Privacy Policy
Last updated: October 11, 2026
1. Introduction
EBLIT LLC, a Delaware limited liability company ("EBLIT", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the EBLIT platform. By using EBLIT, you consent to the practices described in this policy. If you do not agree with this policy, please do not use the Platform.
2. Information We Collect
We collect the following categories of information: (a) Account Information: name, email address, password (hashed), phone number, street address, city, state, zip code; (b) Identity Verification Data: through Stripe Identity, we receive and store your verified legal name, the month and year of your birth (used to confirm you are at least 18 years of age; we receive your full verified date of birth from Stripe but discard the day immediately and never store it), the type of identity document you presented, its issuing state, the verification status and result, and an irreversible cryptographic hash of your identity document number used for fraud prevention. We do NOT store your identity document number itself, and we do NOT receive or store photographs or scans of your identity document — those remain with Stripe; (c) Transaction Data: product listings, purchase history, sale history, payment amounts, shipping addresses, tracking numbers; (d) Location Data: GPS coordinates collected at specific points during meetup and shipping transactions for verification purposes; (e) Device and Usage Data: IP address, browser type, device identifiers, pages visited, features used, time and date of access; (f) Communications: messages sent through the Platform's chat system, support tickets, and dispute communications; (g) Payment Data: payment method details processed and stored by Stripe; EBLIT does not store full payment card numbers; (h) Identity Photos: photographs taken during meetup transactions to confirm that the individuals completing the transaction are the parties associated with the relevant accounts. We retain these photographs only for as long as necessary to fulfil the purposes described in this policy, including the completion of transactions, the investigation and resolution of disputes and payment chargebacks, and the prevention of fraud, after which they are securely and permanently deleted; (i) LiveVerify Call Recordings: audio and video recordings of LiveVerify calls between a buyer and a seller, captured when a LiveVerify session takes place; (j) Reports: when you report a message, a person, or a listing, we record what you reported, the reason you chose, any details you add, and the decision our trust and safety team reaches. A report may also be created automatically, for a person to review, when a message or a listing contains language on a short list of slurs and threats. We use reports to review and act on what was reported, to answer an appeal against that action, and to see repeated conduct across accounts. A report is kept while it is under review and for 365 days after it is decided, and is then deleted; (k) Blocks: when you block another User, we record who you blocked, when, and the reason if you choose to give one; the person you blocked is not told. While you are signed in, we use a block to stop that person reaching you, to hide the profile and the listings of each of you from the other (including listings either of you sells for someone else as a delegate), and to hide from you the notifications that person had already sent you; we also use it to understand conduct between the two of you when something is reported. Your conversations from before the block are kept and stay readable to both of you, closed to new messages, as a record for a report or a dispute. A block is kept while it is in place and for 365 days after it is lifted, and is then deleted; (l) Handover Photographs: at an in-person meetup, after the buyer has examined the item and scanned its identifier, the buyer photographs the seller holding the item, and the seller then photographs the buyer holding it. Each photograph is taken in the EBLIT app on the other party's device and uploaded directly to EBLIT; the app does not save it to that device's photo library. Each photograph carries a visible EBLIT watermark identifying the listing. A buyer may choose not to be photographed, and may continue without photographing the seller; in either case we record the choice, when it was made, and the words the buyer was shown before making it. We also record when each party is told about the handover photographs before the meetup, when a seller reports that their camera is not working, and when a buyer reports, or a seller confirms, that the seller will not be photographed.
3. How We Use Your Information
We use your information to: operate and improve the Platform; process transactions and facilitate payments; verify your identity and prevent fraud; enforce our Terms of Service and other policies; communicate with you about your account and transactions; provide customer support; send transactional emails and notifications; comply with legal obligations; calculate and apply applicable sales tax based on the delivery destination (the shipping address for shipped items) or the meetup location for in-person exchanges; record the handover of an item at an in-person meetup, and use the handover photographs, and any choice not to be photographed, as evidence if the sale is later disputed, including in response to a payment chargeback; protect the rights, property, and safety of EBLIT, our users, and the public; detect and prevent fraudulent, unauthorized, or illegal activity; generate anonymized analytics to improve the Platform.
3A. Session Recording
We record a sample of web browsing sessions to diagnose errors and understand how the Platform is used — including clicks, scrolling, navigation, and timing. Recording is configured to mask all text, mask all form inputs, and block all images and video before any recording leaves your browser, and network request and response bodies are not recorded. We similarly record a sample of mobile app sessions — including taps, gestures, screen views, navigation, and timing — configured to mask all text (including text you type), mask all images, and mask all vector graphics before any recording leaves your device. As a result, on both the website and the mobile app, we do not capture your name, address, date of birth, identity document numbers, payment details, message contents, or photographs through session recording. We record approximately 10% of sessions, together with sessions in which an error occurs. Session recordings are processed and stored on our behalf by Sentry (Functional Software, Inc.) as our processor. We do not record our administrative interfaces.
3B. Text Messages
If you provide a mobile number, EBLIT may send you text messages, including one-time verification codes that you request and, if you have separately consented, messages about our launch and updates. Message frequency varies by the messages you request. Message and data rates may apply. You can reply STOP to any message to opt out, or HELP for support. We do not sell or share your SMS opt-in information or consent with third parties for marketing purposes.
3C. Support Correspondence
When you contact EBLIT support, or when EBLIT opens a support ticket about your account, the messages exchanged — the ticket, your messages, and our replies — are kept as a record of the matter. We retain this correspondence even after you delete your account. We do this because a support exchange is often the record of what happened in a dispute and may be needed to resolve that dispute, to investigate a payment chargeback or fraud, or to meet a legal or regulatory obligation. We do not anonymize the contents of these messages: the wording of what was said is frequently the evidence itself, and free-text messages cannot be reliably redacted without destroying that record. Support correspondence is retained for seven years, matching the retention period stated for transaction and dispute records in the Data Retention section below, and is then deleted.
3D. Phone Verification Before Messaging
Before you can message another member, we may ask you to verify a mobile phone number (Section 5A of our Terms of Service). When you do, we collect the number you give us and record each step of the verification: when a code was sent, whether a code was entered correctly, and whether a number was refused. We use the number to send you the one-time code, to confirm that each account belongs to a real person, to limit one number to five accounts, and to prevent fraud and abuse. We do not use it for marketing. The code is delivered by Amazon Web Services through AWS End User Messaging, which receives your number and the message only to deliver it. We keep your verified number for as long as your account is open and remove it when you delete your account. A number you entered but did not confirm is kept only until you confirm it, enter a different number, or delete your account. The record of each verification step does not contain your number: it holds a keyed one-way code made from it, which cannot be turned back into the number and lets us notice one account trying many different numbers. We delete that record 12 months after it is made. When you enter a number, we also ask the mobile carrier, through AWS End User Messaging, what kind of line it is: a mobile line, a landline, or an internet phone service. We keep the carrier's answer against the number, under the same keyed one-way code and linked to no account, so that a number that cannot receive our codes is refused and the same number is never checked twice; we use it only to prevent fraud and repeat checks. We keep the carrier's answer for as long as any EBLIT account uses that number, and for 12 months after the last such account is closed; for a number no account ever confirmed, we keep the carrier's answer for 12 months after the check.
4. Identity Hashing and the FirmSecureHash System
EBLIT uses a proprietary system to generate a pseudonymous identifier (the "FirmSecureHash" or "FSH") linked to your verified identity. This system enables EBLIT to track product ownership history and detect unauthorized re-listings without storing your raw government ID information. The specific methodology used to generate FSH identifiers is a proprietary trade secret. Your FSH number is never displayed in any user-facing interface. In the event of a data breach, exposure of FSH data does not expose your underlying government identification information.
4A. Display of Your Verified Name
When you complete identity verification, the legal name on your identity document becomes the name on your EBLIT account, and we notify you when this happens. After verification you cannot change that name yourself; if it needs correcting, contact support and a member of our team will review the change against your identity document before making it, and we will tell you when it is made. Other users see a display form of your name that you choose in your account settings: your full name, your first name with your last initial, or your first initial with your last name. Your middle names are never shown to other users. Your display choice applies while other users browse listings, view your profile, or wait in a purchase queue. Once you enter into a transaction, the other party to it is shown your full first and last name, so that each of you knows who you are dealing with, together with the photographs described in Section 2. Your display choice does not apply to EBLIT's own records, to information used to resolve a dispute, or to the disclosures described in Section 5, including disclosure to law enforcement or in response to legal process. If the legal name on your identity document differs from the name you ordinarily use, please contact us before completing verification.
5. Information Sharing
We share your information only in the following circumstances: (a) With other users, as necessary to complete transactions (e.g., shipping address shared with seller after payment, buyer name shared with seller for meetup); handover photographs are not shown to other users; (b) With Stripe, Inc. for payment processing and identity verification, and to respond when a card payment is disputed: when a payment for an in-person sale is disputed, we give Stripe the handover photographs for that sale as soon as the dispute is opened, and our response to the dispute states any choice not to be photographed; Stripe provides our response, with those photographs, to the card network and the card issuer deciding the dispute, and holds its copies under its own privacy policy; (c) With EasyPost for shipping label generation and carrier tracking; (d) With Amazon Web Services for infrastructure, storage, and communication services, including Amazon Chime, which carries and records LiveVerify video calls, and AWS End User Messaging, which delivers our text messages and receives your phone number only to deliver them and to tell us what kind of line the number is; (e) With Sentry (Functional Software, Inc.) for error monitoring and session recording; (f) With law enforcement or government authorities when required by law or legal process, or to protect the safety of users or the public; (g) With successors in the event of a merger, acquisition, or sale of assets, in which case users will be notified; (h) With service providers who assist in operating the Platform under confidentiality obligations. We do not sell your personal information to third parties. We do not share your personal information with advertisers.
6. Data Retention
We retain your personal information for as long as your account is active or as needed to provide services. Financial records and transaction data are retained for a minimum of seven years for legal and compliance purposes. Dispute records are retained for a minimum of seven years. Identity Photos taken during meetup transactions are retained only for as long as is reasonably necessary to fulfil the purposes for which they were collected, principally the completion of the transaction, the investigation and resolution of payment chargebacks, and the prevention and detection of fraud. Because a payment chargeback may be raised for a period of time after a transaction is completed, Identity Photos from a completed transaction are retained for 4 months after it completes, and are then securely and permanently deleted. Identity Photos from a transaction that is cancelled or rejected are deleted 72 hours after it ends. During these periods, and to limit the data we hold, these photographs may be moved to secure archival storage. Where Identity Photos are held because of a payment chargeback or a safety alert, they are kept while that matter is open and until 90 days after it is closed, and are then deleted. Handover Photographs are kept for exactly the same periods as the Identity Photos of the same meetup and are deleted with them: 4 months after a completed transaction, 72 hours after a cancelled or rejected transaction ends, and, where they are held because of a payment chargeback or a safety alert, until 90 days after that matter is closed. The record of a choice not to be photographed is kept with the transaction record. Photographs that a buyer or seller uploads to a meetup transaction as evidence are retained for 30 days after the meetup. Where a support ticket is opened, they are retained until 120 days after that ticket is closed, and are then deleted. Photographs and video that a buyer or seller uploads to a shipped transaction as evidence -- the carrier drop-off photographs and the unboxing video -- are retained for 120 days after the sale completes, and are then deleted. LiveVerify call recordings are retained for 20 days after the session and are then deleted. Where a dispute is opened, the recording is retained until 90 days after that dispute is resolved. How deleting your account works, and what is kept when you do, is set out in section 6A.
6A. Deleting Your Account
You can delete your account yourself, at any time, from Settings in the app or on the website (Delete account). Deleting your account is immediate and cannot be undone. Your personal details are removed: your name, email address, phone number, home and ship-from address, date of birth, profile and cover photos, bio and username, and the name and date of birth from your identity check. Every device signed in to your account is signed out, and any Apple or Google sign-in linked to it is disconnected, so it cannot be used to sign back in. Your live listings are taken down, your unfinished drafts are deleted, and you are removed from any waiting list you joined. Records of your sales, purchases, payments and taxes are kept for at least seven years, showing you as a deleted user, and we do not set a date on which they are deleted. EBLIT is required by law to hold them, and a card payment can be disputed long after a sale; the record of the sale is what answers that dispute. A shipping address on one of those sales is kept as the proof of where the item was sent, and is deleted 90 days after the sale ends, or 90 days after a related support ticket closes if that is later. While a dispute or a support ticket about the sale is open, the address is kept until it is resolved. Records of disputes are kept, and the personal information in a dispute is removed seven years after it was opened. Messages you exchanged with our support team are kept, because they are often the record of what happened in a dispute, and are deleted seven years after the conversation began. A one-way code made from your identity document is kept, with no date on which it is deleted. It cannot be turned back into your details. It is what stops a person who was banned from opening a new account, and a ban that ended when the banned account was deleted would protect no one. Payments are processed by Stripe, which keeps its own records of them under its own privacy policy. You cannot delete your account while another person is depending on it: while a sale you are part of has its payment held pending confirmation, while a dispute you are part of is open, while a meetup with you is arranged, or while EBLIT still owes you the proceeds of a sale. The app and the website tell you which of these applies and what to do; once it is finished, you can delete your account. You can also ask us to delete it through Support; we delete it in exactly the same way, under the same conditions.
7. Data Security
We implement industry-standard technical and organizational measures to protect your personal information, including encryption in transit (TLS), hashed passwords using bcrypt, row-level security on sensitive database tables, access controls limiting employee access to personal data, and regular security assessments. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security of your data. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.
8. Cookies and Tracking
We use cookies and similar tracking technologies to operate the Platform, authenticate users, and analyze usage. Please see our Cookie Policy for full details on the types of cookies we use and how to manage your preferences.
9. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal information: (a) Right of Access: request a copy of the personal information we hold about you; (b) Right of Correction: request correction of inaccurate personal information; (c) Right of Deletion: delete your account yourself from Settings, as section 6A describes, subject to the conditions and retention set out there; (d) Right of Portability: request your personal information in a portable format; (e) Right to Object: object to certain processing of your personal information; (f) Right to Withdraw Consent: withdraw consent where processing is based on consent. To exercise your rights, contact us through the Support section of the Platform. We will respond within 30 days.
10. Children's Privacy
The Platform is not directed at children under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.
11. International Transfers
EBLIT is operated from the United States. If you access the Platform from outside the United States, your information may be transferred to and processed in the United States. By using the Platform, you consent to the transfer of your information to the United States.
12. Third-Party Links
The Platform may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to review the privacy policies of any third-party websites you visit.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date and, where appropriate, by email. Your continued use of the Platform after changes constitutes your acceptance of the updated policy.
14. Contact
For privacy-related questions or to exercise your rights, please contact us through the Support section of the Platform.