Privacy

What this covers

This notice describes what CraneBoard collects when you use thecraneboard.com and the CraneBoard phone app. Write to privacy@thecraneboard.com for a privacy request. Cookie choices are described in the cookie policy.

California Online Privacy Protection Act

This notice is meant to satisfy the conspicuous-policy requirement of the California Online Privacy Protection Act (CalOPPA), Business and Professions Code sections 22575 through 22579. The statute is published at leginfo.legislature.ca.gov.

CraneBoard collects identifiers you give us (name, email, phone), listing content, messages, payment status from Stripe, and the Stripe Identity status and session id described below. You can review and ask to correct account details by writing to privacy@thecraneboard.com. You can ask to delete an account the same way, subject to records we must keep for fraud, tax, or legal process.

Do Not Track and sale or sharing

Browsers can send a Do Not Track signal. There is no industry standard for how a site must respond. CraneBoard does not change its behavior when it receives a Do Not Track signal.

CraneBoard does not sell personal information. Marketing cookies, including the Meta pixel, stay off until you accept them. The footer link Do Not Sell or Share My Personal Information opens that choice and turns marketing off. If your browser sends Global Privacy Control, CraneBoard keeps marketing off. That signal is described at globalprivacycontrol.org.

Identity checks and biometric information

Email and phone confirmation stores the account email, an E.164 phone number, and the times those channels were confirmed. One-time codes are stored only as a hash and are discarded after use or expiry.

Stripe Identity is the identity check for posting. Before a session starts, CraneBoard shows a consent screen. You must agree that Stripe will collect a photo of a government identity document and a selfie. Those images are biometric information. Stripe Identity processes them. CraneBoard does not receive the images, the document number, or the extracted date of birth.

CraneBoard stores only the verification status and the Stripe Identity session id, plus the time you gave consent. The account is allowed to post, and the ID verified badge is shown, only after Stripe sends the identity.verification_session.verified webhook. Returning from the Stripe window does not set that badge.

ID.me is not part of launch. If it is turned on later with IDME_ENABLED, CraneBoard would store an ID.me subject identifier, not a Social Security number. That check does not replace Stripe Identity and does not by itself show ID verified.

Stripe Identity biometric processing

The document photo and the selfie are processed by Stripe Identity to compare the face on the document with the selfie and to check that the document looks genuine. CraneBoard asks Stripe to require a matching selfie. Stripe's own privacy notice describes how long Stripe keeps those images and how to contact Stripe. CraneBoard's copy of the result is the status and the session id.

You can refuse the check. Without a verified result you can still read the boards and the blog. You cannot post. You may ask CraneBoard to delete the status and session id by writing to privacy@thecraneboard.com. Deleting them removes the ID verified badge and the ability to post until a new check is completed. CraneBoard cannot delete images it never stored. That request goes to Stripe.

Cookies and the Meta pixel

Essential cookies remember a sign-in and the cookie choice itself. Analytics and marketing stay off until you accept them in the banner or in Cookie settings.

If the environment variable NEXT_PUBLIC_META_PIXEL_ID is set, and you have accepted marketing cookies, CraneBoard loads the Meta (Facebook) pixel. The pixel can receive a PageView when a page loads, a Lead when you start Stripe Identity, and a Purchase when a listing fee is paid. The Purchase event is sent as 5 US dollars. CraneBoard does not send your name, email, phone, account id, or listing id to the pixel. If the pixel id is not set, the pixel is not loaded.

Details and the Do Not Sell or Share choice are in the cookie policy.

CCPA disclosure

The California Consumer Privacy Act and the California Privacy Rights Act give California residents the right to know, delete, and correct personal information, and the right to opt out of sale or sharing. Use the footer link Do Not Sell or Share My Personal Information to turn marketing off. That is also available from Cookie settings.

Categories collected: identifiers (name, email, phone, account id), commercial information (listing fee status), internet activity on this site (pages you request), and inferences used only for scam moderation of the listing you submitted. Sensitive personal information: the phone number, and, at Stripe rather than on CraneBoard's servers, the document image and selfie.

To make a request, email privacy@thecraneboard.com with the subject CCPA request. We will verify the request with the email on the account. An authorized agent may write for you with proof of authority. You will not be discriminated against for making a request. The Attorney General publishes the law at oag.ca.gov/privacy/ccpa.

Other processors

Supabase hosts the database and authentication. Stripe processes the $5 listing fee and Stripe Identity. xAI may process a chat message or listing text when an API key is configured, and that content is not kept after the request. Vercel hosts the site. Meta receives pixel events only after marketing consent, and only the events described above. Each is used to run the board.