Privacy Policy

Information we collect

• Access requests. Your name, work email, company, the role you select (customer, provider or other), what you tell us you ship, and when you submitted. We do not store your IP address or browser details with your request.
• Accounts. For invited users: name, email address, organization, role and sign-in records (such as when you last signed in and failed sign-in attempts). Your password is stored only as a salted scrypt hash. A temporary password is shown once to the admin who sets it, must be changed at first sign-in, and stops working 72 hours after it is set unless it has been changed; after that we never see your password.
• Sandbox content. Requests, proposals, messages and other content you create in the sandbox. The sandbox is for synthetic data; please do not enter real shipment or customer data.
• Technical data. Our hosting provider processes IP addresses and request details to deliver the Site and protect it from abuse, including rate limiting. We do not use this data to build profiles.

How we use information

• To review access requests, reply to you, and invite teams to the sandbox.
• To run the Exchange: sign-in, keeping each organization’s workspace separate, and security.
• To keep an internal record of interest in Puffin Exchange.

We do not sell personal information, and we do not use it for advertising.

Cookies and analytics

The Site does not set cookies of its own. The Exchange uses session cookies that are needed to keep you signed in; they are not used for tracking. We use no third-party analytics or advertising tools.

Service providers

• Cloudflare hosts the Site, stores access requests, and protects the Site and the Exchange from abuse.
• Google delivers email sent to hello@puffinexchange.com to our mailbox.
• ntfy sends our team a notification that new access requests have arrived. The notification contains only a count, never your details.

The Exchange application and its database run on servers operated by DK1 Capital. Sign-in is handled by the Exchange itself; no third-party sign-in or identity provider is involved.

How long we keep information

• Access requests are kept for 12 months after you submit them, then deleted automatically.
• Account and sandbox data are kept while your access is active. When access ends, we disable the account, close its sandbox and end its sessions. If you ask us to delete your account, we delete the account, its sandbox data, your sign-in details and your access request within 30 days. Copies in our backups are removed as older backups are replaced.
• Email you send us is kept as long as needed to respond and to keep a record of our correspondence.

Your choices

To access, correct or delete information you have submitted, email hello@puffinexchange.com. We will confirm when your request has been handled.

Security

We use encrypted connections, limit access to personal information to the people who need it, and keep each organization’s workspace separate from every other.

Changes

When this policy changes, we update this page and the date at the top.

Contact

Questions about this Privacy Policy? Email hello@puffinexchange.com. The Site and the Exchange are operated by DK1 Capital LLC.