Privacy (short version)

• No accounts, no tracking cookies, no ads. We count page views with Vercel Web Analytics, which uses no cookies and doesn't identify you; we send only the page path (never search text or other query parameters), plus the referrer, country and device type it derives.
• We also keep our own cookieless visit count: per day, the number of page views by page type and the number of unique visitors. Visitors are counted with a one-way hash of your IP address and browser user agent under a salt that changes every day and isn't stored, and the counts are deleted within a day or two, so visits can't be linked across days. We never store your IP address or user agent, and bots and our own test traffic aren't counted.
• If you post a need, we store its text, parsed fields and time. Don't include names, addresses or contact details. Need text is deleted after 30 days; hidden needs too.
• For rate limiting and abuse reports we keep a salted hash of your IP address, not the IP itself, and delete it after 30 days.
• To stop abusive lowball haggling we use a salted hash of your IP address together with the seller you countered, on the basis of our legitimate interest in preventing abuse, and keep it for 24 hours at most.
• Developer sandbox (/api/sandbox/mcp): we count, per day, which tools were called, thread events (request, offer, counter, accept, decline, handoff), the client name your MCP app reports (for example "Cursor") and a salted hash of your IP address and browser/app user agent that changes every day. With a database, sandbox threads (the full thread, including what you type as the item) are stored for up to 1 day and then deleted by a daily scheduled job; without one they live in memory for up to 30 minutes. Don't include personal data. We don't store your IP or user agent. Daily hashes are deleted after 30 days; the remaining counts contain no personal data. Sandbox deals are with fictional Demo sellers only.
• Our host (Vercel) processes standard request logs for security for a short period.
• We don't sell or share data. Delete your need anytime with its delete token, or email contact@haggleboard.com.
• You have rights under GDPR (access, deletion, objection) and can complain to your data protection authority (in Ireland, the DPC).

Controller: the HaggleBoard project, contact@haggleboard.com. Last updated: 24 October 2026.