Privacy

We store the account you create: name, email, password hash, state, postcode, suburb, and bio. We store listings, basket items, orders, messages, reviews, and reports. Payment card numbers in demo mode are not saved. If Stripe is connected, card data is handled by Stripe, not written into the Bug Barn database.

Session cookies are httpOnly. The database stores a hash of the session token, not the token itself. Passwords are hashed with bcrypt.

Your state and suburb appear on your keeper page. Your email does not. Order addresses are visible to you, the seller of that order, and admins.

Messages are private to the two keepers on the thread, plus an admin who is investigating a report. We don’t sell personal information.

Photos you upload are stored on the app server in this demo. A production barn should move them to private object storage.

The local database is SQLite on the machine running the app. It is not a promise about where production data will live. For a public launch, use a hosted Postgres database and a written privacy policy.