Privacy policy

Last updated 25 August 2026.

Who we are

Buy Stuff Direct runs this marketplace and is the data controller for the information described below. If you want to reach us about anything on this page, use the details on our contact page.

What we hold, and why

Your account

Your name, email address, and — if you give one — a phone number and profile photograph, along with your country, preferred language and preferred currency. We need these to run your account, show your ads to buyers, and let you sign back in. We keep them while your account exists.

Your ads and messages

The content of your adverts, including photographs and the location you give. Private conversations between buyers and sellers. Public questions and answers posted under an advert. Ads and public comments are visible to everyone; private messages are visible to the two people in the conversation and, where a report is being investigated, to our moderators.

Photographs are stripped of their metadata before publication, including any GPS coordinates your camera recorded, and the original file is deleted. What is published is a re-encoded copy.

How the site is used

When an advert is viewed, or a phone number or email address is revealed, we record the event so the seller can see how their ad is performing. We do not store your IP address against those events. We store a one-way hash of it, which lets us count one visitor once without being able to work out who that visitor was. We keep the referring website's hostname, not the full address it linked from.

Referrals and affiliate links

If you arrive through a referral or affiliate link, we record the click so the right person is credited if you later buy something. That record holds a hashed address, your browser's user-agent string, and the hostname that referred you — again, not your address in the clear.

Payments

We record what you bought, when, for how much, and the reference the payment provider gave us. We never see or store your card details. Those go directly to PayPal. If you pay in cryptocurrency, we store the payment address and the amount expected, which are public on the relevant blockchain by design. Payment records are kept for as long as tax and accounting law requires, which is longer than your account may last.

Cookies

We use a small number of cookies, described in full on our cookie page. One of them keeps you signed in and cannot be turned off without breaking the site. The rest exist to credit referrals and affiliates, and are not necessary for the site to work.

Those non-essential cookies are not set unless you agree to them. We ask once, on your first visit, and accepting and declining are offered the same way. You can change your mind whenever you like from the cookie page, and declining also deletes any that were already set.

Who else sees your data

• PayPal — when you pay by card or PayPal balance.
• Google Translate — if you ask for an advert to be translated, its title and description are sent to Google to be translated. Nothing else about you is sent.
• Blockchain explorers — to confirm a cryptocurrency payment has arrived, we query a public block explorer for the payment address.
• Our hosting and email providers — who process data on our instructions in order to run the service.

We do not sell your personal data, and we do not share it for advertising.

Your rights

If you are in the UK or the European Economic Area, you have the right to get a copy of what we hold, to have mistakes corrected, to have your data deleted, to object to some uses of it, and to complain to your national data protection authority.

Two of those you can do yourself, immediately, from your data page: download everything we hold about you, or close your account. For anything else — a correction, an objection — write to us and we will action it within the time the law allows.

Closing an account removes your profile details, your adverts and their photographs, your comments, the messages you sent, your saved searches and your favourites. Two things stay, and it is worth being plain about them: records of payments already made, because tax law requires us to keep them, and messages other people sent you, which are their record of what they were told rather than yours to erase. Neither still identifies you afterwards.

Changes

If we change how any of this works, this page changes with it, and the date at the top changes too.