Privacy Policy

We Keep It Simple 🐌

Yard Snail is operated by Sthetic Creative Group, LLC ("we," "us"). This policy explains what information we collect, why, who processes it for us, and how to exercise your rights. We believe in plain language.

Short version: We collect what we need to run a local marketplace. We don't sell your data. You don't need a phone number to use Yard Snail, and we send no text messages — the only phone number we ever ask anyone for is an optional business contact number a seller may publish on their own shop. Listings are public because that is the point; messages, offers and bookings are private to the people involved.

Data controller: Sthetic Creative Group, LLC, 7533 S Center View Ct #6340, West Jordan, UT 84084, United States — the company that decides how and why your personal data is used, and the party responsible for it. Privacy questions and data requests: hello@sthetic.org.

This policy applies wherever you use Yard Snail and includes specific information for people in the European Economic Area (EEA), the United Kingdom and Switzerland (Sections 10 to 12a) and for residents of U.S. states with privacy laws (Section 11).

1. What We Collect

Information you give us directly

• Email address — to create your account and send you service email
• Password — handled by our platform's sign-in system; we never see it. Or, if you sign in with Google, the email, name, profile picture and account identifier Google returns; if you sign in with Apple, the name and email Apple returns — which may be an Apple private relay address that forwards to your inbox (see Section 3)
• Username, display name, avatar, banner and bio — your public identity on the platform. If you change your username, we keep an internal record of the change (see Section 9)
• Age confirmation — that you have confirmed you are 18 or older, and when
• City / neighborhood — so we can show you nearby sales
• Listings and shop content you post — titles, descriptions, categories, prices, photos, videos, dates, sale addresses and map coordinates, shop location and how precisely to show it, payment-method badges and QR codes you choose to display, menus, vendor schedules, food ingredient and allergen details, rental terms
• Messages, offers, holds, pickup bookings and meetup plans — in-app conversations and arrangements between you and other members, including photos sent in messages
• Reviews, ratings, comments, RSVPs, follows and thumbs-up/down meetup feedback — tied to your account for trust and accountability
• Saved listings, folders, routes, area alerts and saved searches — including the map areas you ask to be alerted about
• Scout submissions — photos, addresses and GPS coordinates you submit as a Snail Scout
• Vendor licenses — documents vendors choose to upload to their private license vault; visible only to the vendor and Yard Snail admins
• Consignment records — items you consign to a Yard Snail pop-up, their status and payout details
• Helper, venue and stockist listings — business details you choose to publish, which may include a business email, phone or website
• Feedback, reports, support messages, feature votes and interest sign-ups — what you send through contact, report and "help us decide" forms, and the city or zip code you give when raising your hand for a coming-soon feature
• Support tickets — the category and subject you pick, the name and reply address you give, what you write, the page you were on and your browser/platform description (captured automatically so we can reproduce a problem), an optional screenshot, and — only if you leave it in place when you send — the handover summary from the help assistant, which is the questions you asked it and the help articles it pointed you to. A ticket, its reference number and its thread are visible to you and to Yard Snail administrators only. Screenshots are stored in private storage, never at a public link
• Questions you ask the help assistant — a question typed into the help bubble is sent to an AI model to answer, and is checked for misuse like every other AI feature (Section 6). It is not kept as a chat history: what a ticket can carry is the handover summary described above, and only if you leave it there
• Blocks and mutes — who you have blocked and words you have muted, so we can enforce them

Location data

If you grant location permission, we use your device's coordinates only to center the map, sort nearby listings, suggest a locality, and fill in a location you are creating. We do not store your location history or track you between sessions. Your precise location is only read after you tap to allow it — nothing asks for it when a page loads, and if you never grant it, it stays off. You can deny location permission and type a city or zip code instead. Locations you deliberately save — a listing address, your shop's locality, an area alert, a Scout submission — are stored because you asked us to.

Usage data we collect automatically

• Listing interaction events — a pin tap, detail view, directions tap, save or share — recorded on our own servers against the listing and an opaque per-browser session id that is never joined to your account, and reported to sellers and to us only in aggregate
• AI usage metering — how many AI requests your account has made this month, so we can apply fair-use limits
• AI misuse log — if something you send to an AI feature is blocked as misuse, a record of it (see Section 6), visible only to administrators and deleted automatically after 12 months
• Pages visited, approximate location derived from your IP address, device and browser type, and the referring page, through Google Analytics 4, only if you accept analytics (see Section 8)
• Visit data through our app platform Base44's built-in analytics, also only after you accept — when a visit started and the page that referred it, a heartbeat about once a minute, how long the visit lasted, the page path, a random visit ID stored in your browser's local storage, and your account identifier when you are signed in, so a visit can be attributed to a member rather than to a browser (see Section 8)
• IP address and basic log data — used for security, rate limiting and abuse prevention; not used for targeting
• Platform logs — our hosting platform (Base44) keeps server-side technical logs of requests to the app's backend, as our service provider, to operate and secure it (see Section 8)

What we do not collect

We do not require a phone number to create or use an account, and we send no text messages. The only optional phone field in the app is a seller's business contact number, which they choose to publish as part of their consumer disclosure (see Section 3) — nothing else in the app asks for one. We do not collect payment card details; we do not process payments. We do not collect precise location history.

2. How We Use Your Information

• To operate the Yard Snail platform — publishing your listings, showing nearby sales, delivering messages, arranging pickups and meetups, tracking consignments
• To send you account and transactional email (sign-in and password emails, pickup and meetup confirmations, itineraries and reminders you request, license-expiry reminders for vendors, city-launch notices you signed up for) and in-app notifications you can manage in your profile
• To put an accepted pickup on a connected Google Calendar (Section 5)
• To power the AI features you use and to run automated safety review (Section 6)
• To moderate content, enforce our Community Guidelines, investigate reports, and prevent fraud and abuse
• To show sellers how their listings perform and to understand, in aggregate, how the app is used so we can make it better
• To comply with the law and protect the rights and safety of members and others

3. Signing In

You can create an account with an email address and password, or sign in with Google or Apple. Authentication is handled for us by the Base44 platform; we do not see or store your password.

When you choose "Continue with Google," Google returns your email address, basic profile information (such as your name and profile picture) and a Google account identifier. Google handles that sign-in under its own privacy policy and receives your name and email for it. We use it solely to create and identify your Yard Snail account and sign you in. We do not receive access to your Gmail, Drive, Contacts or any other Google service through sign-in. You can disconnect Yard Snail from your Google account permissions page at any time; doing so stops Google sign-in but does not delete your Yard Snail account.

When you choose "Continue with Apple," Apple handles that sign-in under its own privacy policy and receives your name and email for it. Apple returns your name, your email address and an account identifier — and if you choose to hide your email, the address we receive is an Apple private relay address that forwards to your real inbox. Apple returns your name and email only the first time you authorize the app. We use what we receive solely to create and identify your Yard Snail account and sign you in, and we receive no access to your Apple ID, iCloud or any other Apple service through sign-in. You can stop using Apple sign-in at any time in your Apple ID settings; doing so does not delete your Yard Snail account.

If you authorize an outside AI tool to connect to your account through our authorization screen, that tool can read and act on your account data to the extent shown when you approved it, until you revoke it. We show you what is being granted before you approve.

4. What Is Public

Yard Snail is a marketplace, so some things are visible to anyone, including people without an account: your username, display name, avatar, banner and bio; your listings, shop page, shop items, menus and schedules; the locality and, if you choose, the exact address of a sale; reviews, ratings and comments you post; your follower count; your place on the Scout and Seller leaderboards; and Helper, venue and stockist pages you publish. Search engines can index public pages. Think before you post a photo of your home or something you would not want a neighbor to see.

Never public: your email address, messages, offers, pickup bookings and meeting places (revealed only to the other party once a pickup is accepted), saved listings, folders, routes, area alerts, drafts, license documents, consignment payouts, blocks, reports, and who has RSVP'd to an event.

5. Sharing with Third Parties

We share information only in these limited circumstances:

• Service providers — Base44 (our application platform: hosting, database, file storage, sign-in, email delivery, backend functions and the AI integration layer) and the AI model providers reached through it; Google (sign-in if you choose it, Google Analytics if you opt in, Google Calendar where a calendar connection has been set up for pickups, and Google Fonts, which delivers our typefaces from Google's servers and so receives your IP address and browser information but sets no cookies); Apple (sign-in if you choose it); Stadia Maps (map tiles and map-search suggestions), with OpenFreeMap and OpenStreetMap's Nominatim geocoder as backups and for saved locations; Open-Meteo (weather for a sale's coordinates and date); and the U.S. CPSC SaferProducts API (recall checks by brand, model or description). Our Subprocessors & Security page lists each one and what it receives.
• Other members — the person you message, make an offer to, or book a pickup with sees what you send them, your display name and username, and — once a seller accepts — the meeting place. A shop owner's designated representative can see that shop's conversations.
• Sites you paste into link import — our server fetches the page you pasted; that site sees a request from us, not you.
• Legal requirements — if required by law, court order, or to protect the safety of our members or others.
• Business transfers — if Sthetic Creative Group, LLC is acquired or merges with another company, your data may be transferred as part of that transaction, and this policy will continue to apply to it.

We do not sell, rent or trade your personal information, we do not share it with advertisers, and we do not use it for targeted advertising.

6. AI Features & Automated Review

Some features are powered by AI: the listing assistant (titles, descriptions, item details and price ranges, including from photos), photo item detection and multi-item photo posting, barcode and model-plate reading, spreadsheet and link import, search suggestions, listing summaries, review highlights, message reply drafts, the saved-alert builder, vendor tools, venue matching, report triage, the in-app chat assistants (Finds Guide, Shop Coach, Meetup Feedback, Support Assistant), the help assistant that appears on every page, and our automated content-safety review. The help assistant is deliberately narrow: it is given our published help articles and your question, and nothing else — it is not given access to your account, your listings, your messages or anyone else's data, and it cannot look anything up. When you use one of these — or post content that goes through safety review — the relevant text and photos are sent through the Base44 platform to an AI model provider to generate the result. Only what a given request needs is sent.

Automated safety review can hide a listing, photo or message that appears to violate our guidelines and keeps a record of what it declined and why; a person reviews flags, and you can always contact us if something was blocked in error. AI outputs are suggestions, not decisions about you, and we do not use your content to train AI models or to build advertising profiles. AI usage is metered per account for fair-use limits. Do not include sensitive personal information (such as government ID numbers or financial account numbers) in anything you submit to an AI feature.

Misuse checks. Messages you send to the in-app chat assistants, and questions or requests you type into other AI features, are automatically checked for misuse — attempts to override or "jailbreak" the AI's safety rules, to extract its hidden instructions, or to reach other people's information. A blocked attempt is not sent to the AI. We record it in an AI misuse log: what kind of attempt it was, which feature, when, your account email and role, the reasons it was flagged, and a short excerpt of what was typed (up to about 300 characters, with ID-style numbers such as Social Security, card and account numbers masked). The log is visible only to Yard Snail administrators. Serious or repeated attempts are also emailed to the administrators. Log entries are deleted automatically after 12 months; they are not removed early when you delete your account, because they exist to investigate and prevent misuse. Administrators are checked and logged the same way. The AI features are designed and configured to work only with your own information and public content, and administrators are subject to the same restrictions and logging — an administrator account is not given extra access to members' data through them.

7. Notifications & Emails

We send transactional email that the Service needs (sign-in codes, password resets, pickup and meetup confirmations) — you cannot opt out of those while you have an account. Other email is sent only because you asked for it: a route itinerary you emailed yourself, a reminder you set, a license-expiry heads-up, or a launch notice for a city you signed up to hear about. In-app notifications (new followers, listing activity, Scout updates) can be managed in your profile settings.

We do not send text messages, and we never ask for a phone number to sign in, post or message anyone. The one optional phone field in the app is a seller's business contact number, published as part of their consumer disclosure. If you share your own number inside a message, that is your choice and the number becomes known to whoever you sent it to; from that point the conversation is between the two of you and outside our moderation, blocking and scam detection.

8. Cookies & Tracking Technologies

We use essential cookies and browser storage to keep you signed in and remember preferences like theme, language and map settings. Optional analytics runs only if you consent by choosing "Accept analytics" in the cookie banner or in Safety & privacy → Analytics preferences. There are two analytics tools, and both are covered by that one choice: Google Analytics 4 and the built-in analytics of our app platform, Base44.

• Google Analytics 4 (Google LLC; Google Ireland Ltd. for the EEA, UK and Switzerland). Until you accept, Google Consent Mode keeps everything denied and the Google Analytics script is not loaded at all. Advertising features, Google signals and ad personalization are off; we do not sell your data or share it for targeted advertising.
• What it collects: pages viewed, the referring site, approximate location (country and city, derived from your IP address — Google Analytics 4 does not store IP addresses), device and browser type, session timing and interactions. We never send names, emails, user ids, messages, search text, listing text, or map coordinates or addresses, and Google Analytics never runs on sign-in, messaging, payment, profile, safety, pickup or admin screens.
• Cookies and retention: _ga and _ga_FHBGBMS67M, up to 2 years. Google Analytics data is kept for 2 months. When you withdraw consent we switch analytics off and delete those cookies.
• Legal basis (EEA, UK, Switzerland): your consent (GDPR / UK GDPR Art. 6(1)(a)). Withdraw any time, as easily as you gave it, via "Cookie settings" in the footer or Analytics preferences.
• Transfers: Google LLC is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) and also uses Standard Contractual Clauses.
• Global Privacy Control: if your browser sends a GPC signal we treat it as a refusal without asking, and analytics stays off unless you later opt in yourself.
• Base44 platform analytics: our app platform's built-in analytics, which also runs only after you accept. It records when a visit starts and the page that referred it, a heartbeat about once a minute while you are on the site, how long the visit lasted, the path of the page you are on, a random visit ID kept in your browser's local storage (base44_analytics_session_id), and — when you are signed in — the identifier of your account, so a visit can be attributed to a member rather than to a browser. It also counts guest listing and shop views. It is not Google Analytics and it never receives your name or email: those stay on your account so you can sign in, and they are not shared with either analytics tool. It is off for anyone who has not accepted, it starts from your next page load once you accept (the platform sets it up as the page loads), and it stops when you reject or withdraw, or when your browser sends a Global Privacy Control signal. Rejecting removes the visit ID from your browser.
• First-party stats: with the same consent, listing and shop taps are counted on our own servers (for guests, through the same platform analytics described above) and shown to sellers only in aggregate.
• Platform logs: our hosting platform, Base44 (a Wix.com Ltd. company), keeps server-side technical logs of requests to the app's backend, as our service provider, to operate and secure it. These are server-side records of requests rather than something running in your browser, they are not Google Analytics, and they are not used for advertising.
• Google Fonts: our pages load fonts from Google's servers (fonts.googleapis.com and fonts.gstatic.com). Google receives your IP address and browser information to deliver them. Google Fonts sets no cookies.
• How long we keep your choice: 12 months. We ask again after 12 months. Withdrawing also deletes our consent-only ys_analytics_session id and the platform's base44_analytics_session_id.

You can also install Google's opt-out add-on at tools.google.com/dlpage/gaoptout. Learn how Google uses information from sites or apps that use its services. We do not use advertising cookies. Our Cookie Policy lists every cookie and storage item.

9. Data Retention

We keep your data as long as your account is active. You can delete individual listings, items, saved things and conversations in the app at any time. If you delete your account, we delete your personal information within 30 days, except where we must keep it for legal or safety reasons (for example records of flagged content, abuse reports, safety-review logs, and consignment payout records). AI misuse log entries (Section 6) are deleted automatically 12 months after they are recorded, whether or not you still have an account. Support tickets and their threads are removed with the rest of your personal information when you delete your account, except where a ticket records a report or a moderation decision, which is retained for the legal and safety reasons described above. Copies may persist in routine backups for a limited period.

How long we keep each kind of data

• Account and profile — email, name, username, avatar, banner, bio, age confirmation and preferences: while your account is open, then deleted within 30 days of account deletion. Routine backups may hold a copy for a limited period (currently up to 90 days).
• Listings, shop items, photos, videos, menus and vendor schedules — until you delete them, until a classified item expires (30 days after posting), or with your account.
• Messages, offers, holds, pickup bookings and meetup arrangements — while your account is open; deleted within 30 days of account deletion.
• Saved listings, folders, routes, area alerts and saved searches — until you delete them, or with your account.
• Reviews, comments, ratings and RSVPs — kept with the content they belong to, and removed with your account.
• Vendor licences you upload — while your shop is active and the licence is on file; removed with your account.
• Consignment and payout records — kept for 7 years after payout, because tax and accounting law requires it.
• Support tickets and their threads — 24 months after the last reply, or with your account, except a ticket that records a report or a moderation decision, which is kept for the legal and safety reasons above.
• Reports, moderation decisions, blocks and mutes — up to 24 months, so repeat behaviour is visible to whoever reviews the next report.
• AI misuse log — 12 months from the record, and not deleted early when you delete your account (Section 6).
• First-party listing and shop interaction counts — 24 months, held in aggregate.
• Analytics — Google Analytics data 2 months; the platform analytics has no separate long-term store; your consent choice is remembered for 12 months (Section 8).
• IP addresses and server logs — where we keep an address for rate limiting it is truncated to a date-scoped hash and kept up to 12 months; routine platform request logs up to 12 months.

Username change history

When you change your username, we keep an internal record of the change: the old handle, the new handle, when it happened, and a hashed (never raw) form of the network address it came from. We keep this for fraud prevention, moderation, and dispute resolution — so that if someone builds trust under one name, causes harm, and renames, we can still connect the dots. This record is never shown publicly. We retain it for 24 months from the change, or 90 days after you delete your account, whichever comes first, and it is included when you request a copy of your data.

10. Legal Bases for Processing (EEA, UK & Switzerland)

If you are in the EEA or the UK, we process your personal data only where we have a lawful basis under the GDPR / UK GDPR:

• Performance of a contract (Art. 6(1)(b)) — to run your account and provide the Service under our Terms of Service: publishing your listings and shop, delivering your messages, offers, holds and pickup bookings, adding an accepted pickup to your calendar, and the transactional email the Service needs. Without this we cannot provide Yard Snail at all.
• Legitimate interests (Art. 6(1)(f)) — security, moderation and improvement: preventing fraud and abuse, rate limiting, enforcing our Community Guidelines, investigating reports, counting how listings perform in aggregate, and making our features work better. We use as little data as we can for these, balance them against your rights and freedoms, and you can object at any time (Section 11).
• Consent (Art. 6(1)(a)) — the optional things: analytics cookies and the analytics described in Section 8; your precise device location, which is read only after you tap to allow it; the optional AI features in Section 6, which process the content you choose to submit to them; connecting an outside tool to your account; and optional emails such as a city-launch notice. You can withdraw consent at any time, as easily as you gave it.
• Legal obligation (Art. 6(1)(c)) — where the law makes us: retaining consignment and payout records for tax and accounting, answering lawful requests and court orders, running our copyright process, publishing the seller disclosures required of high-volume third-party sellers, and keeping the report and moderation records described in Section 9.

11. Your Privacy Rights

Depending on where you live — including under the EU and UK GDPR, the California CCPA/CPRA, and the privacy laws of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other U.S. states — you may have the right to:

• Access — know what personal data we hold about you and get a copy
• Correction — fix inaccurate or incomplete data (most of it you can edit yourself in your profile)
• Deletion — delete your account and associated personal data
• Portability — receive your data in a portable, machine-readable format. You can download a copy of your data yourself from profile settings at any time, and sellers can export their listings and inventory in the app
• Restriction and objection — limit or object to certain processing, including direct marketing
• Opt out of sale, sharing, targeted advertising and profiling — we do none of these, so there is nothing to opt out of; we also honor Global Privacy Control signals as an opt-out of optional analytics
• Withdraw consent — where we rely on consent, at any time
• Non-discrimination — we will not treat you differently for exercising any of these rights

To exercise any of these rights, email hello@sthetic.org from the address on your account with the subject line "Data Request." We verify requests by confirming control of that email address. We respond free of charge — within one month of your request under the GDPR and UK GDPR (extendable by up to two further months where a request is complex or you send several, and we will tell you if we need that), and within 30 days under U.S. state laws (generally 45 days, extendable once with notice). You may use an authorized agent; we will ask for your signed permission and verify your identity directly. If we decline a request and your state gives you an appeal right, reply to our decision with the word "appeal" and your reasons and we will respond in writing. You can also delete your account yourself at any time in your profile settings.

For CCPA purposes: in the preceding twelve months we collected the categories described in Section 1 (identifiers, account and profile details, commercial information about what you list and buy, location you provide, internet activity, and inferences generated by AI features), disclosed them only to the service providers listed on our Subprocessors page for the business purposes described here, and did not sell or share personal information, including that of anyone under 16. We do not offer financial incentives in exchange for personal information.

If you are in the EEA, the UK or Switzerland and believe we have mishandled your data, you have the right to lodge a complaint with a data protection authority. You can go to them directly, without coming to us first — though we would appreciate the chance to put things right with you first.

• EEA: your local supervisory authority — the one in the country where you live or work, or where the alleged infringement happened. The European Data Protection Board lists them all at edpb.europa.eu.
• United Kingdom: the Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint, telephone 0303 123 1113.
• Switzerland: the Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch.

12. International Users & Data Transfers

Yard Snail is operated from the United States, and our service providers store and process data in the U.S. and may do so in other countries. If you use Yard Snail from outside the U.S. — including from the EEA or the UK — your information will be transferred to and processed in countries whose data-protection laws may differ from your own. These transfers are necessary to provide the Service you asked for, and they are covered by the safeguards below.

• Where a provider is certified under the EU-U.S. Data Privacy Framework (including its UK Extension and the Swiss-U.S. Data Privacy Framework), we rely on that certification. Google LLC — our analytics and font provider, and the sign-in and calendar provider when you choose it — is certified.
• Where a provider is not certified — including our application platform Base44 (a Wix.com Ltd. company) and the AI model providers reached through it — we rely on the European Commission's Standard Contractual Clauses, together with the UK Addendum issued by the ICO and the Swiss addendum where relevant, and on each provider's own assessment of the transfer.
• You can ask us for a copy of the safeguards relied on for a particular transfer, or for more detail about where a given provider processes data, by emailing hello@sthetic.org.

By using Yard Snail, you understand that your information will be handled as described in this policy.

13. Minors & Age Requirement

Yard Snail is intended only for adults. You must be at least 18 years old to create an account, consistent with our Terms of Service. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has created an account, please contact us and we will delete it promptly.

14. Image Removal Requests

Yard Snail accepts photos on listings, shop items, profiles and messages. If an image of you was posted without your consent — including intimate or sexually explicit imagery, and including an image that was altered or generated to look like you — you can ask us to take it down, whether or not you have an account.

Use the Report link on the listing, shop or message and choose “Image of me / non-consensual image.” Those reports are flagged high priority and go to the front of the moderation queue. You can also email hello@sthetic.org with the subject line “Image Removal” and a link to or description of where the image appears.

Our commitment: we will remove reported non-consensual intimate imagery within 48 hours of receiving a valid request, and we will also remove copies of the same image that we can identify elsewhere on the Service. We may ask for enough information to confirm that the request concerns you, but we will not ask you to send us further copies of the image. We do not require a lawyer, a form, or a fee. If we cannot verify a request, we will tell you why and how to follow up.

15. Security

Traffic to Yard Snail is encrypted in transit (HTTPS), passwords are handled by our platform's sign-in system rather than by us, and private records are access-controlled per member so that one account's messages, offers, bookings and documents are not readable by another. Sensitive actions run through server-side checks. No internet service is completely secure; use a strong, unique password and tell us immediately about any suspected unauthorized access. Our Subprocessors & Security page describes our practices — and what we do not claim — in more detail.

16. Changes to This Policy

We may update this Privacy Policy as the app evolves. We will post the new version here and update the "Last updated" date, and for material changes we will give additional notice by email or in-app notice.

Contact Us

Questions, data requests, or concerns? Email hello@sthetic.org and we will respond within 30 days.

For anything to do with using the app — a problem, a bug, or a question about how something works — write to support@yardsnail.com, or use the contact form in the help center, which gives you a reference number to follow. The help center answers most questions without waiting for a reply.

Sthetic Creative Group, LLC

7533 S Center View Ct #6340, West Jordan, UT 84084