Privacy Policy

1. Who we are

Overrun (overrunxchange.com) is a marketplace where businesses and contractors in New Jersey buy and sell surplus building materials. This policy explains what personal information we collect, how we use it, and who we share it with.

2. Information we collect

• Account: your email address, used to log you in with a one-time link. We do not use passwords.
• Listings: the title, description, photos, quantity, price, town, and the contact name and phone number you enter when you post.
• AI suggestions: if you use "Fill in details from photos", the listing photos and any title you typed are sent to our AI provider (Anthropic) to suggest a description, condition and price. If you use the price lookup, the product name and description are also used to search the web for retail prices. They are not used for anything else by us.
• Messages: if you message a seller or buyer through Overrun, the content of those messages. Before a purchase, messages are automatically checked for contact details or attempts to arrange a deal off-platform, and blocked if found; this checking happens on our servers, not by a person reading your messages. Messages are delivered in real time through Pusher, our messaging infrastructure provider.
• Purchases: your name, phone number, and email, and whether you chose platform-coordinated pickup. The amount and time of the sale are also recorded.
• Payments and payouts: handled by Stripe. Card and bank details go directly to Stripe and never reach our servers. Sellers give Stripe identity and bank information to receive payouts, and Stripe holds it.
• Reviews and disputes: ratings, and any description you write when reporting a problem with a purchase.
• Waitlist and interest forms: the name, company, phone, email, and message you submit.
• Email alerts: if you sign up for alerts, your email address and the category and area you chose. We only send alerts after you confirm, and every alert has an unsubscribe link.
• Wanted requests: what you are looking for, its category and area. Requests are public but do not show your name or contact details.
• Notifications: if you turn on sale notifications, your browser's push subscription.
• Technical data: a login cookie, server logs, and basic error reports from the site. We use Vercel Web Analytics, which measures page views and where visitors come from without cookies or tracking individuals across sites. If you arrive through a referral link, we remember the referrer's code (30 days) so the referral can be credited.
• Advertising: we use the Meta (Facebook/Instagram) Pixel to measure whether our ads led you to the site and to show you relevant ads on Facebook and Instagram. It sets cookies and shares page-visit information with Meta; if you are logged into Facebook or Instagram in the same browser, Meta may connect that visit to your account for ad targeting. You can limit this through your browser's tracking settings or Meta's own ad preferences (facebook.com/adpreferences).

3. How we use it

To run the marketplace: log you in, show listings, process payments and payouts, share pickup details between buyer and seller, coordinate logistics, handle disputes and refunds, calculate seller ratings, prevent fraud and misuse, enforce our Terms, and contact you about your account or transactions.

4. What other users can see

Listings are public, including photos, town, price, and the seller's aggregate statistics (number of sales, lifetime sales amount, and review results). A seller's name, phone, and email are revealed to a buyer only after the buyer's payment clears. A buyer's name, phone, and email are revealed to the seller only after a sale. Individual reviews are not shown with your name.

5. Who we share it with

We do not sell your personal information. We share it with service providers that operate the site for us:

• Stripe: payments, seller payouts, refunds, and seller identity verification.
• Vercel: website hosting and storage of our data and uploaded photos.
• Resend: sending login links and notification emails.
• Pusher: delivering messages between buyers and sellers in real time.
• Anthropic: AI listing suggestions and price lookups, described above.
• Meta: the Facebook/Instagram Pixel, described above.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights and safety of users. If Overrun is sold or merged, your information may transfer to the new owner.

6. Cookies and local storage

We use one essential cookie to keep you logged in (up to 30 days), a cookie that remembers a referral code if you followed a referral link (30 days), and your browser stores a cached copy of the site so it can work offline. The Meta Pixel (see above) also sets cookies used for advertising measurement and targeting.

7. How long we keep it

We keep account, listing, and transaction records for as long as your account is active and as needed to meet tax, accounting, and legal obligations and to resolve disputes. You can delete your account yourself at any time from the Account page, or ask us to at privacy@overrunxchange.com. Deleting removes your account, unsold listings and photos, and waitlist sign-ups. Records of completed sales, reviews, and disputes are kept as required for tax, accounting, and legal purposes, with your name and contact details removed. Payout information held by Stripe is governed by Stripe's own policies.

8. Your choices and rights

You can ask to access, correct, or delete your personal information, or to stop receiving notifications, by contacting us at privacy@overrunxchange.com. Residents of New Jersey and other states with privacy laws may have additional rights, including to know what we hold about them and to appeal a decision on a request. We will respond within the time the law requires.

9. Security

We use reasonable safeguards, including encrypted connections and limited access to stored data. No system is perfectly secure, so we cannot guarantee absolute security.

10. Children

Overrun is for businesses and adults. We do not knowingly collect information from anyone under 18.

11. Changes

We may update this policy. We will post the new version here with a new date, and notify account holders of material changes.

12. Contact

Questions about this policy: privacy@overrunxchange.com.