Privacy notice

This explains what Thanet Market keeps about you, why, who sees it, how long we keep it, and what you can do about it. The short version: we keep what we need to run local classifieds safely, we never sell your data, there’s no advertising tracking, and you can download or delete everything from your account page.

Last updated 20 October 2026.

Who we are

Thanet Market is responsible for your personal data (the “controller”). For anything about your data, email privacy@thanet.market.

What we collect

Your account: your name, email address, and, if you add them, your phone number, town and postcode. If you sign in with Google, we receive your name, email and profile picture from Google.
A business account: your trading name, address, phone, email, website and company number, which the law says a trader must show. These appear on your storefront.
Your ads: what you write, your photos, the price and the details for the category. We ask for a postcode to place the ad, but only the town and postcode district (such as CT9) are ever shown. Location data hidden inside photos is removed when you upload them. You can write an ad before signing in: what you type stays in your browser, and photos you add are kept, unseen by anyone else, for 24 hours so the sign-in link we email you can finish the ad.
Messages you send and receive, and anything you share in them: a collection time, a meeting place, or your address if you choose to send it.
Community notices and the Garage Sale Trail: what you post. If you add a garage sale, its address is shown publicly on the trail map until the trail ends; you agree to that when you sign up the sale.
What you save: saved ads, saved searches and alerts, sellers you follow, people you block, and your notification choices.
Landlord checks: your legal name, address and a photo of your ID, if you ask to be a verified landlord.
Reports: what you tell us when you report something, and your email if you give it. If someone reports you, we keep what they said.
Safety and security: your IP address and browser when you sign in, which messages and ads our automatic checks flagged, and the decisions we make.
How the site is used: pages visited, searches (counted, not the words), ads posted and errors, without cookies (see below).

Why we use it, and our legal basis

To run the service you signed up for (contract): your account, posting and showing ads, messages between buyers and sellers, alerts, saved searches, collection times and reminders.
To keep people safe and prevent fraud (legitimate interests, including the “recognised legitimate interests” of preventing crime and safeguarding): checking ads and messages for scam patterns, holding contact details sent by brand-new accounts, landlord checks, acting on reports, and stopping banned people from returning.
To meet our legal duties (legal obligation): under the Online Safety Act 2023 and consumer law, and when the police, Trading Standards or Ofcom lawfully ask for information.
To understand and improve the site (legitimate interests): counting visits and fixing errors, using data that can’t identify you.
Notifications on your phone or computer (consent): only if you turn them on, and you can turn them off at any time.

We don’t send marketing emails, and we never sell or rent your data or use it for advertising.

Automatic checks

Every ad and message goes through automatic checks for things like requests for a deposit, couriers, payment links and prices far below the usual. They flag things for a person to look at. One check acts on its own: a message from an account under a few days old that includes a phone number, email address or link is held until one of our team looks at it, usually within a day. Nothing is removed, and no account is suspended, without a person deciding, and you’re always told why.

Who can see it

Everyone: your ads, your first name, town and when you joined, the badges you’ve earned (such as phone checked or met in person), your community notices, and your storefront if you have a business account.
The person you’re messaging: your messages and anything you choose to share in them.
Our moderators: a small team who handle reports and checks. Staff access needs a second step (an authenticator code), and everything they do is logged.
Our service providers, who process data for us under contract and only on our instructions (below).
The authorities when the law requires it, such as the police, Trading Standards, Ofcom or the National Crime Agency.

Our service providers

Vercel: Runs the website. Servers in the UK and EU, company in the US.
Neon: Our database, in London.
Vercel (Blob storage): Stores the photos on ads and sponsors’ logos, and, in a separate private store, landlord ID photos until they’re checked.
Cloudflare (Turnstile): Checks that the sign-in form is being used by a person, not a bot, using signals from your browser and connection. No account details are sent to it.
Resend: Sends our emails: sign-in links, messages, alerts.
PostHog (EU): Counts visits and reports errors, without cookies (see below).
Anthropic: Only if you tap “Fill it in for me” or use house clearance: the photos you chose are sent to Claude to suggest a title, description and price. They aren’t used to train its models.
Google: Only if you choose to sign in with Google. We also tell Google when a job ad goes up or comes down, so it can list the job; that’s the ad’s address, nothing about you.
Twilio: Sends the text message code when you check your phone number.
Your browser’s push service (Google, Apple or Mozilla): Delivers notifications to your phone or computer, if you turn them on.
OpenStreetMap: Draws the maps on ads and the Garage Sale Trail. Your browser fetches the map pictures from OpenStreetMap, which sees your IP address.

Some of these companies are based in the United States. Where your data leaves the UK, it’s protected by the UK’s approved safeguards for international transfers, such as the UK–US data bridge or the UK’s standard contract terms.

Cookies and visitor counts

We only use cookies the site needs to work, such as keeping you signed in, and there’s no advertising tracking. We count visits and catch errors with PostHog in cookieless mode: it stores nothing on your device and can’t recognise you from one day to the next. When you’re signed in, actions such as posting an ad are linked to a one-way code made from your account, never your name, email or messages. The cookies page lists everything we store on your device.

How long we keep it

Your account and profile: Until you delete your account.
Your ads, live or ended: Until you delete them or your account. Ended ads stay in My listings so you can relist them; sold ads keep a short public page saying they’ve sold.
Ads you started but never posted: 30 days, or 24 hours for an ad written before signing in that the sign-in link never finished (its photos go too).
Messages: The text is cleared 12 months after it was sent, or straight away if either person deletes their account.
A collection address you send in a conversation: Removed from the conversation after 14 days.
A Garage Sale Trail address: Removed the day after the trail ends.
Notifications: 90 days.
Landlord ID photos: Deleted as soon as the check is decided.
Reports and our moderation decisions: Six years, so we can deal with appeals, complaints and repeat abuse. Reports still open are kept until they’re closed.
If an account is banned: A one-way scrambled copy (a hash) of its email address and phone number, for six years, so the same person can’t simply sign up again. Nothing readable is kept.
Sign-in records (IP address and browser): Until you sign out, or 30 days at most. Records used to stop repeated sign-in attempts last a few minutes to a day.
Visitor counts and error reports (PostHog): Up to 12 months. They contain no names, emails or messages.
Short-lived server logs at our hosting provider: Up to 30 days, for security.

When you delete your account, your profile, ads, photos, messages, saved items and notifications are deleted. We keep only the records listed above for reports, moderation decisions and bans.

Your rights

See your data: download everything we hold about you from your account (“Download your data”), or ask us.
Correct it: change your details on your account page, or ask us.
Delete it: delete your account from your account page. We’ll email you a link to confirm.
Take it elsewhere: the download is a standard file (JSON) you can use anywhere.
Object or ask us to limit how we use your data, where we rely on legitimate interests.
Withdraw consent for notifications at any time in your notification settings.

Email privacy@thanet.market for any of these. We’ll reply within a month.

Complaints about how we use your data

If you’re unhappy with how we’ve handled your data, email privacy@thanet.market with “Data complaint” in the subject. We’ll acknowledge it within 30 days, look into it, and tell you what we found and anything we’ve changed. If you’re still not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Under 18s

Thanet Market is for people aged 18 and over. If we learn that an account belongs to someone younger, we’ll close it and delete its data.

Keeping it safe

Everything travels over encrypted connections. Sign-in uses one-time email links or Google, so there are no passwords to steal. Staff need an authenticator code as well as their sign-in, ID photos are kept in a private store and deleted once checked, and the secrets we keep for staff sign-in are encrypted.

Changes

If we change this notice in a way that matters, we’ll tell you by email or on the site before it takes effect. The date at the top shows when it last changed.