Privacy Policy
Last updated October 30, 2026.
What we collect
Little Free Pile collects only what is necessary to provide the service:
- A display name you choose at sign-up (you can change it later)
- Your email address, which is how you sign in and how we reach you
- Passkey credentials if you add one (public keys only)
- Listings you post, claims you make, and messages you send
- Images you upload for listings and, if you choose, a profile picture
- A map location, if you set one on your profile or a listing. It is stored as coordinates and used only for distance and "near you" filters. Other members see your zip code on your listing cards and an offset pin on the map, never your exact spot.
Authentication
You sign in with a one-time link we email you, or with a passkey (WebAuthn/FIDO2) if you add one. No passwords are stored. Your biometric data never leaves your device; for a passkey we only receive a cryptographic public key.
Services that touch your data
The site runs on our own server. A small number of outside services carry traffic or messages for it:
- Cloudflare sits in front of the site. Every request passes through it, so it sees your IP address and the usual request details, and it filters abusive traffic. We also use it for anonymous traffic statistics (see below).
- Resend delivers our email. It handles the address and content of every message we send you, including sign-in links.
- Browser push services (Apple, Google or Mozilla, depending on your browser) deliver push notifications if you turn them on. They see the notification text and an identifier for your browser, nothing about your account.
None of these services is given your data for its own purposes. We use no advertising networks and sell nothing.
Traffic statistics and security signals
We collect anonymous, aggregate traffic statistics and security signals through Cloudflare to keep the site running and to spot abuse: how many visits a page gets, which countries and device types they come from, and which addresses are hammering the site. These are not used for advertising, not sold, and not tied to your account. The statistics are cookieless; Cloudflare may set a short-lived security cookie while it checks that a visitor is not a bot.
Data storage
All account data is stored on our self-hosted server. Your data is not shared with or sold to anyone, and there is no third-party advertising or tracking.
Data deletion
You can delete your account yourself from the Security page, or ask us to by opening a ticket on the Contact page. When your account is deleted, all associated data (listings, images, claims, messages you sent, profile) is permanently removed; items you already picked up stay recorded for the lister with your name replaced by "[deleted user]".
Cookies
- An authentication cookie keeps you signed in. It expires after a year of inactivity (30 days for admin accounts).
- A small cookie remembers which accounts have signed in on this device, so the sign-in page can offer the right passkey. It holds no secrets.
- A short-lived session cookie carries your invitation code and passkey challenge while you sign in.
- Cloudflare may set a security cookie while it checks for bots, as described above.
No advertising or cross-site tracking cookies are used.
Contact
Questions about this policy? Open a ticket on the Contact page.
