In effect since September 3, 2026. Marvel Mirror LLC, operator of YardBooth · 2501 Chatham Rd #5694, Springfield, IL 62704 · hello@yardbooth.com
The short version
We keep the information needed to publish stores, deliver and track offers, protect buyer and seller access, confirm YardBooth payments, provide support, prevent abuse, and understand whether the site works.
We do not sell or rent personal information. We do not run advertising or session replay. YardBooth does not receive card numbers for the $9 store fee or for payments between buyers and sellers.
Information sellers give us
When a seller creates and runs a store, we receive the seller’s name, email, mobile number, store name and description, general location, agreement choices, verification status, listings, photos, prices, item status, chosen outside payment methods, and optional payment or pickup note.
We also keep store dates and status, listing and offer activity, private sales entries, support notes, moderation decisions, notifications, and an audit history. If a sale is corrected or an item is reopened, the earlier sales entry may be kept with the reason instead of being silently erased.
Listing photos and screening
When a seller uploads a listing photo, Cloudflare decodes and rewrites it into smaller web versions for phones, larger screens, and link previews. That rewrite removes embedded metadata such as camera and location details. YardBooth stores the rewritten versions rather than the original upload.
YardBooth may use automated text rules and Cloudflare image classification to identify a prohibited or higher-risk listing. A listing may be rejected or held for authorized manual review. Automated screening can make mistakes; sellers may contact us about a decision, and community reports remain available after launch.
Information buyers and reporters give us
An offer includes the selected items and their asking prices, offered amount, buyer name, email, phone, preferred pickup time, message, agreement choices, status, counteroffers, deadlines, holds, and related notifications.
YardBooth first keeps each offer in a short-lived server-side draft. A first offer stays there while the email and phone are verified; an eligible current buyer session can submit a later draft immediately. When an offer is submitted, we keep the item title, asking price, and a private copy of its thumbnail so the buyer’s offer record remains understandable if the public listing changes or is removed.
If a buyer asks to be notified about a held item, we keep the listing, verified buyer identity and mobile-number pair, request status, dates, and related email record. The request sends one service email if the hold is released before the sale ends. It does not reserve the item.
A listing report may include the listing, reason, explanation, reporter name and email, supporting link, review status, private notes, decision, and audit history.
What is public and what is shared
After launch and once the store has an approved active listing, the store’s name, description, town or city, state, county, configured pickup-time choices, approved listings, rewritten photos, prices, and availability appear publicly. A launched store with no approved active listing remains unavailable in public browsing, at its direct store link, through listing-image routes, and in YardBooth search indexes. Draft or review-held listings are not public. A seller’s legal name, email, mobile number, exact pickup address, private notes, and sales total are not public. Sellers should not place a home address, private phone number, account number, or other sensitive information in public listing text.
Public pages may be viewed, copied, shared, or indexed by other people and search services. Removing a listing from YardBooth cannot remove a copy that someone else already made.
While an offer is pending, the seller sees masked buyer contact details. Only after acceptance, the seller receives the buyer’s full contact details and the buyer receives a saved handoff with the selected pickup window, exact private pickup location and instructions, verified seller contact, payment options and instructions, and hold deadline. This sharing is only for the offer, payment, and pickup. Later seller-setting changes do not rewrite that accepted-offer handoff.
Listing reports and reporter contact details are not public. Authorized YardBooth administrators may review private seller, buyer, report, payment, and activity information to operate the service, help users, enforce policies, and protect people and the site.
Email, phone, and account access
Browsing public pages does not require a buyer identity or buyer session. Supabase handles one-time email codes for seller access and My Offers. Supabase works with Twilio Verify for separate mobile-number codes. YardBooth uses the results to confirm control of the exact email and phone connected to a store or offer. We do not ask buyers or sellers to create a YardBooth password.
A buyer’s first offer requires both email and phone verification. Opening My Offers without a current buyer session also requires both checks. During a current session, a buyer may submit later offers without new codes only when the offer uses that session’s exact verified email and mobile number. A changed number requires a new text code.
Requesting or cancelling a held-item availability alert also requires that buyer session. If there is no current session, the buyer completes the same separate email and mobile checks and returns to My Offers to finish the request.
Verification providers process the contact details, code requests, delivery and verification results, account identifiers, session information, and ordinary network or device details needed to deliver the message, prevent abuse, and protect access. YardBooth does not keep the plain-text codes.
Agreement records
When a seller or buyer accepts YardBooth’s agreements, we keep the name and contact details they gave us, related store or offer, date and time, exact acceptance wording, policy names and versions, a copy of the policy text, and its SHA-256 fingerprint. A verified seller or buyer record also includes the sign-in provider and verified account identifier. The record may note whether the anti-bot check succeeded and include a request trace and site address; it does not include the raw IP address.
That agreement record is separate from ordinary hosting and security logs, which may contain an IP address and the request details described below.
Agreement records cannot be edited or deleted through the YardBooth application. They are available only to authorized administrators and may be kept after a store or offer ends so we can prove what was agreed to and handle security, legal, or payment questions.
QuickBooks payments
QuickBooks hosts the $9 invoice and payment page. YardBooth sends Intuit the seller’s name and email, a YardBooth store reference, the invoice purpose, and amount. Card details go to QuickBooks, not YardBooth.
We keep the invoice and payment references, amount, currency, balance, status, dates, store period, verification results, and history needed to apply a payment once, handle a reversal, and answer billing questions. Credentials used to connect YardBooth to QuickBooks are encrypted before storage. QuickBooks sends payment updates, and YardBooth also checks QuickBooks directly in case an update is delayed or missed.
Payments for listed items happen outside YardBooth. We may share the seller’s chosen payment methods after an offer is accepted, but we do not receive payment credentials, hold the money, or confirm that the buyer paid.
Website use and analytics
When someone visits or uses YardBooth, we and Cloudflare may process the page address, time, IP address, browser and device information, referring page, request and response details, request identifiers, search or filter request, and security or Turnstile signals. We use this information to deliver the site, diagnose errors, prevent abuse, and protect YardBooth and its users.
YardBooth uses Google Analytics 4 by default unless it is turned off in that browser or Global Privacy Control is enabled. For public listings, it may receive the public item ID, title, category, asking price, list or button location, and listing-specific page and action information. A title that looks like contact, payment, website, or street-address information is replaced before it is sent. Google may also receive a random browser identifier, approximate location, and ordinary browser, device, and network information.
We do not intentionally send listing descriptions, store names, names, email addresses, phone numbers, form-field contents, buyer messages, store IDs, exact pickup details, offer amounts, payment details, keystrokes, pointer paths, or session recordings to analytics. Advertising features and Google Signals are off.
Private offer pages at /offer, My Offers, and buyer verification screens do not load analytics. The permanent Privacy button lets you turn analytics off or back on elsewhere. The choice applies to that browser. See Cookies and analytics for the exact cookies, measurements, and controls.
Private offer access and My Offers
Offer emails open through My Offers. The URL may name the offer to open, but the URL itself does not authorize access. My Offers requires a verified buyer session for that offer’s exact email and mobile-number pair before YardBooth shows the offer, its history, or any accepted handoff. Forwarding the URL alone does not forward access.
My Offers lists active and closed offers tied to that exact pair, plus current availability-alert requests. YardBooth sets a random, secure, HttpOnly buyer cookie and stores only its one-way fingerprint. The cookie lasts up to seven days unless the buyer signs out, it is revoked, or browser data is cleared. Provider credentials used during verification are not installed as the YardBooth buyer cookie.
Why we use information
- To create private drafts and publish, manage, renew, archive, and restore launched stores.
- To deliver offers, counteroffers, holds, contact details, requested availability alerts, and other service notifications.
- To verify contact channels, protect access, prevent fraud and abuse, and investigate reports.
- To create and confirm YardBooth invoices, apply payments and reversals, and keep business records.
- To provide support, enforce our agreements, comply with law, and protect legal rights.
- To measure and improve the site when analytics is on.
Who helps us
- Cloudflare hosts YardBooth, stores marketplace data and rewritten images, processes image variants and automated screening, rate-limits public forms, and protects the administrator area.
- Supabase and Twilio Verify handle seller and buyer email and mobile-number verification.
- Dynu Full Service Email sends and receives YardBooth email, including seller sign-in messages.
- QuickBooks / Intuit creates and hosts YardBooth invoices and handles their payment status.
- Google Analytics processes allowed site-use information when analytics is on.
- Email and mobile providers deliver messages to the addresses and numbers involved.
These providers receive only the information needed for their work and handle it under their own terms and privacy notices. We may also disclose information when required by law, to investigate fraud or a safety threat, to protect legal rights, or as part of a merger, sale, or transfer of the business.
How long we keep information
An unfinished offer draft becomes unusable after about 30 minutes, though its record may remain until routine cleanup for security or troubleshooting. A submitted draft may remain with the offer to prevent duplicate submission and support the offer record. Public stores normally remain open for 30 days. Pending offers normally end after seven days, and accepted offers normally hold items for 48 hours. When a store ends, its listings and images stop appearing publicly. We may keep non-image store, listing, verification, agreement, sales, payment, offer, handoff, report, moderation, notification, and audit records as reasonably needed for business records, security, support, disputes, fraud prevention, and legal obligations.
When a seller deletes a listing or replaces its photos, the superseded rewritten image versions are removed or queued for removal. If a launched store is not renewed, its listing photos become eligible for automatic deletion 90 days after the paid store period ends. If a store is archived before it ever launches, its draft-listing photos instead become eligible 90 days after archive. A store moved back to pending after a payment reversal is retained unless it is later archived. Renewing a launched store, or restoring a never-launched store, before cleanup stops deletion of photos that have not already been removed. When eligible cleanup commits, the listing is retired and its photo references cannot be restored; deletion of queued storage objects may finish on a later retry.
A private offer-thumbnail copy becomes eligible for automatic deletion 90 days after the offer is completed, declined, withdrawn, expired, canceled, or otherwise closed. Active submitted or accepted offers are not eligible. After the thumbnail is removed, My Offers may still keep and show the item title, asking price, offer and counteroffer history, status, pickup choice, and accepted handoff details.
An availability-alert request ends when it is sent, cancelled, expires at the sale end, or the listing otherwise closes. YardBooth may keep the ended alert and its notification record for up to 90 days for delivery, troubleshooting, abuse prevention, and support.
YardBooth checks for eligible photos daily. Automated and administrator-started retention deletion begins November 29, 2026, so photos from stores or offers that closed before this notice receive at least 90 days of notice. An authorized administrator can run the same eligible-only cleanup from the private dashboard after that date. A retry, service interruption, investigation, legal requirement, or security hold may delay technical deletion; the administrator control does not shorten the 90-day period.
Buyer and seller sign-in cookies last no longer than described in Cookies and analytics. Google Analytics cookies expire no later than 90 days under YardBooth’s settings. Google’s user- and event-level retention setting is two months, though aggregated reports may remain longer.
Security
We use reasonable technical and organizational safeguards designed to protect information, including encrypted connections, restricted administrator access, secure HttpOnly buyer and seller cookies, one-way session fingerprints, encrypted QuickBooks connection credentials, and activity records. No online service can promise perfect security.
Your choices
Email hello@yardbooth.com to ask what information we hold about you, correct it, delete it, or close a store. Tell us enough to find the record. We will explain if we must keep something for accounting, fraud prevention, security, a dispute, or another legal reason.
You can turn analytics off from any YardBooth page, cancel an active availability alert in My Offers, stop using the service, and ask us to stop nonessential messages. Security, offer, payment, requested availability, and store-operation messages are part of providing the service you requested.
Children
YardBooth is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. Sellers and buyers who submit offers must be at least 18.
Changes and contact
The effective date changes when this notice changes. A material change applies going forward. Earlier agreement snapshots remain tied to the people who accepted them.
Marvel Mirror LLC · 2501 Chatham Rd #5694, Springfield, IL 62704 · hello@yardbooth.com