Privacy Policy

• Account details: your name, email address and a hashed password (we never store your password in plain text), and optionally your phone number and postal address.
• Deals and parcels: the deals you commit to, your submissions (items, quantities, declared value, carrier and tracking details, drop-off requests), quote requests, and messages you exchange with our staff.
• Payout details: your PayID (an email address or mobile number) and, optionally, your bank's name, plus the history of your wallet credits, fees and payouts. We don't collect your bank account number or card details.
• Identity information: we don't routinely collect government ID. If we ask you to verify your identity (for example before a payout, or because second-hand goods laws require it) we'll tell you what we need and why.
• Security and technical information: login sessions, one-time verification codes (stored hashed), your IP address as your requests reach our systems, and an audit trail of account and financial changes. We also record the date and version of the Terms and Privacy Policy you accepted at sign-up.

We collect this information directly from you, from the actions you take on the site, and from carriers who tell us about your parcel.

• To create and run your account, your deals, submissions, wallet and payouts.
• To receive, check and pay for your items, and to resolve any mismatch or dispute.
• To send you service emails: confirmations, parcel updates, payout notices and security codes.
• To verify identity, prevent fraud and the sale of stolen or locked goods, and keep the service secure.
• To meet legal obligations, including tax, record-keeping and second-hand goods laws, and to respond to lawful requests from police and regulators.

We don't sell your personal information. We currently send only service emails. If we ever send marketing we'll do so only with your consent and you'll be able to unsubscribe at any time.

• Delivery carriers we use for labels and tracking (your name, address, phone and parcel details).
• Your bank, when we pay you by PayID (your PayID, the amount and a reference; your bank shows the payer to you).
• Service providers that help us run the service, such as Cloudflare (which delivers and secures our website traffic), Microsoft (which hosts our business email), and IT and backup providers, who may only use the information to provide their service to us.
• Police, regulators and courts where the law requires or permits it, including in connection with stolen or fraudulent goods, and our professional advisers (such as accountants and lawyers).
• A buyer or successor of our business, if it is sold, on the same privacy terms.

Some of our service providers, including Cloudflare and Microsoft, operate global networks and may handle information (such as your IP address, or emails we send you) outside Australia, including in the United States and elsewhere. We take reasonable steps to ensure such providers handle your information in line with the APPs.

We use a single essential cookie that keeps you signed in (for up to 30 days). We don't use advertising or analytics cookies or third-party trackers. Cloudflare may set its own security cookies to protect the site from abuse.

Passwords are hashed and never stored or logged in plain text. Sessions use random, revocable tokens. We never store your bank account number. Changing your PayID requires a one-time code sent to your email, not just being signed in. Access to customer information is limited to staff who need it, and changes to accounts and money are logged. Our website is served over HTTPS.

If a data breach happens that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.

• Account and deal information: while your account is open.
• Financial and audit records: for the period the law requires (generally five to seven years), even after you close your account. After closure we anonymise your name, phone and address so those records are no longer linked to you.
• Sessions and one-time codes: only for as long as they are valid.
• Backups: copies may persist for a short period after deletion until they are overwritten.

You can view and update most of your information under Settings. To ask for a copy of your information, to correct it, or to make a privacy complaint, email us using the address at the top of this page. We'll respond within 30 days. If you're not satisfied with our response, you can complain to the OAIC at oaic.gov.au.

You can browse our site without an account, but we need to identify you to buy your items and pay you, so we can't deal with you anonymously or under a pseudonym for that.

Cashout is for people aged 18 and over. We don't knowingly collect information from anyone under 18.

We may update this policy. The version and effective date are at the top of this page, and we'll give reasonable notice of material changes.