Privacy
What we keep
Last updated 18 September 2026.
The short version: an email address, what you list and buy, and the school or club you picked. No card numbers, no advertising, no tracking between sites, and nothing sold to anybody ever.
What we store
| Your email address | It is how you sign in — there is no password — and how we tell you something sold. |
| A display name and handle | Only if you set them. Other members see these on your listings. |
| Your school or club | So listings reach the families who can collect them. |
| Your listings and orders | What you listed, what you bought or sold, and the amounts. We keep these as long as the account exists — they are a financial record and we are required to be able to produce them. |
| Your invite activity | Who invited you, who you invited, and the credit that earned. |
| IP address, briefly | Recorded on a sign-in request and used for rate limiting. This is how we stop somebody scripting thousands of sign-in emails to strangers. Rate-limit counters expire on their own. |
| Browser user-agent | Stored with a session so you can tell your own devices apart. |
| Your email, shown to one other person | Only after you have bought or sold something, and only to the other side of that order. It is how the two of you arrange the handoff — see below. Never shown to anybody else, never listed publicly, and never sold. |
| A delivery address | Only when you buy something that is being posted to you. Stripe collects it during payment and we store it on that order so the seller can send the item. It is shown to you and to that seller, and to nobody else. Most trades here are hand-to-hand at a practice and never involve one at all — we do not ask for an address to have it on file. |
| Country and region | For waitlist signups only, and only coarsely — used to decide which community to open next. No IP address is kept with it. |
What we do not store
- Card numbers and bank details. These go to Stripe and never reach us. We could not show you your own card number.
- Anything about children. Accounts are for adults. We do not ask for a child's name, age, year group, team or photograph, and you should not put them in a listing.
- Location beyond the community you chose, and beyond a delivery address for an order that is actually being posted. No GPS, no address book, no device identifiers.
- A browsing profile. There is no analytics, no tag manager, no session recording, no advertising pixel, and nothing that follows you to another site.
Cookies
Two, both first-party, both HttpOnly and Secure:
__Host-sf_session | Keeps you signed in. Expires after 30 days, or immediately when you sign out. |
__Host-sf_invite | Set only if you arrive through somebody's invite link, so their invite still counts after you click the link in your email. Cleared as soon as it is used. |
Neither is used for tracking. There is no consent banner because there is nothing else to consent to.
Who else is involved
| Stripe | Payments and payouts. They receive the buyer's payment details and the seller's identity and bank details directly. They see your email address when an order is created. Stripe's privacy policy. |
| Cloudflare | Hosts the site and stores the database. They handle every request, as any host does. |
| Resend | Sends the sign-in emails. They receive your address and the message. |
| Cloudflare Turnstile | On the waitlist form only, and only if we have switched it on. It checks whether a request looks automated. No cross-site tracking and no cookie in the mode we use. |
| Google Fonts | Serves the typefaces. Your browser fetches font files from Google, which means Google sees the request. This is the one third party here that exists purely for appearance, and we would replace it with self-hosted fonts if that trade stops seeming worth it. |
Nobody else. We do not sell, rent or share your information, and there is no advertising business here to sell it to.
What the other person sees
On an order, each side sees the other's handle or display name, what was bought, and the amounts relevant to them. If the item is being posted, the seller sees the delivery address — they cannot send it otherwise.
Once an order is paid, the buyer and the seller see each other's email address, on that order, and we email you both to say so. This is how a handoff gets arranged: most trades here are hand-to-hand at a practice, there is no messaging built in, and two people who have exchanged money need some way to reach each other. It happens at the point of sale and not before — browsing, listing and being outbid reveal nothing — and only ever to the other person on that particular order.
If you would rather not share an address with the person you are trading with, use one you are happy to give out. We would rather tell you that plainly than surprise you with it after you have paid.
Your listings are public
What you list — the title, size, condition, price, and your handle or display name — is visible to other members and, for open communities, to anyone. Your email address is not shown to other members. Treat a listing as public, because it is.
Asking for your data, or its deletion
Email hello@stillfits.com from the address on the account and we will send you what we hold, or delete it.
One honest limit: completed orders cannot be fully erased. They are the other party's financial record as much as yours, and Stripe keeps its own for its own legal reasons. We will remove your name and contact details from them and keep the amounts and dates.
Changes
If this changes in a way that affects what we collect or who sees it, we will email you before it takes effect rather than quietly editing this page.
Contact
hello@stillfits.com. A person reads it.