Privacy Policy

Effective date: May 18, 2026 | Last updated: May 18, 2026 | Version 1.0

This Privacy Policy describes how PNW Cutters Xchange (“we,” “us,” “our”) collects, uses, shares, and retains information when you use pnwcuttersxchange.com and its subdomains, applications, and services (the “Site”). Capitalized terms not defined here have the meanings given in our Terms of Use & Disclaimer.

1. Scope

This Policy applies to information collected through the Site. It does not apply to information you provide directly to other Users (for example, in an off-platform email, phone call, in-person meeting, or third-party payment app). Once you communicate or transact off the Site, this Policy no longer governs that exchange — the third party’s privacy practices do.

2. Information We Collect

We collect only what is reasonably necessary to operate the Site.

2.1 Information You Provide.

Account data: email address; optional display name, location (city/state), phone, and WA UBI or Federal EIN for business sellers.
Listing data: title, material, species, treatment, origin, dimensions, weight, price, description, photographs, optional payment-method handles (PayPal email or paypal.me link, Cash App tag, Venmo handle, Zelle email/phone, Apple Pay indicator, free-text “other”).
Messages & replies: the buyer’s name, email, optional phone, optional “ship to” city/state/ZIP, and the message body for inquiries sent through the contact form or reply page.
Contact-form submissions: name, email, subject, and message body submitted through our general contact page.

2.2 Information Collected Automatically.

Request metadata: IP address (hashed before storage for rate-limit and abuse-mitigation purposes), browser user-agent, referrer, request timestamps, and pages visited.
Email-relay tokens: short opaque tokens that route reply email between buyer and seller without revealing either party’s address when the seller chose anonymity.

2.3 Information We Do Not Collect.

We do not use third-party advertising trackers, social-media pixels, or behavioral-advertising cookies.
We do not collect payment card numbers. Marketplace transactions occur between buyer and seller outside the Site.
We do not sell personal information to data brokers or marketers.

3. How We Use Information

We use information solely to:

Operate, secure, and maintain the Site (rate-limiting, abuse detection, fraud prevention);
Authenticate sellers via email-code login;
Route messages between buyers and sellers (including optional “ship to” details forwarded to the seller’s email so they can quote shipping);
Display public listings (including seller name, location, and any payment-method handles you choose to include);
Verify business identifiers (UBI/EIN) against publicly available Secretary-of-State records and apply a verified-business badge;
Send transactional email (verify links, login codes, listing confirmations, inquiry forwards, reply notifications);
Run periodic image-moderation scans on listing photos for content-policy compliance;
Comply with legal obligations, respond to lawful process, and protect our rights and Users in accordance with Sections 9, 10, and 11 of the Terms of Use.

4. How We Share Information

We share information only in the limited circumstances below.

With other Users. A listing’s public fields — including seller name, location, listing photos, and any payment-method handles you chose to include — are visible to anyone who views the listing. When a buyer messages a seller, the seller receives the buyer’s name, email (or our relay address if the seller chose anonymity), optional phone, optional “ship to” details, and message body.
With service providers that operate the Site on our behalf (see Section 5).
With victims of fraud or misconduct, in accordance with Section 10 of the Terms of Use, when reasonably necessary to support a civil action, small-claims filing, or law-enforcement report.
To comply with lawful process — subpoenas, court orders, search warrants, and law-enforcement requests under the Stored Communications Act (18 U.S.C. §§ 2701–2712), RCW 9.73, or other applicable authority.
In a business transfer. If we are acquired, reorganized, or sell substantially all assets related to the Site, information may transfer as part of that transaction. We will require the recipient to honor this Policy or notify Users of any material change.

We do not share information with advertisers or data brokers.

5. Service Providers We Use

The Site relies on the following third-party processors. Each is bound by its own terms and privacy practices; we link them for transparency.

Cloudflare (hosting, CDN, D1 database, R2 image storage, Workers AI moderation, Email Routing, Access SSO for admin pages) — privacy policy.
Resend (transactional email delivery for verify links, login codes, and inquiry forwarding) — privacy policy.
Apify (automated UBI/EIN verification against WA Secretary of State, only for business-listing sellers) — privacy policy.
GoldAPI.io and Metals.dev (precious-metals spot price feeds for the public ticker; no personal data is shared with either).
Square (payment processing — currently sandbox only, not active in production).

6. Cookies, Local Storage & Logs

Session cookie. A single first-party cookie (pnwcx_session) stores a seller’s login token for up to 30 days. It is HttpOnly, Secure, and SameSite-Lax.
Local storage. The Shop cart and a few UI preferences are stored in your browser’s localStorage. These never reach our servers.
Server logs. Cloudflare records request metadata (IP, user-agent, timestamps) for operational and security purposes. We retain hashed IPs for rate-limit and abuse-mitigation windows described in Section 7.
No third-party trackers. The Site does not use Google Analytics, Meta Pixel, advertising cookies, or other cross-site tracking.

7. Retention

We retain information only as long as needed for the purposes for which it was collected or to comply with our legal obligations.

Accounts: retained while active; you may request deletion at any time (see Section 8).
Listings: active listings remain visible until you delete them or they expire (30-day window with optional renewal). Expired listings remain in the database for limited operational purposes (deep-link resolution, dispute support) for up to 12 months, then are purged.
Messages: message metadata (hashed IPs, timestamps, delivery status) is retained for up to 12 months to support abuse investigations; message bodies are retained as part of the same record.
Login codes: 10 minutes.
Public-upload IP log: entries roll off after 30 days.
Backups: Cloudflare D1 retains automated backups according to its own retention schedule.

8. Your Choices & Rights

You can:

Edit or delete your own listings any time using the manage link emailed to you, or from the “My listings” page after logging in.
Update your account information via the signup/login flow.
Request account deletion or a data export by emailing privacy@pnwcx.com. We will respond within thirty (30) days. Verification of identity may be required to prevent unauthorized requests.
Opt out of non-essential email. Transactional email (verify links, login codes, inquiry notifications) is required to operate the Site and cannot be turned off while your account is active.

Residents of certain U.S. states have additional rights under state privacy laws (California CCPA/CPRA, Washington My Health My Data, and similar). To the extent those rights apply to the limited data we collect, we honor them upon verified request to privacy@pnwcx.com.

9. Children

The Site is intended for users eighteen (18) and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided information through the Site, contact privacy@pnwcx.com and we will delete it. (See Children’s Online Privacy Protection Act, 15 U.S.C. § 6501 et seq.)

10. Security

We use reasonable technical and organizational measures to protect information, including TLS for all transport, hashed credentials for sensitive identifiers, single-sign-on (Cloudflare Access) for administrative pages, content-security headers, and rate-limiting. No system is perfectly secure. If you suspect unauthorized access to your account, notify security@pnwcx.com immediately.

11. International Users

The Site is operated from the United States and intended for U.S. Users. If you access the Site from outside the U.S., information you provide will be processed in the U.S. and other jurisdictions where our service providers operate. Cloudflare’s global edge network may route requests through facilities outside your country.

12. Changes

We may update this Policy from time to time. Material changes will be announced by updating the “Last updated” date and posting a notice on the Site for at least thirty (30) days. Continued use after the effective date of a change constitutes acceptance. If you do not agree to the updated Policy, stop using the Site.

13. Contact

Privacy inquiries, deletion / export requests: privacy@pnwcx.com
Account security: security@pnwcx.com
General inquiries: info@pnwcx.com
Postal: PNW Cutters Xchange, Yelm, Washington, USA

This document is provided for transparency and does not constitute legal advice. For questions about your rights under applicable privacy law, consult a licensed attorney in your jurisdiction.