Privacy notice

What Prixzi keeps

• Your account: your username, your password (stored only as a salted scrypt hash), your recovery codes (stored only as SHA-256 digests) and your Matches alert setting.
• What you post: listings and their photos, item details, condition and defects, a coarse pickup area, price and expiry; messages and offers; and how each deal ended (sold or cancelled, the amount and the date).
• What you keep private: item alerts, including the most you would pay and any year or mileage limits; saved listings; people you block; and reports you file.
• Inbox updates: which of your conversations have something new (a message, an offer or a change to a deal) and whether you have opened them since.
• Housekeeping: a log of actions (what kind, when, and which item) and the request key of each form you submit, so a double submission is handled safely.
• Rate limits: to slow down password guessing and spam, Prixzi counts recent attempts per username, per account and, on the public site, per network address. It stores a hash of each (not the value itself) with the count; counts expire within an hour, and expired ones are deleted as the site is used.

Who can see what

• Anyone, signed in or not: published listings, their photos and the seller’s username.
• The other person in a conversation: your username and the messages and offers in that conversation.
• Only you: your item alerts and their prices, saved listings, blocks, and your recovery codes (shown to you once).
• Moderators: each report’s reason and the listing it is about. Moderation never shows item alerts or their prices.
• People who run Prixzi can access the database to operate and secure the service.

What Prixzi does not do

• No email address or phone number is collected. The early-access form in this preview checks the email you type but does not store it.
• No ads, analytics or tracking scripts, and no third-party scripts or fonts. Every file comes from Prixzi itself.
• Photos are re-encoded when you upload them, which removes embedded camera and location data.
• Prixzi does not sell or share your information with anyone.

Cookies and browser storage

• prixzi_session keeps you signed in for up to 12 hours.
• prixzi_pre protects sign-in and sign-up forms before you have a session, and lasts up to 1 hour.
• Both cookies are HttpOnly and SameSite=Strict. One flag in your browser’s session storage stops the logo animation replaying on every page. Nothing else is stored in your browser.

Security

Sessions expire after 12 hours. Changing or resetting your password signs out every session on your account. Sign-in and recovery attempts are rate limited.

The public site runs only over HTTPS. Backups are taken every 6 hours, checked, and the oldest are deleted after about 7 days.

Your copy, and deleting your account

Under Account security you can download everything Prixzi keeps about you as one file, and delete your account.

Deleting removes your username, password, sessions and recovery codes, item alerts and their prices, saved listings, matches, blocks you made, your photos, and listings nobody contacted you about. It cannot be undone, and any agreed deal must be finished or cancelled first.

Messages and offers you sent, and completed deals, stay visible to the people you dealt with, shown as from “Deleted member”. Listings that are part of a conversation or report are withdrawn and kept without photos as their record. Reports you filed stay with moderators.

We keep your information while your account is open. When you delete your account, your private data is removed immediately, and remaining copies in backups are gone within about 7 days.

Depending on where you live, you may have rights to see, correct, download or delete your data. Account security lets you download your data and delete your account; for anything else, write to support@prixzi.com.