Privacy Policy

This Privacy Policy explains what information GoodStand collects, how we use it, and the choices you have. GoodStand is a service operated by an individual sole proprietor in the State of Washington ("GoodStand," "we," "us," or "our"). It applies to the GoodStand website, the stand storefronts it hosts, and related services (together, the "Service").

1. The short version

• We collect the minimum we need to run the Service, and we say plainly what it is below.
• We do not sell personal information. Ever.
• We do not run advertising networks or ad tracking.
• Payment for goods goes between the buyer and the stand owner's own payment provider. GoodStand is not in the flow of funds and does not receive or store payment card numbers.

Your use of the Service is also governed by our Terms of Service.

2. Information you provide

If you run a stand (a seller):

• Account information: your name, email address, and password, and, if you sign in with Google, your Google name and profile picture.
• Your stand's content: item names, descriptions, prices, photos, about text, branding and design choices, notification preferences, and other content you publish.
• Payment setup: when you connect Square, Stripe, PayPal, or Venmo, the credentials those providers issue are stored encrypted at rest on our servers.
• Forwarded Venmo receipts: Venmo has no way to tell a website that it was paid, so if you turn on Venmo payment matching, you set up forwarding that delivers the payment notification emails Venmo already sends you to a private address we issue you. We read each forwarded receipt for the amount, the note, and the name Venmo shows for the payer, and use them only to match a payment to an order. This is off unless you turn it on, and you can turn it off at any time. We never receive your Venmo password or your Venmo account access.
• Anything you send us in emails or support requests.

If you buy from a stand (a buyer):

• Order information: the items, quantities, total, and tip for each order.
• Your name and phone number, if you choose to provide them at checkout (they help the stand owner coordinate pickup).
• Your email address when you place a pre-order or custom order.
• Payment details: these go directly to the stand owner's payment provider (Square, Stripe, PayPal, or Venmo). They do not pass through GoodStand and we never see or store your card number.
• If you pay a stand with Venmo and that stand has turned on Venmo payment matching, the notification Venmo sends the stand owner is also delivered to us. It tells us the amount, the note you typed, and the display name Venmo shows for you. We store that name encrypted and use it only to match your payment to your order. We do not receive your Venmo login, your bank or card details, or anything else from your Venmo account.

3. Information we collect automatically

• Visit analytics. We count visits to each stand's storefront. To do this we record a one-way hash of the IP address and browser type, keyed with a secret and changed daily, so visits can be recognized within a single day but cannot be linked across days or back to a person. We also record the general device class (iPhone, Android, desktop) and, when present, the website that referred the visit. This is done without cookies.
• Cookies. We use only strictly necessary cookies: the ones that keep a signed-in stand admin signed in, that carry a sign-in through a second step such as an authentication code, and that protect sign-in against cross-site request forgery. How many there are may change as the Service changes; what they are for will not. They are not readable by scripts in the page, and the sign-in cookie expires after 7 days. We do not use advertising cookies, tracking pixels, or third-party tracking cookies, and the Service has no consent banner because strictly necessary cookies do not require one.
• Server logs. Our hosting provider keeps standard server logs (such as IP address, browser, and pages requested) for security and operating purposes.

4. How we use information

We use information to:

• Provide, operate, maintain, and improve the Service.
• Keep accounts and sessions secure, prevent abuse and fraud, and enforce our Terms of Service.
• Send transactional messages, such as order alerts, signup confirmations, and password reset emails.
• Build aggregate analytics about how the Service and individual stands are used, and retain that analytical data to improve the platform. This analytics data is aggregated and does not identify individuals.
• Meet legal and record keeping obligations.

5. How we share information

• Service providers. We use Vercel for hosting and photo storage, Neon for our database, and Resend for sending email. Each has access only to what it needs to provide its service and is bound by its own privacy and security commitments.
• Cloudflare. Cloudflare provides the DNS that gives each stand a web address, and, for stands using Venmo payment matching, the email routing that carries forwarded Venmo receipts to us. Those receipts pass through Cloudflare on the way to our servers.
• Purelymail. Purelymail hosts the mailboxes behind our published contact addresses. Anything you email us — a support question, a privacy request, a copyright notice — is stored there.
• Payment providers. Square, Stripe, PayPal, and Venmo receive the information needed to process payments, as part of the flows you set up. Their own privacy policies apply to the data they hold.
• Google. Only if you choose to sign in with Google, Google processes your sign-in and shares your name, email address, and profile picture with us.
• Weather lookups. We send a stand's general location coordinates to Open-Meteo, a weather service, to annotate sales charts. No account or key is used.
• Where required. We may disclose information to comply with the law, to respond to legal process, to enforce our Terms of Service, or to protect the rights, property, or safety of GoodStand, our users, or others.
• Business transfers. If GoodStand or its assets are sold or merged, information may transfer as part of that transaction, subject to this policy.
• We never sell personal information, and we do not share it with advertisers.

6. Analytics and retention

We retain analytical data about Service usage to improve the platform, as described in Section 4. Visit analytics are hashed and day-scoped as described in Section 3 and cannot be used to identify or track a person over time.

We keep other information for as long as needed to provide the Service and for as long as the law requires. Order and financial records may be kept for as long as needed for tax, accounting, and record keeping purposes. If you ask us to delete information, we will honor the request unless we are required to keep it.

7. Security

We use reasonable technical and organizational measures to protect information, including encryption in transit, encryption at rest for payment credentials, and one-way hashing or encryption for customer identifiers. Passwords are stored only as a salted one-way hash: we cannot read your password, which means we cannot tell it to you, to anyone who asks us for it, or to anyone who breaks into our database.

No method of transmission or storage is 100 percent secure, and we cannot guarantee absolute security.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. You must be at least 18 to create or run a stand.

9. Your choices and rights

• You can review, correct, update, or delete information in your account, or contact us to ask us to do it.
• You can close your account at any time.
• You can opt out of non-essential emails using the instructions in the email.
• Residents of certain US states, including California, may have additional rights, such as the right to know what personal information we hold, to access it, to correct it, and to request deletion. We do not sell personal information and we will not discriminate against you for exercising these rights. To make a request, email privacy@goodstand.us, or use the address in Section 12.

10. International users

GoodStand is operated from the United States, and information is stored on servers in the United States. If you use the Service from elsewhere, you understand that your information will be transferred to, stored, and processed in the United States, where privacy laws may differ.

11. Changes to this policy

We may update this policy from time to time. When we do, we will post the new version here and update the effective date. If the changes are material, we will make a reasonable effort to tell you.

12. Contact

Questions, requests, or concerns about this policy or your information can be sent to: hello@goodstand.us