Privacy Policy

When you create an account, we collect what Google or your sign-in method provides — your name, email address, and profile photo. You can add more to your public profile: a display name, bio, avatar, and a general NYC location (borough/neighborhood only — we never ask for or show your exact address).

When you list, message, or review on Drifted, we collect what you submit: item photos and details, asking price, listing text, messages you send other users, and reviews you leave after a transaction.

When you upload a photo to create or price a listing, that image is sent to Google’s Gemini API (and, for some features, Google Cloud Vision) to identify the item, estimate condition, and suggest a fair price. These are automated, third-party AI services processing the image on our behalf — we don’t control how Google’s models work internally, but we don’t grant them any rights to use your photos beyond generating that one response.

If you sign in with Google, we receive your name, email address, and profile photo from your Google account, via our authentication provider (Supabase). We use this only to create and identify your Drifted account. We don’t request access to your Gmail, Drive, Calendar, or any other Google data beyond basic profile information.

You can optionally connect a Strava account from your profile to verify riding activity and earn distance-based badges. If you connect it, we request read-only access to your Strava activities (distance, ride count) — never your Strava login credentials, and never anything you post to Strava beyond ride activity. You can disconnect Strava from your profile at any time, which stops any further access.

The only payment Drifted itself processes is an optional paid promotion (featuring or bumping a listing), handled by Stripe. Your card details go directly to Stripe — Drifted never sees or stores your full card number. We keep a record that a payment was made, not your payment method itself.

We use cookies to keep you signed in and to remember where to return you after you log in. We don’t use cookies for advertising or cross-site tracking, and we don’t run third-party analytics or ad trackers on Drifted.

We use what we collect to:

• Create and secure your account;
• Show your listings, profile, and reviews to other users;
• Connect buyers and sellers through messaging;
• Auto-fill and price listings from your photos;
• Verify ride activity for badges, if you connect Strava;
• Process an optional listing promotion, if you buy one;
• Moderate reports and keep Drifted safe to use; and
• Contact you about your account or a transaction.

We don’t sell your personal information. We share it only with the service providers that run Drifted on our behalf — Supabase (database, authentication, and photo storage), Google (sign-in, and Gemini/Cloud Vision for listing photos), Stripe (promotion payments), and Strava (only if you connect it) — and with other users, to the extent your profile, listings, reviews, and messages are inherently visible to the people you’re transacting with.

We may also disclose information if required by law, or to investigate a report of fraud, abuse, or a safety issue on the platform.

Drifted’s database, authentication, and file storage run on Supabase. Listing photos are processed by Google’s Gemini and Cloud Vision APIs at the moment you upload them.

You can edit or remove most of what’s on your profile and listings directly in the app. You can disconnect Strava at any time from your profile. To delete your account and associated data, reply to the email tied to your account — we’ll confirm once it’s done, aside from records we’re required to keep (e.g. for legal or fraud-prevention purposes).

Drifted is for users 18 and older, per our Terms of Service. We don’t knowingly collect information from anyone under 18.

We may update this Privacy Policy from time to time. If we make a material change, we’ll update the effective date above.

Questions about this Privacy Policy or your data? Reply to the email tied to your Drifted account, or reach us through the app.