Privacy Policy

• Account data: email, username, name (first name + last initial public), and your phone number if you choose to add one. Giving a phone number is optional, and we do not currently verify phone numbers or send text messages.
• Listing data: titles, descriptions, photos, categories, approximate location, VIN/serial where provided.
• Bidding data: bids placed, watchlist, questions asked, viewing requests.
• Payment data: card-on-file tokens and buyer-fee payment records held by our payment processor (Stripe). DoBid does not store full card numbers.
• Technical data: IP address, user agent, device info, and audit metadata for important actions.
• Usage data: which pages you view and which actions you take, so we can run and improve the product. See section 5.

• Operate auctions, validate bids, end auctions, and enforce platform rules.
• Authorize and capture the disclosed 10% buyer fee when a seller accepts a winning bid, and maintain the associated payment and transaction records.
• Send notifications about bids, auctions, viewings, pickup, and account activity.
• Detect fraud, resolve disputes, and improve the product.
• Measure our advertising, if you have accepted marketing cookies. See section 5.
• Comply with legal obligations and respond to lawful requests.

• Payment processor: Stripe processes saved cards, authorizations, and buyer-fee charges on behalf of DoBid.
• Infrastructure providers: hosting, database, and email delivery vendors under data-processing agreements.
• Analytics providers: Amplitude and Google Analytics, on our instructions and for the limited purposes described in section 5.
• Meta (Facebook and Instagram), and only if you accept marketing cookies: the Meta pixel reports that an action happened on dobid.ca — a page viewed, an item viewed, a bid placed, a listing published, an account created — together with the item id, category and amount involved. We do not send your name, email address, phone number, DoBid username or account id, and we have not switched on Meta’s advanced matching. Meta receives your IP address and cookie identifiers as a technical consequence of your browser contacting it, and uses them under its own privacy policy, which we do not control. Nothing is sent unless you accept, and nothing is sent from inside the DoBid mobile app at all.
• The other party in a transaction: after a seller accepts, the buyer and seller exchange the information needed for pickup. DoBid is not a party to the sale.
• Law enforcement: when required by law or to protect users and the integrity of the marketplace.

DoBid does not sell your personal information for money, and never has. We should be straight about the other half of that sentence, though: if you accept marketing cookies, the Meta pixel described above passes activity to an advertising company, and under some laws — including California’s — that counts as “sharing for cross-context behavioural advertising” even though no money changes hands and no identifier of yours is sent. That is precisely what the choice in section 5 is for. Decline, or never answer, and no such sharing happens. Everything else on this page runs the same either way.

We measure how the product is used so we can improve it, and we measure our advertising so we can stop paying for ads that do not work. Four things do this, and nothing else:

• Our own page-view records, stored in our database. Visitors are identified by a value derived from IP address, browser and date, which cannot be linked to you across days.
• Amplitude — product analytics: which screens and features are used. Session recording is switched off, so we do not record video of your session.
• Google Analytics — website traffic and where visitors arrive from. It runs on the dobid.ca website only. It is switched off inside the DoBid mobile app, which sends nothing to Google.
• The Meta pixel — advertising measurement, so we can tell which Facebook or Instagram ad led to a real bid or a real listing rather than a click. This is the only one of the four that requires your consent, because it is the only one that reports to an advertising company. It stays completely switched off — not loaded, nothing sent — until you accept, and it is switched off inside the DoBid mobile app whatever you choose here. What it reports is listed in section 4.

Google Analytics on DoBid is configured to receive the page address only — never the query string or link fragment. Search terms you type, sign-in and password-reset links, and share links therefore stay out of it. Google’s advertising features, including Google Signals and ad personalisation, are switched off, so this data is not used to build an advertising profile of you or to follow you across other companies’ sites.

Cookies are used for signing in and session integrity, for the analytics above, and for hCaptcha on public forms. Marketing cookies are separate and off by default. You can block or delete cookies in your browser; sign-in will stop working if you block ours.

• Edit your profile and notification preferences in Account settings.
• Change your marketing-cookie choice at any time, using the buttons in section 5 above. You do not need an account to do it.
• Enable two-factor authentication in Account security.
• Delete your account yourself, in the app, at Account → Security → Delete account. It takes effect immediately — there is no support ticket, no email step, and no waiting period, and you do not have to settle anything first. It cannot be undone.
• What deletion does: your name, email address, phone number, profile photo, bio, saved location, saved searches, watchlist, notification settings, saved card details and the messages you sent are erased, and any item of yours still up for auction is withdrawn from sale. Your past bids, accepted transactions, commitment holds, fee charges and audit history are kept in anonymized form, shown as “Deleted user”, because the people you dealt with keep their record of the transaction and because we are required to retain that trail. A commitment hold that is still open stays open and runs its course.
• Request a copy of your data through Support.