Privacy Policy
Last updated: July 15, 2026
1. Overview
This Privacy Policy explains how Quadsale collects, uses, discloses, and retains personal information when you use the Quadsale website, mobile applications, and related services (collectively, the “Service”).
This Policy is meant to describe our data practices. It is not a standalone consent mechanism for every processing activity. Where law requires consent for a specific activity, such as optional analytics technologies, we request that consent separately.
Quadsale App
Email: [email protected]
2. Notice at Collection
When you sign up, create listings, contact us, report content, or otherwise interact with the Service, we collect information in categories such as account and identity information, campus affiliation information, listing content, communications, device and log data, and security or fraud-prevention data.
We use that information to:
- create and administer your account
- verify campus access and manage campus requests
- display and moderate listings
- enable users to contact each other offline
- send service and security communications
- maintain logs, detect abuse, and protect the Service
- comply with legal obligations and respond to disputes or investigations
The Service now includes a short-form privacy notice in the signup flow and a cookie banner for non-essential analytics technologies. Additional just-in-time notice may still be appropriate if Quadsale later adds new sensitive-data uses, location features, marketing tools, or recording features.
3. Information We Collect
Information you provide directly
- Account and campus information, such as your name, school-issued email address, password, selected campus, and optional graduation year
- Profile information, such as your avatar and the contact methods you choose to share
- Listing content, such as titles, descriptions, categories, condition, price, and uploaded images
- Messages exchanged with other users through the in-app chat feature
- Support communications, campus requests, reports, moderation submissions, and other correspondence you send us
- Verification and account-management information, such as email-verification status, password-reset requests, and legal or privacy requests
Information collected automatically
- Session information, such as session identifiers, login timestamps, logout or revocation events, and session expiry data
- Device and request data, such as IP address, user agent, browser or device type, and approximate location derived from IP address
- Usage and diagnostics data, such as pages viewed, searches, interaction events, referrers, and application errors
- Cookies, local storage, and similar technologies used for authentication, consent-state storage, and analytics choices
Information from third parties or service providers
- Bot-protection and abuse-prevention signals, including Cloudflare Turnstile responses on protected sign-in or sign-up flows
- Analytics information from tools we enable with your consent
- Delivery, hosting, or infrastructure metadata generated by providers acting on our behalf
4. How We Use Information
- to create, authenticate, and secure accounts
- to verify campus eligibility and manage access to campus marketplaces
- to host, display, search, and moderate listings and user profiles
- to let users message each other, share chosen contact methods, and arrange offline transactions
- to respond to support requests, reports, disputes, and safety issues
- to investigate fraud, abuse, unauthorized access, and other policy violations
- to send transactional, service, and security emails
- to maintain, troubleshoot, and improve the Service
- to comply with legal obligations and protect users, Quadsale, and the public
5. How We Disclose Information
To other users
Quadsale is designed as a campus marketplace, so some information is visible to other users as part of the product. The user-facing visibility rules are described in Section 6 below.
To service providers acting on our behalf
- Microsoft Azure, including Azure Blob Storage, for hosting, storage, and related infrastructure functions
- Cloudflare, including Cloudflare R2 and Cloudflare Turnstile, for storage, delivery, site protection, and bot mitigation
- Azure Communication Services and Amazon Web Services Simple Email Service (AWS SES) for transactional email delivery
- Google Analytics, if you consent to analytics, for web-traffic and product-usage measurement
- PostHog, if enabled in the deployment you are using and if you consent to analytics, for product analytics
- Whop Inc., through the Whop advertising and attribution pixel, if you consent to non-essential technologies, to measure and attribute the performance of our advertising campaigns (see Sections 7, 12, and 13)
We instruct service providers to process information for us and not for their own unrelated direct-marketing purposes. If the providers we use materially change, we will update this Policy as appropriate.
For legal, safety, or business reasons
- to comply with legal process or lawful government requests
- to investigate, prevent, or address fraud, security incidents, or unlawful conduct
- to enforce the Terms of Service or protect users, Quadsale, or the public
- in connection with a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable law
6. Campus Visibility, Public Previews, and Internal Access
What same-campus users can see
- your display name and avatar
- your graduation year, if you choose to provide it
- the contact methods you choose to share through the Service
- your active listings and listing details within the campus marketplace
Your full account email address is not displayed to ordinary users unless you choose to share it as one of your contact methods.
Limited public listing metadata
Full listing detail is intended for signed-in users within the relevant campus experience, but active listings may also generate limited public metadata so links and previews work. That metadata can include a title, category, condition, generic description, and preview image. It does not include your chosen contact methods or your full email address.
Internal access and campus controls
- Campus moderators are generally limited to the campuses they are assigned to moderate.
- Quadsale administrators, support personnel, and legal or safety reviewers may access information across campuses when reasonably necessary for operations, abuse review, dispute handling, fraud prevention, legal compliance, or incident response.
As a result, Quadsale is campus-scoped from a user-facing marketplace perspective, but not every internal access path is limited to same-campus visibility.
8. Service Communications and Optional Marketing
We currently use the Service primarily to send transactional or operational messages, such as verification emails, password resets, listing-status notifications, safety notices, and important account or policy updates.
If Quadsale later introduces optional marketing communications, we will update this Policy and provide any consent and unsubscribe mechanisms required by law. Until then, the Service should not be understood to promise a live marketing-preferences center in account settings.
9. Data Retention
We retain different categories of information for different periods.
- Account and profile data: generally while your account is active. If you delete your account, we deactivate the account and replace directly identifying profile fields in the primary application database with deleted-user values rather than instantly wiping every related record.
- Session records: until logout, revocation, or the end of the session lifetime, which is generally up to 30 days.
- Email-verification tokens: generally up to 24 hours.
- Password-reset tokens: generally up to 1 hour.
- Listings and uploaded images: while the listing is active and for a reasonable period afterward for backups, abuse review, legal compliance, and dispute handling. Deleted or removed listings may remain in deleted or archived form in system records.
- Support communications, campus requests, reports, moderation records, audit logs, and fraud or security records: as long as reasonably needed to investigate issues, enforce rules, protect users, and satisfy legal obligations.
- Analytics data: according to the settings and retention periods of the analytics tool in use, subject to your consent choices.
- Backups and cached copies: until they are rotated out, overwritten, or expire under our backup or infrastructure lifecycle.
We do not guarantee immediate deletion from every backup, log, or archive. If we need to retain information for legal claims, safety investigations, fraud prevention, or compliance, we may keep it for longer.
10. Security
We use administrative, technical, and organizational safeguards designed to protect personal information. These measures include HTTPS or TLS in transit, bcrypt-based password hashing, role-based access controls, rate limiting and account-lockout controls, and bot protection on protected account flows.
No system is perfectly secure, and we cannot guarantee absolute security. You should also protect your own credentials and use caution when sharing contact information or meeting other users offline.
11. Your Choices and Privacy Rights
Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of certain personal information, to appeal certain decisions, or to opt out of specific types of processing.
- Access and correction: you may review and update parts of your profile in the Service, and you may contact us for additional access or correction requests.
- Deletion: you may request account deletion through the Service or by contacting us.
- Portability: where applicable, you may request a portable copy of information you provided to us.
- Cookie and analytics choices: you can manage non-essential analytics choices through the cookie banner and browser controls.
- Appeals: if applicable law gives you an appeal right and we deny a privacy request, you may appeal by replying to our decision or emailing us within 30 days.
To protect accounts and other users, we may need to verify your identity before acting on a request. We typically do this by matching the request to your account email and may ask for additional information if needed.
Authorized agents may submit requests on your behalf, but we may require written authorization, proof of agency, and verification from you directly.
12. Sale, Sharing, Targeted Advertising, and Direct Marketing
Quadsale does not sell your personal information for money, and we do not disclose your personal information to third parties for their own independent direct-marketing purposes.
We do, however, use the Whop advertising pixel described in Section 7 to measure and attribute the performance of our own advertising. Because that technology can disclose identifiers and online-activity information to an advertising partner for cross-context behavioral advertising, it may be considered a “sale” or “sharing” of personal information under some U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
You can opt out of this activity at any time by declining non-essential technologies in the cookie banner, by using the “Do Not Sell or Share My Personal Information” control in Section 13, or by enabling a Global Privacy Control (GPC) signal in your browser, which we honor automatically. If you opt out, the advertising pixel is not loaded.
We also disclose personal information to service providers, safety reviewers, and in the other circumstances described in this Policy. If these practices materially change, we will update this Policy and provide any additional notice or choices required by law.
13. California Privacy Rights (CCPA/CPRA)
This section applies to California residents and supplements the rest of this Policy. It describes your rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA/CPRA”).
Categories of personal information we collect
In the last 12 months, we may have collected the following statutory categories:
- Identifiers, such as name, school-issued email address, IP address, and device or online identifiers
- Customer records, such as your password (stored in hashed form) and the contact methods you choose to share
- Commercial information, such as listings you post and items you browse
- Internet or network activity, such as pages viewed, searches, interaction events, and advertising-pixel events
- Geolocation data, limited to coarse location inferred from your IP address
- Visual information, such as images you upload to listings or a profile avatar
- Inferences drawn from the above to operate and improve the Service
- Sensitive personal information, limited to account log-in credentials; we do not use sensitive personal information to infer characteristics about you
Sources and purposes
We collect this information from you, from your device and browser, and from service providers and technology partners acting for us. We use it for the business and commercial purposes described in Sections 2 and 4, including operating the Service, security and fraud prevention, and measuring our advertising.
Disclosure, “selling,” and “sharing”
We disclose the categories above to the service providers and other recipients described in Section 5 for business purposes. We do not sell your personal information for money. As explained in Sections 7 and 12, our use of the Whop advertising pixel may be treated as “selling” or “sharing” of Identifiers and Internet or network activity for cross-context behavioral advertising under the CCPA/CPRA. We do not knowingly sell or share the personal information of consumers we know to be under 16, and the Service is intended only for adults 18 and older.
Your California rights
- Right to know and access the categories and specific pieces of personal information we have collected about you
- Right to delete personal information we collected from you, subject to legal exceptions
- Right to correct inaccurate personal information
- Right to opt out of the “sale” or “sharing” of your personal information
- Right to limit the use and disclosure of sensitive personal information
- Right to non-discrimination for exercising your rights
Opt out of the sale or sharing of your personal information
You can opt out in any of the following ways. Each takes effect immediately for this browser, and opting out stops the advertising pixel from loading.
- Decline non-essential technologies in the cookie banner.
- Use the control below at any time.
- Enable a Global Privacy Control (GPC) signal in a supported browser or extension; we treat GPC as a valid opt-out request and honor it automatically.
Your current choice
Non-essential advertising and analytics technologies are ON by default. You can opt out at any time using the button below.
How to exercise your other rights
To exercise your right to know, delete, correct, or limit sensitive personal information, email us at [email protected]. To protect your account, we will take reasonable steps to verify your identity, typically by matching your request to your account email. You may use an authorized agent, subject to written authorization and verification. We aim to respond within 45 days and may extend by another 45 days when permitted, with notice. If we deny your request, you may appeal by replying to our decision.
Shine the Light
California’s “Shine the Light” law (Civil Code § 1798.83) lets California residents request information about disclosures of personal information to third parties for those third parties’ own direct-marketing purposes. We do not disclose personal information to third parties for their own direct marketing.
Notice of financial incentive
We do not offer financial incentives or price or service differences in exchange for the retention, sale, or sharing of personal information.
14. Children's Privacy
The Service is not intended for children under 18. If we learn we collected personal information from someone under 18 in a manner that should not have occurred, we will take reasonable steps to delete or de-identify the information.
15. International Transfers
Quadsale is intended primarily for use in the United States. Personal information may be processed in the United States or other countries where our service providers operate. Those countries may have data-protection laws that differ from those where you live.
16. Changes and Contact Information
We may update this Policy from time to time. If we make material changes, we will post the revised Policy, update the “Last updated” date, and may provide additional notice when appropriate.
Quadsale App
Privacy requests: [email protected]
General support: [email protected]
We aim to respond within the time required by applicable law. If no specific legal deadline applies, we will respond within a reasonable time.