Privacy policy

• Account details: email address, username, password (stored only in scrambled form, so nobody can read it) and, if you turn it on, your two-step verification secret (stored encrypted).
• If you choose "Continue with Google": your Google account ID, name and verified email address. We never see your Google password.
• Profile and address: your bio, and the name, address and phone number you add for sending or receiving parcels.
• Listings: photos, descriptions and prices. Photos are re-saved in your browser before upload, which removes hidden location (GPS) data.
• Messages, reviews, reports and disputes between you, other users and us.
• Orders: what you bought or sold, amounts, delivery and tracking details.
• Payment and payout data is collected and held by Stripe, not by us. We receive only limited details, such as whether payouts are set up and payment status.
• Technical data: IP address, browser type, and records of logins and actions, used for security.

• To run your account, list items, process orders, payments, deliveries and Buyer Protection: performance of our contract with you.
• To keep Retaged safe: preventing fraud, spam and abuse, rate-limiting, investigating reports and disputes, and enforcing our terms: our legitimate interests.
• To send essential emails (such as confirming your email address, password resets and order updates): performance of our contract.
• To send offers, new arrivals and Retaged news by email, only if you ticked the box when signing up or turned it on in Settings: your consent. You can turn it off at any time in Settings, or with the unsubscribe link in any such email.
• To keep financial records and report to HMRC where required: legal obligation.
• To improve Retaged: our legitimate interests. We do not sell your data and we do not use advertising trackers.

• Other users: your username, profile, listings, reviews and messages you send them. When you sell, the buyer's delivery details appear on the shipping label you print.
• Stripe (payments and payouts), Shippo and delivery carriers such as Evri and DPD (labels and tracking), Hostinger (website hosting and storage), and Google (sending our emails, and "Continue with Google" sign-in). They act on our instructions or under their own privacy policies for the services they provide.
• HMRC, the police or other authorities where the law requires it, or to protect people from harm or fraud.
• A buyer of our business, if Retaged is ever sold, under this same policy.

Some of our providers (for example Stripe and Google) may process data outside the UK, including in the United States. Where this happens it is protected by safeguards recognised under UK law, such as the UK-US data bridge or the UK International Data Transfer Agreement.

• Account and profile data: while your account is open. If you close it, we delete or anonymise it within one month, except as below.
• Order, payment and tax records: 6 years after the end of the tax year they relate to, as required by UK law.
• Messages, reports and dispute evidence: up to 2 years after the last activity, or longer if needed for a legal claim.
• Security logs: up to 12 months.

We use encrypted connections (HTTPS), scrambled passwords, encrypted two-step verification secrets, secure login sessions, rate limits and access controls. No system is perfectly secure, so please use a strong, unique password and turn on two-step verification.

You can ask to access, correct or delete your data, to restrict or object to how we use it, or to receive a copy to take elsewhere. Email us at retaged2026@gmail.com and we'll reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk), but we'd appreciate the chance to help first.

We use one strictly necessary cookie to keep you logged in securely. We do not use advertising or tracking cookies, so we don't need to ask for cookie consent. If we ever add optional cookies, we will ask you first.

Retaged is only for people aged 18 or over. We do not knowingly collect data from children.

We may update this policy. We will post the new version here and tell you about important changes.