Privacy Policy

1. Information we collect

• Contact information you provide, such as an email address and any name supplied with your request.
• Order and transaction information including purchases, amounts, payment identifiers, delivery and refund status, and receipt details. Browser card payments use Stripe Checkout; do not send card numbers or security codes in product forms or support messages.
• Sale and line information for sellers: your email, first name and city, your photos, item titles and prices, pickup times and any meeting point you enter. For buyers: your first name and email when you join a line, and the time you pick.
• Service records including submitted requests, generated outputs, preferences, delivery status, and access or usage records where the feature uses them. Free previews can also involve processing.
• Support and feedback including messages, optional contact details, and submitted attachments. The feedback widget also sends page context such as the URL, title, viewport, user agent, and session identifier. Avoid including private information in URLs or unnecessary attachments.
• Technical records such as IP address, request path, referrer, user agent, timestamps, errors, and diagnostic information generated when our hosting or other providers handle requests.
• Site-visit and attribution records associate pages and referring links or campaigns with a random browser identifier. The identifier can be attached to an order to attribute a purchase to a visit. These records are pseudonymous, not anonymous: they can be linked to other information, including a purchase or identifying message.
• Each photo is re-encoded to remove location and camera data when it arrives, then sent to an automated service that suggests a title and price and decides whether the photo can be published. Only people who proved their email address by opening our link can upload. A refused photo stays private, visible only to the seller, until the seller replaces or removes it or the sale is deleted.
• A seller sees a buyer's first name and email only once that buyer has confirmed a pickup. A buyer who confirmed sees the seller's email and, when the seller chose this, the meeting point. Other buyers see only how many people are in line.
• To apply stops and sending limits we keep keyed hashes of email addresses, and usage events that carry hashed references and no address or name. A person's history in one line is never shown to any other seller.
• When someone reports a page, the item or the whole page is hidden and we keep the reason, the time, a keyed reference to the reporter and any note, sealed at rest. A GitHub issue is filed with the reason and a reference, and it holds no image, no address and no link to the sale.

2. How we use information

• To provide requested features, produce and deliver outputs, maintain access, and handle support, payments, and refunds.
• To send service messages, respond to enquiries, and provide optional communications you request. Where offered, optional mail preferences are separate from essential service and billing notices.
• To diagnose errors, prevent fraud and abuse, protect the service, and understand visits, usage, and which channels lead to purchases.
• To keep necessary business records, resolve disputes, and meet legal obligations.

We do not sell personal information or share it for cross-context behavioural advertising. We do not use third-party analytics services or cross-site advertising trackers on this site.

If your organisation supplies information about other people for us to process on its behalf, its responsibilities and ours depend on the service and applicable data-processing agreement. This notice does not replace a required agreement or give either party permission to process information unlawfully. Contact us before submitting material that requires contractual safeguards not already agreed.

3. Important submission rules

Next in Line is designed for selling your own used goods to people you reach yourself, and pickup in person. Provide only what is needed for the requested feature and what you are authorised to provide. If required information is omitted, we may be unable to provide that feature.

Photograph only the goods you are selling. Do not upload photos of people. A photo showing a person, or something that is not an item for sale, stays private and is not published.

Do not list firearms, ammunition, vehicles with titles, alcohol, tobacco, prescription drugs or live animals.

Submission restrictions are not a claim that every prohibited detail is automatically detected or removed. They do not reduce our obligations under applicable privacy law.

4. Service providers and AI processing

The following providers support the relevant features. Information shared depends on the operation, not every provider receives every submission.

• Stripe processes payments, checkout, billing records, and refunds under its applicable terms and privacy notice.
• Vercel hosts the website, functions, and stored records or artifacts.
• Resend handles outbound service and support email.
• Migadu hosts incoming support email and mailbox records.
• OpenRouter routes model requests. Relevant submitted content and generated material may pass to OpenRouter and its upstream model providers, including during free previews. Retention and model-improvement practices vary by provider and settings. We do not promise universal no-training or zero-retention treatment.
• Neon hosts the shared database for visit attribution and, where used, developer-account and API usage records.
• GitHub holds internal support and issue records. Messages and relevant metadata may be copied into private issues. Support and technical investigation may involve automated assistance; omit unnecessary sensitive material from support requests.
• Reddit receives a purchase record when you arrived from one of our Reddit advertisements and then buy: the click identifier Reddit added to the advertisement link, the order amount and currency, the time of the purchase, and an order reference. It is used to measure which advertisements lead to purchases. No name, email address, or order content is sent, and nothing is sent when you did not arrive from a Reddit advertisement. Reddit handles it under its own privacy policy.

Additional feature-specific recipients are described in this policy and the portfolio provider inventory at forage.bot/security. A payment provider or an integration you choose may also act independently under its own notice. Our use of a provider does not remove our own duties.

Information may also be disclosed as necessary for lawful requests, legal claims, security, or a business reorganisation, with the protections and notices required by applicable law. Sharing or publication features make selected material available to their intended recipients or link holders as described by the product. A recipient can keep a separate copy.

5. Legal bases where EEA/UK law applies

• Contract for processing necessary to provide a service requested by the individual, including delivery and related support.
• Legitimate interests in security, fraud prevention, troubleshooting, and operating the business, where not overridden by individual rights. An organisation's contract does not by itself supply this basis for every person whose data it submits.
• Legal obligation for required accounting, tax, and other legal records.
• Consent where required for a particular use or storage technology. A privacy notice or use of the site alone is not that consent.

Special-category information and other restricted data may require additional legal conditions. A submission instruction is not a substitute for those conditions.

6. Retention and deletion

You can delete a sale from your private link at any time. A sale, its items, photos, lines and any address typed into a claim form are otherwise deleted 14 days after its end date. A sale whose seller never opened the confirmation email is deleted 14 days after it was started. Requests to hear about the next sale in a group are deleted 180 days after that group's last sale.

A report is deleted 180 days after it was made, unless a photo was preserved with it. A hash of an address that stopped mail is kept so the stop continues to apply. Usage events carry no name or address and are kept. Deleting records does not recall emails already sent or erase records held separately by payment or email providers.

Accounting and transaction records may need to be retained for statutory periods even when product data is deleted. Retention decisions also consider the sensitivity of the information, continuing service needs, legal claims, and applicable deletion duties. This is not permission to keep information indefinitely where law requires its removal.

Cancelling billing, unpublishing a page, expiring a link, deleting a stored artifact, and deleting an account are different actions. An action on our service does not necessarily erase downloaded copies, delivered email, backups, payment records, or data held independently by a recipient or provider. Ask us about the scope of a deletion request; legal exceptions do not justify keeping unrelated product content.

7. Your rights and choices

Depending on the law that applies, you may request access, correction, deletion, restriction, or a portable copy of your personal information; withdraw consent without affecting earlier lawful processing; and exercise applicable opt-out rights. You may use an authorised agent where law permits. Email nextinline@forage.bot with enough context to locate the information. Do not send identity documents unless a proportionate verification method has been arranged.

Right to object

Where EEA/UK law applies, you may object to processing based on legitimate interests on grounds relating to your situation, and to direct marketing at any time. Optional-message unsubscribe controls, where offered, do not prevent you from making a wider privacy request.

Verification, exceptions, response deadlines, and appeals are governed by applicable law. If we refuse a request, you may ask for the reason and appeal where available by contacting the address above. You may complain directly to your local supervisory authority or other competent regulator; contacting us first is not a prerequisite. Exercising a privacy right does not remove consumer rights or justify unlawful discrimination.

8. Cookies and browser storage

The first-party "vid" cookie contains the random attribution identifier described above. It is scoped to this site, is read by our servers rather than page scripts, and has a two-year expiry when set. It is used for visit and purchase attribution, not just essential delivery. Other storage used by a particular feature is described below.

When you arrive from an advertisement, the identifier the advertising platform adds to the link ("rdt_cid" from Reddit, "gclid" from Google, "fbclid" from Meta) is stored in a first-party cookie of the same name, read by our servers rather than page scripts, for 28 days (Reddit) or 90 days (Google and Meta). If you buy within that time it is added to the order's checkout record, so the purchase can be reported to the platform whose advertisement you clicked, as described in section 4.

Your private key is kept in your browser's local storage on your manage page. The feedback widget also uses browser session storage for a random identifier attached to feedback.

You can remove or block cookies and local storage in your browser settings. Removing storage may reset preferences or access saved on that device; it does not delete server records or cancel billing. First-party storage is not automatically exempt from consent requirements. This notice is not a consent control and does not replace any choice required by applicable law.

Stripe Checkout operates on Stripe's domain and may use its own cookies or similar technologies under Stripe's privacy practices.

9. Security and access links

The service uses HTTPS for web traffic and managed hosting and processing providers. No transmission or storage method is completely secure. Some products use signed or hard-to-guess links rather than a login; anyone holding such a link may be able to access the associated content or controls. Keep private links and credentials private. Contact us about unintended access. Security-incident obligations, including any required notices, remain governed by applicable law.

10. International processing

Jobbot Inc is based in the United States. Providers may process information there and in other countries with different privacy laws. The provider inventory identifies their published locations and terms, not a guarantee that all data stays in one country. Where a transfer needs a legal safeguard, that requirement must be satisfied separately; using this site does not waive it. Contact us for information about the arrangements applicable to your data and any available safeguard copy.

11. Children and intended audience

Next in Line is intended for adults selling or collecting used household goods, not for children to independently order or create accounts. Do not provide children's information unless a product-specific feature and notice expressly cover it and you have the required authority. If you believe a child's information has been provided improperly, contact nextinline@forage.bot.

12. Changes to this policy

The revision date identifies when this notice changed. Material changes require the notices and, where applicable, permission required by law. Posting a revised notice does not retroactively authorise a new, incompatible use of information already collected.

Reports about child safety

A photo reported for child safety is moved to private storage that no page serves, is not deleted when the sale is deleted, and is kept for at least one year after any report we make. We report apparent child sexual abuse material to the National Center for Missing and Exploited Children's CyberTipline, as United States law requires of a provider that learns of it. Nobody here looks through photos as a matter of routine, and the automated check that decides whether a photo can be published is not a check for illegal images.

13. Contact

For privacy questions or requests, email nextinline@forage.bot.