Privacy notice

Thriftloop Cape Town (“Thriftloop”, “we”) is a map of Cape Town’s thrift, charity and second-hand shops, run by Hack Cove. We are the responsible party for the personal information described here under the Protection of Personal Information Act, 2013 (POPIA). Contact us about anything on this page at privacy@hack-cove.com.

We have not yet registered an Information Officer with the Information Regulator. Until we do, privacy requests go to the address above.

You do not need an account to use the map or the directory. Your browser remembers your light or dark theme choice on your own device; that never reaches us.

The site is served by Cloudflare and the map tiles by OpenFreeMap. Like any web server, theirs see your IP address and browser details when they deliver a page or tile to you.

We count how often six things happen: a shop page is opened, the Get directions button is used, a review, claim or listing is submitted, and the events page is opened. Each count records only which action it was and which shop, and is not linked to you or to your device.

You sign in with Google. Google sends us your name, email address, profile photo and an account identifier. We do not ask Google for anything else, and we never see your Google password. We keep:

• Your account: that name, email, photo and identifier, plus a display name if you choose one.
• A session cookie that keeps you signed in for up to 30 days. It is essential to signing in and is not used for tracking.
• Reviews you write: rating, text and date.
• Claims, if you ask to manage a shop: your message, and a record of the one-time code we send to the shop’s published phone number or email to check the claim.
• Shop ownership, once a claim is approved, and the changes you make to that shop’s listing.

We use this to run your account, show your reviews, decide claims and contact you about them. That is the reason we process it: you asked for an account, and these are the things an account does.

Signing in, writing a review, claiming a shop and creating a listing each ask you to pass a Cloudflare Turnstile check first. Turnstile reads signals from your browser and device to tell people from bots, and Cloudflare handles that data under its own privacy policy. The check loads only on those forms, not on the map.

A new review, and the title and description of a new listing, are read by an automated model run by Cloudflare (Workers AI) before they go public. Only that text is sent to it. If the model flags the text, or could not read it, we hold it back: it does not appear, and we do not delete it automatically.

A person, not the model, makes the final call on held content. Our admin reads it and either publishes it or removes it. If your review or listing is held, you can ask why at privacy@hack-cove.com. This is the safeguard section 71 of POPIA asks for when a decision about you is partly automated.

When something breaks on our servers, or in your browser while you use the site, an error report goes to Sentry so we can fix it. It holds the error message, where in the code it happened, the page address without anything after a “?”, your browser’s user agent and the version of the site. We do not attach your account, your name or email address, cookies, the contents of what you submitted, or sign-in tokens, and we strip those out before the report leaves our server or your browser.

A review is public. It shows your rating, your text, the date and your chosen display name, or “A Thriftloop shopper” if you have not set one. We never show your Google name, email or photo to the public. Do not put anything in a review you would not want strangers to read.

When you claim a shop, our admin sees your name and email so they can check the claim. Shop listings themselves (name, address, phone, email, hours) are compiled from public sources and are about the shop, not about you.

We do not sell personal information or share it for marketing. Services that store or carry it for us: Cloudflare (hosting, database, the Turnstile spam check and the Workers AI screening), Google (sign-in) and Sentry (error reports, which carry no personal details beyond those listed above). Photos a shop owner uploads are stored with Cloudflare too, apart from older ones that UploadThing still holds. Some of them process data outside South Africa.

We keep your account until you delete it. You can do that yourself on your account page. Deleting your account:

• Deletes your name, email, photo, display name, Google identifier, sessions, claims (with their check codes and contact records) and your shop-manager access.
• Keeps your reviews, anonymised. They stay on the shop’s page as “A Thriftloop shopper”, with nothing that links them to you or to your Google account. If you want a review removed too, email privacy@hack-cove.com and we will remove it.
• Keeps changes you made to a shop’s listing, because they are about the shop, not about you.

If you sign in with the same Google account later, you start a new, empty account.

Under POPIA you may ask what personal information we hold about you, ask us to correct or delete it, and object to how we use it. Email privacy@hack-cove.com. If you are not satisfied with our answer, you may complain to the Information Regulator (South Africa) at inforegulator.org.za.

When you sign in, Google sends us your name, email address, profile photo and an account identifier. We ask for the openid, email and profile scopes and nothing more.

• We use this data only to run your account: to sign you in, to identify your reviews and claims, and to contact you about a claim.
• We never sell it, never use it for advertising, and never use it to train AI models.
• We share it with no one except the services named under “Who else handles it”. Our admin sees your name and email when you claim a shop, so they can check the claim you made.
• We delete it when you delete your account, as described above.

Thriftloop’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. In plain words: we use what Google sends only to provide the features you see, we do not transfer it to others except to run the service, follow the law or protect the site, and no person reads it except to check a claim you made, to investigate abuse or a security problem, or where the law requires.

We will update this page when what we collect changes, and change the date at the top. See also our terms.