Skip to main content

Privacy Policy

Last updated: June 20, 2026

1. Introduction

Hobbsy LLC (“Company”, “we”, “us”, or “our”) operates the Hobbsy marketplace platform (the “Service”). This Privacy Policy (“Policy”) explains how we collect, use, disclose, and safeguard your information when you visit our website and use our Service. Please read this Policy carefully. By using the Service, you consent to the data practices described in this Policy.

2. Information We Collect

2.1 Information You Provide

You do not have to give us personally identifiable information in order to visit our site. However, in order to use some of our Services, you may be required to register with our site. At the time you register we may collect and store the following information:

  • Account information: name, email address, mailing address, password (stored as a bcrypt hash — we never store plaintext passwords)
  • Profile information: avatar image, display name
  • Seller information: shop name, description, location, return and shipping policies
  • Transaction information: shipping address, order history, payment method details (processed and stored by Stripe — we do not store card numbers)
  • Communications: messages sent through the site, reviews, support requests
  • Content: listing descriptions, images, and other content you upload

2.2 Information Collected Automatically

  • Device information: browser type, operating system, device identifiers
  • Usage data: pages viewed, search queries, listings viewed, time spent on pages
  • Log data: IP address, access times, referring URLs
  • Cookies and similar technologies: see Section 7 (Cookie Policy) below

2.3 Information from Third Parties

  • Authentication providers: if you sign in with Google, we receive your name and email address from your Google account
  • Payment processor: Stripe provides us with transaction confirmation details (but not full card numbers)
  • Forwarded sales-channel communications: If you forward order- or sale-confirmation emails from external sales channels (for example, Mercari, Poshmark, Etsy, or Shopify), or connect such channels, we receive and process the information contained in those communications. This may include personal information of your customers on those channels, such as names, shipping addresses, and order details. We collect and use this information solely to synchronize inventory and stock counts across your sales channels through the Inventory Hub. By forwarding or connecting such communications, you represent and warrant that you are authorized to provide this information to us (see Section 3.10 of the Maker Agreement).

3. How We Use Your Information

We use the information we collect to:

  • Create and manage your account
  • Process transactions and send related information (confirmations, invoices, shipping updates)
  • Provide, maintain, and improve the Service
  • Personalize your experience (search results, recommendations)
  • Communicate with you about products, services, and updates
  • Monitor and analyze usage and trends to improve the Service
  • Detect, investigate, and prevent fraudulent transactions and other illegal activities
  • Comply with legal obligations
  • Synchronize inventory and stock counts across connected or forwarded sales channels.

4. How We Share Your Information

We may share your information in the following circumstances:

  • Between Buyers and Sellers: to facilitate transactions (e.g., shipping name and address shared with the Seller to fulfill an order) and to keep stock counts of inventory in our inventory hub. See Section 2.3 regarding forwarded sales-channel communications.
  • Service providers (subprocessors): with third-party vendors who perform services on our behalf, including Stripe (payment processing), Resend (transactional email delivery), Anthropic (AI-assisted features), Cloudflare (image storage and content delivery), Railway (cloud hosting and database infrastructure), Axiom (application logging), and Sentry (error monitoring). These providers may only process your information to perform services for us, and are bound by confidentiality and data-protection obligations. To protect your privacy, our AI-assisted features are restricted to accessing listing content and photos only. They are never given access to names, addresses, payment data, or other sensitive information.
  • Legal requirements: when required by law, regulation, or legal process
  • Business transfers: in connection with a merger, acquisition, or sale of assets
  • Investigation: Investigate, prevent or take action regarding violations of our Policy, suspected fraud or illegal activities
  • Affiliates: with our affiliates, including subsidiaries, joint venture partners or companies under common control
  • With your consent: when you have given us explicit permission

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide Services. We will retain and use your information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

When you delete your account, we will delete or anonymize your personal data within 30 days, except: (a) where a longer retention period is required by law (for example, transaction and tax records); and (b) records reasonably necessary to establish, exercise, or defend legal claims, which we will retain no longer than three (3) years. Information received from forwarded sales-channel communications is retained only as long as needed to maintain accurate inventory counts, and is deleted within 30 days after the related listing is removed or your account is deleted.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

  • Encryption of data in transit (TLS/HTTPS)
  • Passwords stored using bcrypt hashing with a cost factor of 12
  • Payment card data processed exclusively by PCI-DSS compliant Stripe — never touches our servers
  • Session tokens stored in HttpOnly, Secure, SameSite cookies
  • Rate limiting on authentication endpoints to prevent brute-force attacks
  • Regular security testing of our site

7. Cookies

We use a small number of strictly first-party cookies that are necessary to operate the Service and to remember your preferences. We use only essential and functional cookies — the ones listed below.

We do not use cookies for analytics, advertising, or cross-site tracking, and we do not use web beacons, pixel tags, clear GIFs, or similar tracking technologies. We do not sell your personal information, and we do not share cookie data with, or sync cookies to, third-party advertisers or data brokers.

  • Authentication: a session cookie that keeps you signed in to your account.
  • Cart: a cookie that remembers the items in your cart before you check out.
  • Preferences: a cookie that remembers your language and display settings.

Because these cookies are essential to core functionality, disabling them in your browser may prevent you from signing in, using your cart, or saving your preferences. We do not set any non-essential cookies, so there is nothing further to opt out of.

8. Your Rights (EU/EEA — GDPR)

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

  • Right of access: request a copy of the personal data we hold about you
  • Right to rectification: request correction of inaccurate or incomplete data
  • Right to erasure: request deletion of your personal data (“right to be forgotten”)
  • Right to restrict processing: request that we limit how we use your data
  • Right to data portability: receive your data in a structured, machine-readable format
  • Right to object: object to processing based on legitimate interests or for direct marketing
  • Right to withdraw consent: withdraw consent at any time where processing is based on consent

9. Your Rights (California — CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information:

  • The right to know what personal information we collect, use, and disclose
  • The right to request deletion of your personal information
  • The right to opt out of the sale of personal information (we do not sell personal information)
  • The right to require that we correct any inaccurate personal information we may have
  • The right to non-discrimination for exercising your rights
  • The right to limit the use and disclosure of sensitive personal information collected about you

10. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you are resident. These countries may have data protection laws that are different from the laws of your country. We take appropriate safeguards to ensure that your personal data remains protected in accordance with this Privacy Policy.

11. Children’s Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information. If you think that your child has provided us with personally identifying information, the parent or guardian should contact us at legal@hobbsy.shop to remove the information.

12. United States Privacy Laws

Some U.S. states have privacy laws providing privacy rights to their residents. These laws include the; Texas Data Privacy Security Act, California Consumer Privacy Act, Colorado Privacy Act, Connecticut Data Privacy Act, Delaware Personal Data Privacy Act, Iowa Consumer Data Protection Act, Minnesota Consumer Data Privacy Act, Montana Consumer Data Privacy Act, Nebraska Data Privacy Act, New Hampshire Privacy Act, New Jersey Data Protection Act, Oregon Consumer Privacy Act, Tennessee Information Protection Act, Utah Consumer Privacy Act, and Virginia Consumer Data Protection Act. However, these rights are available to all users located in the U.S.

The rights you may exercise with respect to your personally identifiable information include those listed below. In order to opt out or request access as set forth below, please send notice to legal@hobbsy.shop.

13. International Information Transfer

We may transfer, store, and process your information in countries other than the United States or your own. Our main servers and data centers are located in the United States. Please be aware if you access our API endpoints in data centers outside the United States, your information may be transferred to, stored, and processed by us in our facilities outside the United States and by those third parties with whom we may share your personal information in other countries.

If you are a resident in the European Economic Area, then these countries may not have data protection or other laws as comprehensive as those in your country. We will however take all necessary measures to protect your personal information in accordance with this privacy policy and applicable law.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Last updated” date. We encourage you to review this page periodically.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: legal@hobbsy.shop

16. Disputes

This Privacy Policy shall be governed by and construed in accordance with the laws of the State of Maryland notwithstanding any conflict of laws provisions. You irrevocably and unconditionally consent to submit to the exclusive jurisdiction of the federal courts of Maryland and the state courts located in Howard County, Maryland for any litigation or dispute arising out of or relating to this Privacy Policy. You also agree: (i) not to commence any litigation arising out of or relating to this Agreement except in the Maryland Courts, (ii) not to plead or claim that such litigation brought therein has been brought in an inconvenient forum, and (iii) agree that the Maryland Courts represent the exclusive jurisdiction for all disputes relating to this Agreement. If you file any action against us and/or our agents, or we file any action against you, and you do not prevail in any such action, you agree to pay the reasonable attorneys' fees and other costs and expenses, including any expert witness fees, incurred by us. You also agree to reimburse us for any fees and expenses, including reasonable attorney’s fees and expert witness fees incurred by us due to your breach of any provision contained herein.

Notwithstanding, if you are located, or your use of the Site is, or the violating act occurs, outside of the United States of America, we may elect to proceed by arbitration in our sole and absolute discretion. Upon such election by us, arbitration shall be conducted in Columbia, Maryland by the rules of the American Arbitration Association (the "AAA") or the International Centre for Dispute Resolution ('ICDR'), by a single arbitrator knowledgeable in our industry, and in accordance with the rules thereof then pertaining. This section shall not, in the event arbitration is chosen, prevent us from instituting litigation, in order to obtain standing, and seeking injunctive relief from any United States state or federal court under any law or ordinance or from any other tribunal which may have jurisdiction over the parties.

If you have any concerns about your privacy in connection with this Privacy Policy, please send us a thorough description of your concerns to legal@hobbsy.shop and we will try to resolve it.

AI and Automated Processing

Hobbsy's AI features help with listing copy, pricing, and translation — they only ever see the product details and photos of the item being listed. Your name, address, contact details, order history, and payment information are never sent to or processed by an AI model.

Hobbsy does not use personal data for automated decision-making or profiling. AI-assisted features (listing drafts, description optimization, pricing suggestions, translation) operate solely on product and listing content — an item's photos, title, description, category, tags, and materials — and do not take personal data as input.