Privacy Policy

1. Information We Collect

Account information: When you create an account, we collect your name, email address, password (stored as a bcrypt hash), and optionally your phone number, location, and profile photo.

Listing information: When you create a listing, we collect the instrument details you provide, including title, description, pricing, condition, location coordinates, and photos.

Payment information: Payment processing is handled by Stripe. We do not store your credit card numbers. We store your Stripe account ID for payout processing.

Usage data: We collect information about how you use Instrumeet, including pages visited, searches performed, and listings viewed. We use PostHog for product analytics.

Device information: For our mobile app, we may collect your device type, operating system, and push notification token (Expo push token) if you enable notifications.

Location data: We use your location to show nearby instrument listings. Location is collected only when you search or browse, and is not continuously tracked.

2. How We Use Your Information

• To provide and maintain the Instrumeet marketplace
• To process rental transactions and payments
• To send you notifications about rental requests, messages, and reviews
• To show you relevant instrument listings based on your location and preferences
• To improve our platform through analytics and user feedback
• To prevent fraud and enforce our terms of service

3. Information Sharing

We do not sell your personal information. We share information only with:

• Other users: Your public profile, listing information, and messages are visible to other users as needed for transactions.
• Service providers: Stripe (payments), Resend (email), Amazon S3 (image storage), PostHog (analytics).
• Legal requirements: When required by law, court order, or to protect our rights.

4. Data Security

We use industry-standard security measures including encrypted connections (HTTPS), bcrypt password hashing, JWT token authentication, and rate limiting to protect your data.

5. Your Rights

Access and portability: You can access your data through your profile and listing pages.

Deletion: You can request account deletion by contacting us. We will delete your personal data within 30 days, except as required by law or for completed transaction records.

California residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of sale of personal information (we do not sell your data).

EU residents (GDPR): You have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data.

6. Cookies and Tracking

We use essential cookies for authentication (JWT tokens). We use PostHog for product analytics, which may set cookies for session tracking. You can disable non-essential cookies in your browser settings.

7. Children's Privacy

Instrumeet is not intended for users under 18 years of age. We do not knowingly collect personal information from children.

8. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date.

9. Contact Us

For privacy-related questions or requests, contact us at privacy@instrumeet.com.