Privacy Policy

NorCal Auto Fair ("we", "us") operates a weekend display marketplace for vehicles in the Sacramento, California area, at [DOMAIN — norcalautofair.com]. This policy describes what personal information we collect, how we use it, and the choices you have. It is intended to satisfy the California Online Privacy Protection Act (CalOPPA).

From sellers who create an account:

• Display name and city
• Email address and password (stored as a one-way hash)
• Phone number (optional — private by default, never shown publicly)
• Optional "contact preference" text you choose to display publicly
• Vehicle information, including VINs, descriptions, prices, and photos
• Records of your fair-weekend registrations and attendance
• Acceptance records for our Terms of Service and this policy (version and timestamp)

From all visitors, automatically:

• IP address, browser type, and basic request logs (kept for security and troubleshooting)
• Session cookies required for login (see Cookies below)

From the contact form: your name, email address, and message.

The point of NorCal Auto Fair is public display. If you list a vehicle, the following is visible to anyone on the internet:

• Your vehicle's details, including its full VIN (so buyers can run history reports) and your photos of it
• Your display name, city, member-since date, fairs-attended count, and active fleet
• Any contact-preference text you choose to add

We never publicly display your email address or phone number. We strip location metadata (EXIF/GPS) from every uploaded photo before it is stored or displayed.

• Operating the marketplace: accounts, listings, weekend registration, attendance tracking
• Sending transactional email (verification, password reset, policy or account notices)
• Enforcing our no-show policy and Terms of Service
• Security, fraud prevention, and legal compliance

We do not sell your personal information.

We share personal information only with service providers that run the site on our behalf:

• [HOSTING PROVIDER — e.g. Vercel/Railway] — servers and database hosting
• [PAYMENT PROCESSOR — e.g. Stripe, when enabled] — processes the listing fee; card details go directly to the processor and never touch our servers
• [EMAIL PROVIDER — e.g. Resend/Postmark, when enabled] — delivers transactional email
• [OBJECT STORAGE / CDN — e.g. AWS S3 or Cloudflare R2, when enabled] — stores and serves vehicle photos

We may also disclose information if required by law, or to protect the rights, safety, or property of NorCal Auto Fair, our users, or others.

We use only strictly necessary cookies: a session cookie to keep you logged in and a CSRF-protection cookie. We do not currently use analytics or advertising cookies. If that changes, we will update this policy and provide any required opt-outs before doing so.

Some browsers send "Do Not Track" signals. Because we do not track visitors across third-party websites or serve targeted advertising, we do not respond to Do Not Track signals — there is no tracking to turn off.

Account data is kept while your account is open. Server logs are kept for up to [90] days. Emails recorded for transactional purposes are kept for up to [12] months. When you delete your account (see below), personal information is removed promptly; anonymized, aggregate records of fair attendance are retained.

You can delete your account yourself at any time from Dashboard → Account → Delete account. Deletion removes your name, email, phone, city, contact preference, vehicle descriptions, VINs, and all photos from the site and our storage. Historical fair-attendance records are anonymized and kept only as aggregate counts. You can also download a copy of your data (JSON) from the same page, or request deletion or a copy by contacting us (below).

When we make material changes to this policy, we will update the version and effective date at the top of this page and email the address on your account before the changes take effect. Continued use of the site after the effective date constitutes acceptance.

The site is not directed to children under 13, and we do not knowingly collect personal information from them.

Privacy questions or requests: use the contact form or email [PRIVACY CONTACT EMAIL — e.g. privacy@norcalautofair.com]. Mailing address: [BUSINESS MAILING ADDRESS].