Effective: 10 October 2026
1. Introduction
Frippy ("we", "us", "our") is a peer-to-peer marketplace for secondhand fashion, operated by Frippy AU (ABN 51 847 511 301) in Perth, Western Australia.
This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and how we protect it. This policy applies to all users of the Frippy mobile application and frippy.au (together, the "Platform").
We are committed to handling your personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
2. Information We Collect
Information you provide directly:
When you create an account: email address, username, display name, and profile photo. If you sign in with Apple or Google, we may also receive your first and last name from your account.
When you use the Platform: listing details (photos, descriptions, pricing, condition, sizing), chat messages and images, delivery addresses and the contact phone number you give for a delivery, profile information, and reviews and feedback on transactions.
When you make a purchase: your payment information is collected and held by Stripe. We never see your full card number. Our servers do receive and keep, for up to 90 days, the payment notifications Stripe sends us, which include the card brand and the last four digits.
When you verify your identity to sell: identity and banking details are collected by Stripe, not by us, as part of their Know Your Customer (KYC) process. We never see your identity documents or your full account number. Stripe does send us a limited record of where your money goes, being the type of account, the bank name and the last four digits, so we can show you where a payout went, and tell you when Stripe still needs something from you.
Information collected automatically:
When you use the Platform, we collect usage data such as pages viewed, actions taken, the searches you make, device type, operating system, app version, and notification preferences. This data is collected through PostHog, our analytics provider, and is linked to your account while you have one. You can turn this off: see section 3.
We also collect information about how you use the Platform directly in our own systems, such as the listings you view, the listings shown to you in your feed, and the searches you make. This information is stored securely in our database (Supabase), hosted in Sydney, and is used to operate and personalise the Platform.
We also collect error and performance data through Sentry to identify and fix technical issues. While you are signed in, these reports carry your account identifier and username so we can tell whether a crash hit one person or everyone.
When you visit our website: frippy.au is a public website and you can browse it without an account. Our hosting provider records the technical details of each request, including your IP address, the page you asked for, your browser details and the page that sent you to us. We count visits to frippy.au with Vercel Web Analytics, which uses no cookies and never identifies you: it records the page, the referring site, your country and your device type. PostHog adds more detailed usage analytics, but only after you say yes on the banner. If you say no, or you do not answer, PostHog still counts the pages and steps you use, without cookies or local storage and without a profile of you. If you say yes, we may also record how you use item, bag and checkout pages, to fix what trips people up. What you type, your delivery address, your email address and your payment details are hidden, and we never record your account, messages or settings.
When you arrive from an ad or a link with campaign details in its address (such as utm_source), we keep those details, the page you arrived on and the site that sent you in your browser's local storage for up to 90 days. If you then create an account or place an order on frippy.au, we save them with it, so we can tell which ad brought you. If you say no on the banner, we delete them and do not keep them.
When we advertise on Meta or Pinterest, frippy.au also loads a small measurement tag from that platform. The tag tells them that a visit happened and which page it was; on a listing page, which item was viewed and what it costs; on a category page, which items were shown to you; and when you create an account, add an item to your favourites or buy, that you did. We keep the tags off search pages, so the words you search for are never sent to them, and off maternity items and categories. The tags do not receive your name, your email address, or your Frippy account details. The Frippy app uses Meta's tools in the same way. Section 9 explains how to turn ad personalisation off with each platform.
3. How We Use Your Information
We use your personal information to:
Provide and operate the Platform, including processing transactions, generating shipping labels, and facilitating communication between buyers and sellers.
Pre-fill your listing details, when you ask us to or when you have turned on the always-on setting. The photos you add to a listing may be sent to a third-party AI provider, which reads them and suggests a title, category, colours, brand and size for that listing. This happens only when you tap the "Auto-fill from photos" button on a listing, or when you have switched on the always-on setting, "Always auto-fill from photos".
Protect users and the Platform through content moderation, fraud detection, and enforcement of our Terms of Service.
Send you notifications related to your account, transactions, and orders, including push notifications and transactional emails. You can manage all of these in the app settings.
Personalise your experience, including ordering the listings in your home feed based on your activity on the Platform (such as your favourites, the listings you view, and your searches) and the sizes you save in your profile.
Promote Frippy, and measure whether that promotion works, including which ad or link brought you to the website. This includes sending the public details of listings to advertising and shopping platforms, and the measurement events described in sections 2 and 9. We do not use your account details, your messages or your purchase history to target advertising.
Improve the Platform by analysing usage patterns, identifying bugs, and developing new features. You can opt out of usage analytics collected through PostHog in the app settings under Privacy, as Usage Analytics. Turning it off stops analytics linked to you being collected, in the app and on our servers. On frippy.au, a visit may still be counted without cookies and without a profile of you (section 2).
Comply with applicable laws and respond to legal requests.
We will not use your personal information for a purpose materially different from those described here without your consent, unless the Privacy Act allows it.
4. Who We Share Your Information With
We do not sell your personal information to third parties.
We share your information with the following service providers, who process data on our behalf to operate the Platform:
Stripe: payment processing, identity verification, and seller payouts. Stripe collects your card and banking details directly and decides how it handles them as well.
Supabase: database hosting, user authentication, and file storage. Our database is hosted in Sydney.
Vercel: hosting and delivery of our website. Our server functions run in Vercel's Sydney region; pages themselves are cached and served from Vercel's network worldwide, from whichever location is closest to you. Vercel records the technical details of each request, including your IP address, your browser details and the page that sent you to us.
Cloudflare: domain registration and DNS for frippy.au.
Shippo and ShipEngine: shipping label generation and delivery tracking. Your delivery address and the contact phone number on the order are shared with these providers and the relevant carrier to fulfil deliveries.
Expo, Apple and Google: delivery of push notifications to your phone. A push notification travels through Expo's push service and then through Apple or Google to reach your device, and it carries what it needs to show on your lock screen, including, for a new message, the first hundred characters of that message. If you would rather the text of a message never appeared on your lock screen, turn Messages off in Settings under Notifications, or turn off notification previews in your phone's own settings.
Apple and Google: sign-in, if you choose to sign in with your Apple or Google account.
PostHog: usage analytics, linked to your account identifier and username while you have an account.
Sentry: error monitoring and crash reporting, linked to your account identifier and username while you are signed in.
Resend: transactional email delivery.
OpenAI: automated moderation and listing auto-fill. To keep the marketplace safe, we send listing text and photos, chat messages and chat images, and display names, bios and profile photos for automated review. For auto-fill, we send the photos on the listing you asked us to fill. These requests carry the content itself and the link to the photo, which contains your account identifier. They do not carry your name, your email address or your delivery address, and OpenAI does not retain them.
Slack: operational alerts to our own team when something goes wrong with an order, a payment or a delivery. These alerts carry the identifiers of the order or dispute concerned so we can find it.
Meta, Google and Pinterest: advertising and shopping platforms. When we promote items on these platforms, we send them the public details of the listings, plus the product category we file an item under and who it is made for, which the platforms need to file it in their catalogue. Meta and Pinterest also receive measurement events from frippy.au when their tags are running, and Meta receives measurement events from the Frippy app: that an account was created, that a first listing was published, and that an item was viewed, added to a bag, or bought, and for how much. If you said yes to analytics, we also share purchase details with Meta to measure our advertising. This includes your contact and delivery details in hashed form, which turns them into a code Meta can only match against what it already holds, and, for a purchase made on frippy.au, technical details of your browser and device.
We may also share information if required by law, to protect the safety of our users, or to enforce our Terms of Service.
When you transact with another user, certain information is visible to them, including your username, display name, profile photo, and ratings. When you purchase an item, your delivery address is visible to the seller on the shipping label in order to fulfil the delivery.
Listings and seller profiles also have public pages on frippy.au. A listing page can be opened by anyone with the link, without an account, and shows the listing photos, the title, the description, the brand, the size, the condition, the colour, the material, the price and any previous price, when it was posted, and whether it has sold. How many people have liked a listing can show on the cards in our grids. A seller profile page can be opened the same way and shows the username, display name, profile photo, bio, the month the shop opened, how many items have been listed and sold, follower and following counts, seller ratings and reviews, whether the seller is verified, whether the shop is on holiday along with any note left about it, and any social links that have been added. These pages are open to search engines, so they can appear in results on Google and other search engines, and when one of these links is shared in a message or on social media the same details are used to build the preview shown there. When we promote items on advertising and shopping platforms, the same public details are sent to them in a product file.
What is never on a public page: your first name, your city or suburb, your postcode, when you were last online, your email address, your delivery address, your chat messages, your orders, and anything to do with your payment or banking details. In the app, your city and your online status are shown on your profile to other signed-in members unless you switch them off in Settings, under Privacy.
5. Overseas Disclosure
Our database is hosted in Australia, in Sydney, and so are the server functions behind our website. That means the great majority of what you give us, including your profile, your listings, your messages, your addresses and your orders, is stored here.
Some of the service providers we use are located outside of Australia, primarily in the United States. This includes Stripe, Cloudflare, Shippo, ShipEngine, PostHog, Sentry, Resend, OpenAI, Expo, Slack, Apple, Meta Platforms, Google and Pinterest. Supabase and Vercel are United States companies whose platforms and logs are run from there, even though the data they hold for us sits in Sydney.
Two of these are worth spelling out. PostHog stores our analytics data in the United States. And a push notification leaves Australia by design: it travels through Expo and then through Apple or Google to reach your phone.
By using the Platform, you acknowledge that your personal information may be transferred to and stored in countries outside of Australia. We take reasonable steps to ensure that our service providers handle your information in a manner consistent with the Australian Privacy Principles, and where we disclose your information to an overseas recipient we remain accountable for how it is handled.
6. Data Retention
We retain your personal information for as long as your account is active, and for a reasonable period after account deletion to comply with legal obligations, resolve disputes, and enforce our Terms.
Specific retention periods:
Transaction records and order history are retained for 7 years to comply with Australian tax and financial reporting requirements.
Chat messages are retained for the duration of your account. When your account is deleted, your messages are deleted immediately, including from the conversations of the people you were talking to.
Dispute evidence (photos and supporting documents) is deleted 90 days after it was uploaded, once the dispute is closed.
Signals we use to order your feed, being the listings you view, the listings shown to you and your searches, are deleted on a rolling basis, between 30 days and 6 months depending on the signal.
Usage analytics collected through PostHog are linked to your account identifier while your account exists. When you delete your account, we ask PostHog to delete them too.
When you delete your account, your profile, listings and personal details are removed from the Platform. Some information may be retained in our backups for a limited period before being permanently deleted.
When you delete your account, we also keep a minimal internal record of the deletion (your username, email address, account dates and activity counts) for up to 12 months, for fraud prevention, dispute resolution and legal compliance. After 12 months this record is anonymised and can no longer be traced back to you. Payment records held by our payment provider are retained as required by Australian law.
7. Data Security
We take reasonable steps to protect your personal information from unauthorised access, loss, misuse, and disclosure.
Our security measures include encrypted data transmission, secure database hosting with row-level access controls on our database tables, and automated content moderation to prevent misuse of the Platform.
Your payment information is handled entirely by Stripe, which is PCI DSS Level 1 certified (the highest level of payment security).
While we take security seriously, no system is completely secure. We cannot guarantee the absolute security of your information.
In the event of a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act.
8. Your Rights
Under the Australian Privacy Principles, you have the right to:
Deal with us under a pseudonym. Your username is the name other people see on Frippy, and it does not have to be your real name. We do need a working email address, a delivery address to send an order to, and, if you want to be paid as a seller, the identity check Stripe runs.
Access your personal information. You can view most of your data directly in the app or on frippy.au (profile, listings, orders, chat history). If you want a copy of the rest, ask us.
Correct your personal information. You can update your profile, display name, addresses, and other details in the app or on frippy.au.
Delete your account and associated personal information through the app settings. If you have ever bought or sold on Frippy, Australian tax law requires us to keep those transaction records, so the app cannot close that account on its own: email us and we will close it by hand and remove everything we are allowed to remove. See frippy.au/delete-account for what goes and what stays.
Opt out of promotional communications. You can turn off promotional push notifications in the app settings, under Notifications, as Promotions. For marketing emails, use the unsubscribe link at the bottom of any one of them, which works without signing in. You can also turn off the notifications about your orders there, though we do not recommend it, because you may miss a delivery deadline or a dispute you need to answer.
Complain to us first. If you think we have mishandled your personal information, email us and say so. We will acknowledge you within 5 business days and give you an answer within 30 days, in writing, including what we found and what we have done about it.
Complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you are not satisfied with our answer, or if you would rather go straight there.
To make a formal privacy request, contact us at hello@frippy.au. We will respond within 30 days.
9. Cookies & Tracking
Frippy itself sets no cookies on your phone: your session is kept in your device's secure storage, not in a cookie. Some screens do open a web page inside the app, such as these legal pages, which are served from frippy.au, and the identity check, which is served by Stripe. A web page inside the app behaves like a web page anywhere else, cookies included. This is what frippy.au stores in your browser.
Signing in and making the site work. If you sign in on frippy.au, we set a session cookie so the site knows it is you. We also keep small things in your browser's local storage to make the site work, such as the items you saved before you had an account and your recent searches.
Your analytics answer. When you answer the banner on frippy.au, we store one cookie, named frippy_analytics_consent, to remember what you said for a year. It holds a yes or a no and nothing else.
Analytics. If you say yes, we load PostHog, which sets its own cookies and stores a little data in your browser so it can count your visit and tell one visit from another. On item, bag and checkout pages it may also record how the page is used, with what you type, your delivery address, your email address and your payment details hidden. If you say no, or you leave the banner unanswered, PostHog still counts the pages and steps you use, without cookies or local storage and without a profile of you. To change your answer on the website, clear the frippy_analytics_consent cookie in your browser and the banner will ask again. In the Frippy app, the same choice lives in Settings, under Privacy, as Usage Analytics.
Where you came from. If you arrive from an ad or a link, we keep in your browser, for up to 90 days, which ad or site sent you and the page you landed on. If you then sign up or buy, we save that with your account or order. Say no on the banner and we delete it.
Advertising measurement. When we advertise on Meta or Pinterest, frippy.au loads a measurement tag from that platform, and those tags set their own cookies. They are there so we can tell which ads bring people to Frippy, and to show our ads to people more likely to be interested. The Meta tools in the Frippy app work the same way. You can turn ad targeting off with each platform directly: on Meta, in your Accounts Centre under Ad preferences; on Pinterest, in your settings under Privacy and data. Those two are the ones that matter here, because those are the two tags we run. Both platforms also take part in the industry opt-out page at optout.aboutads.info, and there is one for Australia at youronlinechoices.com.au/opt-out. If you would rather we walked you through it, email hello@frippy.au.
Payments. When you pay on frippy.au, Stripe sets its own cookies in your browser to keep the payment secure and to detect fraud.
We do not set cookies for anything else, and we do not let anyone else set one except the payment and advertising providers named here.
10. Children's Privacy
Frippy is not intended for anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a user under 18, we will take steps to delete that information and close the account. If that account has an order in progress, we will cancel it and refund the buyer.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will tell you in the app before you next use it, and the "Effective" date at the top of this policy tells you when it was last revised.
12. Contact
If you have questions or concerns about this Privacy Policy or how we handle your personal information, contact us at hello@frippy.au.