Privacy policy

1. Introduction

This Privacy Policy describes how SiliconExchange collects, uses, shares, and protects information about you when you visit siliconexchange.io or use our marketplace services (collectively, the “Service”). It is incorporated by reference into our Terms of Service. The Service is offered in the United States only, and this Policy is written for United States residents. This Policy does not cover third-party websites or services we link to, or the independent conduct of other users outside the Service. If you do not agree with this Policy, please do not use the Service.

We are a marketplace: independent sellers list PC hardware for sale to buyers, we process payments through our payment partner, and we arrange shipping. Understanding that flow is the easiest way to understand this Policy — most of the information we collect exists to make a sale, a shipment, or a payout happen.

2. Information We Collect

2.1 Information you provide

• Account information. When you register we collect your email address and name, and — if you sign up with a password — a securely hashed version of that password (we never store the password itself). If you sign in with Google, Google provides us your name, email address, and profile picture.
• Seller profile information. Sellers may provide a display bio and location, and — to purchase shipping labels — a ship-from address and phone number. Street-level ship-from detail is shared only with our shipping providers and carriers; it is never displayed publicly. Your public seller page may show the state you ship from.
• Seller identity and payout verification. Payout accounts are opened with our payment partner, Stripe. Stripe — not SiliconExchange — collects your legal name, date of birth, address, Social Security number, and bank account details, under Stripe’s own privacy policy. We store only your Stripe account identifier and its verification status. We never receive or store your Social Security number, government ID, or bank account number.
• Listings and other content. Listing titles, descriptions, specifications, photographs, optional YouTube video links, prices, reviews you write, and messages you exchange with other users through the Service.
• Order and shipping information. When you buy, we collect the shipping address you enter (name, street address, city, state, ZIP code) and a record of your order. You can optionally save a default shipping address to your account for faster checkout.
• Dispute records. If you open or respond to a dispute, we collect the description and any evidence you submit (such as photographs).
• Order condition documentation. Sellers may upload photos and videos documenting an item's condition after it sells and before it ships — for example, a photo of a serial-number sticker or the circuit board, or a video of the item running a benchmark test. For a graphics card sold for more than $1,000, a serial-number photo and a board photo are required before it ships. If an item is returned, the seller may also upload photos and videos of the item that came back. These files are never public. They are visible to that order's buyer and to our staff and are used to resolve disputes; where an order is disputed with a card issuer, the photos taken before the item shipped may be submitted as evidence to our payment partner and through it to the banks and card networks handling the dispute. They are deleted on the schedule in Section 8.
• Function check records. If a seller runs our optional function check for a listing, we collect the test report their computer produced (which can include the device's name, memory size and driver version and, for a Mac, its serial number and its Activation Lock and device-management status), a photo of the item's serial number beside the one-time code we issued, and, for a Mac, a short video of it starting up. These files and the full report are never public: they are visible to the seller and to our staff. The listing shows only a summary (the device, its memory, the tests it passed and the date). They are deleted on the schedule in Section 8.
• Order listing snapshots. When you buy, we store an immutable copy of the listing as it appeared at purchase — its text, condition, terms, and photographs — with the order record, so disputes can be judged against what you actually saw. The snapshot is part of the transaction record and is retained on the transaction schedule in Section 8 (generally at least seven years), even if the live listing is later edited or removed.
• Agreement records. When you accept our Terms of Service — at registration, at checkout, or when we publish a revised version — we record the document version you accepted along with the date, your IP address, and your browser’s user-agent string. We keep these records as evidence of the agreement.
• Support correspondence. If you contact support@siliconexchange.io, we receive whatever you include in your message.

2.2 Information collected automatically

• IP address and request data. Like nearly every website, our servers receive your IP address and basic request information with each page you load. We use IP addresses for security rate-limiting (held briefly), for counting listing views without double-counting (held for about one hour per view), and in the agreement records described above.
• Failed sign-in counts. To slow down password-guessing attacks, we keep a count of recent failed sign-in attempts for each email address that someone tries to sign in with. We store this against a one-way cryptographic hash of the address rather than the address itself, so the record cannot be read back as an email address or used to contact anyone. The count is deleted as soon as a sign-in succeeds or the password is reset, and in any case within about a day of the last attempt. It is kept whether or not the address belongs to a registered account — an attempt on an address we have never seen is counted the same way, so the record does not reveal who has an account with us.
• Device and usage information. Browser type, operating system, pages viewed, and similar technical information, collected through cookies and our analytics service as described in Section 6.
• How you found us. If you arrive through a link that carries a campaign tag — for example, from one of our ads or from a creator who mentions us — we keep that tag (the link’s source, medium, campaign, content and referral-code labels), the page you landed on (without the rest of its address) and the date and time, in a first-party cookie for 30 days. If you create an account in that time, we store them with your account so we can tell which ads and partners bring people who go on to sell, and the cookie is removed once you are signed in. The record we keep with your account stays on our own systems: we never send it to an advertising platform or share it for anyone else’s purposes. (The addresses of the pages you view, campaign tags included, also reach Google Analytics as described in Section 6.2.) None of this is collected when analytics is off for you (Section 6).
• Error and diagnostic data. We use Sentry, our error-monitoring provider, to detect errors and performance problems on our behalf. When an error occurs — and for a small random sample of sessions — Sentry captures a technical replay of the page interaction so we can reproduce the bug. Replays are masked in your browser before anything is transmitted: all text is replaced with placeholders and images and media are blocked, so the content of what you typed or viewed is not captured. Replay data is used only for debugging — never for advertising or analytics profiling (Section 6).
• Marketplace activity events. We record marketplace activity on our own systems — which listings are viewed or saved, what searches are run and how many results they return, and when listings are published at what asking price. These records describe the content, not you: they are not linked to your account, and contain no name, account identifier, or IP address. We use them to understand marketplace demand and to build the aggregated statistics described in Section 5.

2.3 Information from third parties

• Stripe sends us the verification status of seller payout accounts and payment outcomes (for example, that a payment succeeded, failed, or was disputed with the card issuer).
• Shippo and shipping carriers (such as USPS, UPS, and FedEx) send us tracking events for shipments, which we use to update order status.
• Google provides your basic profile information if you choose Google sign-in.

3. How We Use Information

We use the information described above to:

• Operate the marketplace: host listings, process orders, arrange shipping labels, and administer payouts;
• Run the Buyer Protection Program: hold payments while orders are in progress, review disputes, and process refunds;
• Prevent fraud and abuse: rate-limit suspicious traffic, detect payment fraud, respond to card-network chargebacks, and enforce our Terms of Service;
• Verify addresses: when you enter a shipping address, we check it for deliverability (see Section 4.2);
• Communicate with you: send transactional emails (email-address confirmation, order confirmations, shipping updates, dispute notices, password resets); saved-search and followed-seller alert emails, only if you create them; and alert emails about listings you save (a price drop, a sale, or the listing ending or coming back on sale), which you can turn off for one listing or for all of them — all controlled from your dashboard;
• Provide support and resolve problems;
• Understand and improve the Service through analytics (Section 6);
• Measure which of our own ads and partners bring new sellers, using the campaign tag described in Section 2.2 — never to target you with advertising;
• Comply with legal obligations, including tax, accounting, and — where thresholds are met — the federal INFORM Consumers Act, which requires marketplaces to collect and, in some cases, disclose identity information about high-volume sellers.

We do not use your personal information for targeted advertising, and we do not run third-party advertising on the Service.

4. How We Share Information

4.1 With other users

The Service is a marketplace, so some sharing between users is inherent:

• Your display name and seller profile (bio, ratings, reviews, general location, listings) are visible to other users and may appear in search-engine results.
• When someone buys your listing, you (the seller) receive the buyer’s name and shipping address so you can ship the item — it also appears on the shipping label.
• Buyers see the seller’s display name and the city/state a shipment comes from via carrier tracking.
• Messages you send through the Service are visible to the person you send them to.
• Reviews you write are public and attributed to your display name.
• Following a seller is private to you: sellers are not shown the identity of the users who follow them.

New listings are also announced automatically in our public Discord community — the announcement contains only public listing content (title, price, condition, category, photo, and the seller’s display name). Once posted, the announcement lives on Discord, where Discord’s own privacy policy governs it, and it may persist in the channel after the listing is edited or removed.

If you are a seller and your sales on the Service reach the levels set by the federal INFORM Consumers Act, we are required to display identifying information about you — which may include your full name, business address, and contact information — to buyers on your listings or in their order confirmations. We will tell you before this information is first displayed.

If you receive another user’s personal information through a transaction — for example, a buyer’s name and shipping address — you may use it only to complete that transaction and for no other purpose. Adding a counterparty to a marketing list, contacting them off-platform for unrelated purposes, or disclosing their information violates our Terms of Service.

4.2 With service providers

We share information with companies that perform services on our behalf, limited to what each needs to do its job:

• Stripe (payments) processes every payment and payout, and receives order amounts, your email address, and — for sales-tax calculation through Stripe Tax — the order’s shipping address (or, for local pickup, the seller’s location) and each item’s tax category. Payments made with Apple Pay or Google Pay run on the same card rails through Stripe; your wallet provider’s own privacy policy applies to the wallet itself. We never see or store card numbers. Separately from the services Stripe performs for us, checkout offers Stripe Link — Stripe’s own saved-payment-method product. If you choose to use Link, Stripe provides that feature as its own business under Stripe’s privacy policy, and the service-provider limitation described below does not apply to it.
• Shippo (shipping) and the carriers it connects (USPS, UPS, FedEx) receive buyer and seller names, addresses, email addresses, and phone numbers as needed to quote rates, purchase labels, and track shipments. When a seller elects shipment protection, shipment details are also shared with the insurance provider (XCover) to create the policy.
• Google Address Validation checks shipping and ship-from addresses you enter for deliverability. We cache the normalized result for up to 60 days under a one-way hashed key so repeated checks of the same address don’t require a new lookup.
• Google Analytics — see Section 6.
• Anthropic (listing assistance) processes the content you choose to submit to the sell page’s listing assistant — the text or listing link you paste into the import box, the photos you choose to start a listing from (sent as copies, reduced in size where needed, with their location and other metadata removed) together with any note you add to them, and, if you use the assistant to revise a draft, your instruction together with that draft’s current text and details — and only that content, to draft or revise your listing for review. Nothing is sent unless you use these features, and Anthropic does not use these inputs to train its AI models.
• Resend (email delivery) sends our transactional and alert emails.
• Infrastructure providers: our application runs on Vercel (hosting and page-performance measurement — see Section 6), Neon (database), Cloudflare R2 (image and media storage), Upstash (caching and rate limiting), Meilisearch (search indexing), and Sentry (error monitoring). Each stores or processes data as part of running the Service.

These providers are bound by their own contractual and legal obligations and are not permitted to use your personal information for their own advertising.

4.3 For legal reasons and business transfers

We may disclose information when we believe in good faith it is required by law — for example, in response to a subpoena, to comply with the INFORM Consumers Act, to report or prevent fraud, or to protect the rights and safety of our users. If SiliconExchange is involved in a merger, acquisition, or sale of assets, user information may be transferred as part of that transaction; the commitments in this Policy will continue to apply to it.

4.4 What we do not do

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have never sold personal information. We do not share your personal information with third parties for their own marketing, and we do not use or disclose sensitive personal information for purposes that would require a right to limit under California law.

5. Aggregated and De-identified Data

We may create and use aggregated or de-identified data — such as market pricing trends, category statistics, and sales-volume indices — that does not identify you and cannot reasonably be linked to you, your household, or your device. We may sell or share aggregated or de-identified data with third parties, including as part of market-research and analytics products. We maintain and use de-identified data only in de-identified form; we take reasonable technical and organizational measures to prevent re-identification; we commit that we will not attempt to re-identify de-identified data; and we contractually require anyone who receives de-identified data from us to commit to the same. Because it does not identify anyone, aggregated and de-identified data may be retained and used even after the personal information it was derived from is deleted. Aggregated and de-identified data is not personal information, and nothing in this section involves the sale of personal information.

6. Cookies, Analytics, and Similar Technologies

6.1 Cookies we use

• Authentication cookies keep you signed in (session cookies set by our sign-in system).
• se-cookie-consent remembers your analytics choice from the cookie banner for 12 months.
• se-terms-preaccept briefly (15 minutes) carries your Terms-of-Service agreement across the Google sign-in redirect at registration.
• Stripe cookies (such as __stripe_mid) are set during checkout by Stripe for payment processing and fraud prevention.
• Google Analytics cookies (_ga and similar) are set only if analytics is enabled for you (see below).
• se-attribution keeps the campaign tag of the link that first brought you here, for 30 days or until you sign in (Section 2.2). It is set only when analytics is enabled for you, and opting out deletes it.
• While the Service is in pre-launch preview, an access cookie records that you entered the preview password.

We also use your browser’s local storage for device-only conveniences — an in-progress listing draft on the sell page, and (for signed-out visitors) a marker of which listings are new since your last visit. Local-storage data stays on your device; it is not transmitted to us.

6.2 Analytics and your opt-out

We use Google Analytics (GA4) to understand how the Service is used — in an analytics-only configuration. Google’s advertising features are permanently disabled: we set Consent Mode so that ad storage, ad user data, and ad personalization are always denied. Analytics is on by default for new visitors, and you can opt out at any time:

• Choose “Opt out of analytics” in the cookie banner, or
• Use the “Cookie Preferences” link in the footer at any time. Opting out disables the analytics script and deletes the Google Analytics cookies and the se-attribution cookie from your browser.

We also measure how quickly pages load, using Vercel Speed Insights. It reports standard Core Web Vitals timings — such as how long the largest element takes to appear and how much the layout shifts — together with the page URL, your device type, and your connection type. It sets no cookies and stores nothing on your device, and it collects no advertising signal. It runs only when analytics is enabled for you, and the same opt-out above turns it off.

Both tools receive the address of the page you are viewing, and some of our addresses briefly carry a one-time credential — the token in a password-reset or email-confirmation link, and the payment identifiers Stripe adds when it returns you to our order-confirmation page. We remove those values from the address before it is sent to either tool, and we also remove them from your browser’s address bar once the page has used them, so they are not carried into your browsing history or onward links. Speed Insights receives the page address with its whole query string removed. Ordinary parameters — the category you are browsing, or a campaign tag from a link you followed — are still included, because measuring those is the purpose of the analytics.

6.3 Global Privacy Control and Do Not Track

Some browsers and extensions transmit an opt-out preference signal called Global Privacy Control (GPC). We honor GPC automatically and frictionlessly: when we detect the signal, analytics is disabled for your browser with no further action needed from you (you may later enable analytics explicitly through the banner if you wish). You can learn more at globalprivacycontrol.org. We do not respond to the older “Do Not Track” browser setting, which never reached a settled standard; GPC is the signal we honor.

6.4 Third-party content you choose to load

Listing pages may include a seller-provided product video hosted on YouTube. We embed these in click-to-load, privacy-enhanced mode (youtube-nocookie.com): no request is made to YouTube — and no YouTube cookies are set — unless you click play. Once you play a video, YouTube’s own privacy policy applies to that playback.

Other than the services described in this Policy, we do not permit third parties to collect personal information about your activity over time and across different websites through our Service. The error-replay diagnostics described in Section 2.2 are used only for debugging: no replay data is used for advertising or for analytics profiling.

7. Your Choices and Rights

• Access and update. You can review and update your account and profile information from your dashboard. Anything you cannot change there, we will change for you — email support@siliconexchange.io.
• Deletion. You may request deletion of your account and personal information by emailing support@siliconexchange.io. We will verify the request and delete your information, except records we need to keep — completed-transaction, payout, tax, dispute, chargeback, and agreement records are retained as described in Section 8 even after account deletion, as permitted by law.
• Correction and portability. You may ask us to correct inaccurate personal information or to provide a copy of the personal information you have given us, at the same address.
• Email. Transactional emails (email-address confirmation, order confirmations, shipping and dispute notices, security notices) are part of operating the Service and can’t be opted out of while you have an account. Saved-search and followed-seller alert emails exist only if you create an alert or follow a seller, and you can pause or delete either in your dashboard. Saving a listing turns on alert emails about that listing; you can turn them off for one listing on your Saved Listings page, or for every saved listing in Settings. If you create an account before our public launch, we will send you a single launch-announcement email when the marketplace opens — the signup page says so at the time you register, and it is the only pre-launch email we send. Beyond that, we do not send marketing email.
• Analytics. Opt out any time via the cookie banner, the footer’s Cookie Preferences link, or a GPC-enabled browser (Section 6).

We extend these choices to all users, regardless of the state you live in. If you make a privacy request, we will confirm receipt, verify that the request is genuinely yours (typically by confirming control of your account email), and respond within 45 days; where a request is unusually complex, the law allows one additional 45-day extension, and if we need it we will tell you within the first 45 days and explain why. You may also submit a request through an authorized agent acting on your behalf: we will ask the agent for proof of their authority (such as your signed permission or a power of attorney) and will still verify your identity directly before acting. We will never discriminate against you — in price, service, or availability — for exercising a privacy right. If we decline a request, we will explain why, and you may appeal by replying to our response; state residents may also contact their state Attorney General.

In the category language used by state privacy laws, the personal information we collect consists of: identifiers (name, email address, postal addresses, IP address); commercial information (listings, orders, transaction history); internet or network activity (pages viewed, device and browser information, the campaign tag of the link that first brought you here, the diagnostics in Section 2.2); audio-visual information (photographs and videos you choose to upload); and communications (messages, reviews, support requests). We do not collect biometric information, precise geolocation, or — on our own systems — government identifiers or financial-account numbers (seller verification data of that kind is collected and held by Stripe, as described in Section 2.1). These categories are collected from you and your devices, used for the purposes in Section 3, and disclosed only to the recipients in Section 4.

8. Data Retention

We keep personal information only as long as it serves the purposes above:

• Account, profile, and listing data: for the life of your account, and deleted on verified request (Section 7).
• Sign-up campaign tag (Section 2.2): for the life of your account, and deleted with it.
• Order, payout, dispute, chargeback, and order listing snapshot records: retained after account deletion for tax, accounting, fraud-prevention, and legal-compliance purposes — generally at least seven years for transaction records.
• Terms-of-Service agreement records: retained as long as needed to evidence the agreement.
• Messages and reviews: retained while the accounts involved remain active; reviews may persist in anonymized form after deletion.
• Order condition documentation: deleted automatically about 180 days after the order completes, is refunded, or is cancelled — long enough to cover the payment networks' chargeback window, no longer.
• Function check records: the photo, any video and the full report are deleted automatically about 180 days after the check stops being needed: the listing stopped being for sale (or went back to a draft) and its orders have closed, or the check was never added to a listing, was replaced or removed, or its listing was deleted, and no open order still shows it. The summary shown on the listing is kept with the listing.
• Address-validation cache: up to 60 days.
• View-counting IP keys: about one hour. Rate-limiting counters: minutes. Failed sign-in counts (Section 2.2): deleted within about a day of the last attempt, and sooner if the sign-in succeeds or the password is reset.
• Error diagnostics (Sentry): retained on a rolling short-term basis, typically 90 days.
• Cookie lifetimes: as stated in Section 6 (consent choice 12 months; campaign tag 30 days or until you sign in; session cookies expire on sign-out or after about 30 days).

The retention periods in this Section describe how long we keep information on our own systems. Where a document or image has been submitted to our payment partner, a bank, or a card network as evidence in a payment dispute, that copy is held under the receiving organization’s own retention rules and is no longer within our control to delete.

9. Security

We protect your information with industry-standard measures: all traffic is encrypted in transit (HTTPS), passwords are stored only as salted hashes, payment credentials never touch our servers, access to production data is limited, and administrative actions on our side are recorded in an audit log. No method of transmission or storage is completely secure, and we cannot guarantee absolute security — but we design so that the most sensitive data (card numbers, Social Security numbers, bank details) is held by our specialized payment partner rather than by us.

10. Children

The Service is for adults: you must be 18 or older to create an account. We do not knowingly collect personal information from anyone under 18, and the Service is not directed to children. If we learn that we have collected personal information from anyone under 18, we will delete it promptly — for children under 13, that is also our obligation under federal law. If you believe a minor has provided us personal information, contact support@siliconexchange.io.

11. United States Only

The Service is offered in the United States, and your information is processed and stored in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.

12. Changes to This Policy

We may update this Policy from time to time. When we do, we will post the updated Policy here with a new “last updated” date, and for material changes we will provide additional notice (such as an email or a prominent site notice) before the changes take effect. If we ever want to use personal information we have already collected for a materially different purpose than the one we described when we collected it, we will ask for your consent first. Each version’s effective date appears at the top of the Policy.

13. Contact Us

Privacy questions and requests: support@siliconexchange.io

SiliconExchange is operated by 3S Legacy Holdings, LLC, a Delaware limited liability company, doing business as SiliconExchange.