resend (transactional email), and, when advertising is enabled, Google AdSense (ad serving and measurement). Each processes data under its own terms and safeguards.

5. Ads, cookies, and consent

Ads, when enabled, are labeled and may be served by Google AdSense. Google and its partners may use cookies or other local storage to serve ads, limit repeated ads, measure performance, detect invalid traffic, and personalize ads where allowed. Users in regions requiring consent, including the EEA, UK, and Switzerland, must be given legally required disclosures and choices before personalized ad processing.

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to Battarbox or other websites. Google's use of advertising cookies enables it and its partners to serve ads based on visits to Battarbox and/or other sites on the Internet. Users may opt out of personalized advertising through Google's Ads Settings. If third-party ad serving is enabled beyond Google, those vendors or ad networks may also place and read cookies or use web beacons, and they will be disclosed where required.

6. Retention and deletion

Deleting your account permanently removes your profile, posts, photos, offers, messages, saves, follows, and blocks through database cascades. Invite records, moderation records, and webhook records of payments may be retained as required for safety, abuse prevention, audit, and nonprofit accounting. Backups age out on the infrastructure provider's schedule.

7. Your rights

You can view and edit your profile in Settings, export your content by request, and delete your account yourself. Depending on your jurisdiction you may have additional rights (access, correction, portability, erasure); contact support@battarbox.com to exercise them.

8. Security

Every application table is protected by row-level security; precise coordinates are excluded from all client-readable queries; payment webhooks are signature-verified; sessions use industry-standard encrypted cookies. No system is perfectly secure — report vulnerabilities via SECURITY.md in the project repository.

9. Children

Battarbox is for adults 18+. We do not knowingly collect data from minors and delete such accounts.

10. Changes and contact

Material changes to this policy will be announced in-app and require renewed acceptance. Questions: contactsupport@battarbox.com.