Privacy Policy

Thriftr ("Thriftr", "we", "us") is a peer-to-peer thrifting marketplace operated by Blinc, a sole proprietorship registered in Jaipur, Rajasthan, India. This policy explains what data we collect from you, how we use it, who we share it with, and your rights over it.

• Account data — your name, email address, and phone number. You sign in with Google, Apple, or a passwordless email code/magic link; with Google/Apple we receive your email and name from them, and in all cases we never see or store a password. Your phone number is contact information for deliveries — it is not a login credential.
• Seller data — your Instagram handle, self-declared follower count, display name, and payout details (bank account or UPI) used to pay you your earnings. Sellers are verified by sending a one-time code to our Instagram (@thriftr.world), which our team checks manually.
• Listings & content — photos, videos, titles and descriptions you upload, and the messages you send in support chat.
• Order data — delivery and pickup address, phone, order items, and order status. Orders are Cash on Delivery, so we do not collect card or bank-account details from buyers.
• Device & diagnostic data — app version, OS, IP address, and crash logs, used for performance and abuse prevention.

We process your personal data on the basis of the consent you give when you create your account — a clear affirmative action, taken after this notice is made available to you — and, for some processing, for the legitimate uses the DPDP Act 2023 recognises (for example, processing needed to fulfil an order you have placed, to comply with law, or to respond to your own request). Consent is purpose-specific: we use your data only for the purposes listed in this policy, and you can withdraw consent at any time (section 9), after which we stop the processing that relied on it — withdrawal does not affect processing already carried out, or processing we must continue for legal compliance (such as tax records).

Thriftr is for users 18 and over — you confirm this when you sign up. We do not knowingly process the personal data of anyone under 18, do not target advertising at children, and do not undertake behavioural monitoring of children. If you believe a minor has created an account, write to our Grievance Officer (see our Grievance Redressal page) and we will verify and delete the account.

• To operate the marketplace (matching buyers and sellers).
• To verify sellers (we check that the one-time code was sent to our Instagram, @thriftr.world).
• To ship orders, process Cash on Delivery, handle returns, and pay seller payouts.
• To send transactional emails — order updates, approvals, payout notices, and account/security alerts.
• To prevent fraud and enforce our Terms of Service.

We do not sell your personal data, show third-party advertising, or track you across other apps or websites.

We share the minimum data required with these processors:

• Google & Apple (sign-in) — we verify the identity token they issue and receive your email and name.
• Shiprocket(shipping) — the delivery recipient's name, phone, and full address, and the COD amount, so your order can be shipped and tracked. For returns, the seller's pickup details are shared instead.
• Cloudinary (image hosting) — listing, profile, and support photos you upload.
• Bunny Stream / Cloudflare Stream (video hosting) — listing videos you upload.
• Resend / Amazon SES (email delivery) — your email address and the contents of the transactional emails described above.
• Meta / Instagram (seller verification) — sellers tell us their Instagram handle and follower count and prove ownership with a one-time code; your profile photo is one you upload yourself, not taken from Instagram.
• Anthropic(AI features) — we use the Claude API to help draft listings, classify a seller's niche, and screen listing content (listing text/photos). If you contact support and AI assistance is enabled, your support messages and relevant order context (such as order status and wallet balance) may also be processed to help draft a reply. AI inputs are not used by Anthropic to train its models.
• Umami(website analytics) — anonymous, aggregate usage data only; no cookies, no stored IP, no cross-site tracking. See the Analytics & cookies section below.
• Railway / Vercel (infrastructure hosting).

We do not share your data with these processors for their own marketing, and we never sell it.

Where your data is processed. Some providers process data on servers outside India — Google, Apple, Cloudinary, Bunny/Cloudflare, Resend, Meta, and Anthropic operate globally (primarily the United States). Shiprocket, and email sent via Amazon SES (Mumbai region), are processed in India. This cross-border processing is part of what you consent to when you create your account (section 3), and is carried out under contractual and technical safeguards as required by the DPDP Act 2023; it is limited to countries not restricted by the Central Government.

Payments are Cash on Delivery; if we enable online card/UPI payments in future, we will update this policy and disclose the payment and payout processors (e.g. Razorpay).

We use Umami, a privacy-friendly, cookieless analytics tool, to understand how our website is used — for example which pages are most visited and where visitors arrive from. It collects only anonymous, aggregate data (pages viewed, referring site, approximate country, and device/browser type). It does not use cookies, does not store your IP address, and cannot identify you or follow you across other websites. Because no personal data is stored, no cookie-consent banner is required.

Active accounts: as long as you use Thriftr. After account deletion: we retain anonymized order records for 7 years, the record-keeping period required for tax and audit compliance under Indian law (including the Income-tax Act, 1961). Trust-and-safety records connected to a ban or fraud investigation are kept for at most 3 years from the ban or the closure of the investigation, then deleted. All other personally identifying fields are erased at deletion.

Under Indian data-protection law (DPDP Act 2023), you can:

• Access a copy of the data we hold about you.
• Correct inaccurate or incomplete data, and update it.
• Request deletion of your account, which anonymizes your data. See our Data Deletion page.
• Withdraw consent and stop using the service at any time.
• Nominate another person to exercise these rights on your behalf if you die or are incapacitated — write to our Grievance Officer to record a nominee.
• Raise a grievance with us and, if you are not satisfied with our response, complain to the Data Protection Board of India.

If a personal-data breach affects your data, we will notify the Data Protection Board of India and each affected user as required by the DPDP Act 2023 and its rules — describing what happened, the data involved, and the steps we are taking — and we will act promptly to contain and remedy the breach.

Questions about this policy? support@thriftr.shop

To raise a privacy or data-protection grievance, or to reach our Grievance Officer (as required under the DPDP Act 2023 and the IT Rules 2021), see our Grievance Redressal page.