1. Who we are
Zirc (“we”, “us”) operates the marketplace at zirc.shop. This policy explains what data we collect, why, and how we protect it.
2. Data we collect
- Account info — name, email, and profile data from your Clerk sign-in.
- Phone number — if you choose to verify it, used to build your trust network.
- Contacts — if you choose to import them (via Google Contacts, a .vcf file, or manual entry). Phone numbers are hashed before storage; raw numbers are never persisted.
- Listings — photos, titles, descriptions, prices, and payment method identifiers you create.
- Usage data — page views and payment-link clicks per listing.
3. Google user data
When you import contacts via Google, we request read-only access to your Google Contacts (contacts.readonly scope). We use this data exclusively to extract phone numbers for your contact-based trust network. Specifically:
- Phone numbers are extracted client-side in your browser, sent to our server over an encrypted connection, and immediately hashed. Raw numbers are discarded after hashing and never persisted.
- We do not store your Google access token or any raw contact data (names, emails, addresses) on our servers.
- We do not share, sell, or transfer Google user data to any third party.
- Google data is not used for advertising, profiling, or any purpose other than building your trust network on Zirc.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. How we use your data
- To operate the marketplace and display your listings.
- To show trust signals (mutual contacts) between buyers and sellers.
- To send transactional notifications (email or SMS) you opt into.
- To generate aggregate analytics on your listings.
5. Data storage
Account and listing data is stored in Convex. Authentication is managed by Clerk. Contact phone hashes are stored on our database. Raw phone numbers are never stored on the server.
6. Data sharing
We do not sell your data. We share data only with service providers necessary to operate Zirc (Clerk for auth, Convex for database, Resend/Twilio for notifications) and as required by law.
7. Your rights & deletion
You can delete your shared contacts at any time from Settings. To delete your entire account and all associated data, contact us at the email below.