Privacy Policy

This Privacy Policy describes how Open Market ("we," "us," or "our") collects, uses, and protects information when you use openmkt.app ("the Service"). Because Open Market is built on the AT Protocol, most of your data — including your listings — lives on your own Personal Data Server (PDS), not ours.

2.1 Identity & Authentication

When you sign in, you are redirected to your PDS's OAuth flow. We never receive or store your password. Upon successful authentication, we receive your Atmosphere handle, DID (Decentralized Identifier), display name, and avatar URL. OAuth tokens are stored in your browser's IndexedDB — not on our servers.

2.2 Listing & Storefront Content

Listings you create through Open Market are published as public ATProto records to your PDS. We index those records to power the marketplace. This content is publicly accessible on the AT Protocol network regardless of Open Market.

2.3 Usage Analytics

We use Google Analytics (GA4) to understand how the Service is used. This includes page views, listing views, interest interactions, and listing creation events. Analytics data is aggregated and does not identify you personally, but Google's data collection is governed by the Google Privacy Policy. You can opt out using the Google Analytics Opt-out Browser Add-on.

2.4 Support Communications

If you contact us by email, we retain that correspondence to respond to and resolve your request.

Your listing content is stored on the AT Protocol network via your own PDS — not on our infrastructure. Removing a listing from Open Market de-indexes it from our platform, but managing the underlying ATProto record is done through your Atmosphere account.

Session tokensare stored in your browser's IndexedDB and are never transmitted to or held by our servers beyond what is required for the OAuth handshake.

Operational data (analytics, support logs) is stored on secure servers with encryption in transit (HTTPS/TLS). Access is limited to those who need it to operate the Service.

We aim to delete inactive account and support data within a reasonable period after it is no longer needed for its stated purpose.

We use essential cookies and browser storage to maintain your session. We do not use advertising or cross-site tracking cookies.

Google Analytics sets its own cookies for usage measurement. These are analytics-only and are not used for advertising targeting.

Open Market is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

Your data may be processed in countries other than your own. Where required, we rely on appropriate legal mechanisms for international transfers, including standard contractual clauses or adequacy decisions by relevant authorities.

For users in the European Union, our legal bases for processing are:

We may update this Privacy Policy from time to time. For material changes, we will post a notice on the platform and announce the update via our Bluesky account at least 30 days before they take effect. The "Effective date" at the top of this page will always reflect the current version.

For privacy-related inquiries or data requests, contact us at support@openmkt.app. We aim to respond within 30 days.

If you are in the EU and have unresolved concerns, you have the right to lodge a complaint with your local data protection supervisory authority.