Privacy policy

What we store

• Your Dibbid ID and a username you choose.
• Optionally, a name your friends know you by — revealed only when an offer is accepted.
• Optionally, an email address, used only for account recovery.
• Hashed password or PIN and a hashed recovery phrase. We can never read either.
• Your listings: titles, descriptions, prices, photos, deadlines and collections.
• Your dibs and bids, and notifications sent to you.
• Anything you post to the feedback forum.
• An anonymous usage log: that an item was listed, dibsed, accepted or collected, and for how much — with no names or free text.

What we never store

No phone numbers, addresses, payment details or real names. No advertising or third-party tracking cookies. No browsing profile — the "collections you've opened" list lives on your own device, not on our servers.

Why, and on what basis

Account and listing data is processed to perform the service you asked for (contract). The anonymous usage log and security logging rest on our legitimate interest in running and improving a safe platform; it cannot be traced back to you by other users. An email address is optional and given by consent, which you can withdraw by removing it.

Who sees what

People with your collection link see the items, never who else is interested. Listers see offers without identities until they accept one; only then do the two of you see each other's chosen names. Feedback posts are shown to everyone without any author. Site administrators can see accounts and moderate feedback, including its author.

How long we keep things

Listings are deleted as soon as both sides confirm a handover. Anything still on the platform — listings, collections, offers and notifications — is destroyed six months after it was created. Accounts inactive for 90 days are purged with everything they own.

When a handover completes we keep a transaction record: the two account IDs involved, the item title, code and category, the amount agreed and the dates. EU commercial and tax record-keeping rules require these to be retained, so they are kept for ten years and then deleted permanently. They are visible only to site administrators, and are not used for profiling, marketing or anything else. Because this is a legal obligation, a transaction record survives an erasure request; the rest of your account does not.

Anonymous usage records — that an item was listed or dibsed, and for how much, with no names or free text — are kept for six months and then deleted.

Staying safe

Dibbid never asks for payment or personal details. Never share bank or card details, your address, phone number, passwords or recovery phrase with anyone here — see staying safe for how to spot a phishing attempt.

Your rights

You can access, correct, export and erase your data. In Settings you'll find "Download my data" (a full JSON export) and "Delete my account", which removes the account and everything it owns immediately and irreversibly. You may also complain to your local data protection authority.

Advertising

Dibbid is free, and advertising is what keeps it running. We use ethical advertising only: adverts are not targeted at you, your data is never sold, shared or used to build a profile, and no tracking or advertising cookies are set. What you list, dibs or browse never influences what you are shown.

Cookies

Dibbid sets only what is strictly necessary to keep you signed in, plus local storage on your own device for your recently opened collections. No analytics or advertising cookies, so no consent banner is required.

Processors and security

Data is held in our managed cloud database and file storage, encrypted in transit and at rest, with row-level access rules so accounts cannot read each other's data. Photos live in a private bucket reachable only through short-lived signed links.