Privacy Policy
Last updated: July 2026
Chicon is a private marketplace and community — a place to buy, sell, and message people directly. This policy explains what we collect, how it's protected, and the choices you have. We aim to be precise and honest rather than over-claim.
What we collect
- Your account — username, contact email, and a BCrypt hash of your password (never the password itself).
- Your listings, which are public — title, description, price, category, and photos are visible to anyone using the marketplace.
- Your orders — what you bought or sold, the amount, order status, and the username of the counterparty (buyers and sellers see each other's public @handle and the order details).
- Your messages and contacts/profile.
- If you connect an external account (Google, Microsoft, IMAP) to sync contacts, the relevant credential is stored encrypted at rest (AES-256-GCM) so a background job can use it; it is never returned to the browser or logged. Removing the account or deleting your account deletes it.
How your data is protected
Your data is encrypted in transit and at rest, protected by access control, and used only to run the marketplace. Some data — including the encrypted store that holds your keys and any connected-account credentials — is decryptable by the service so it can operate the product (for example, to power search, deliver messages, or respond to a lawful request). In other words, Chicon is not zero-knowledge: we can access your data to run the service, but we do not sell it and we do not run third-party advertising or analytics trackers. Your 1:1 and private-channel messages are encrypted and stay between the participants; public channels and listings are public by design.
Marketplace & payments
Payments run through Stripe, using Stripe Connect. When you buy, Chicon charges your payment method and holds the funds, releasing them to the seller once you confirm you received your item, minus a platform fee. Card details are handled by Stripe — Chicon never sees or stores your full card number. To get paid, sellers complete Stripe identity verification (KYC); Stripe processes their identity, bank, and payout information under its own terms and privacy policy.
Chicon operates the marketplace but is not a party to the sale, and does not handle shipping or delivery — buyers and sellers arrange that between themselves. There is no subscription — Chicon's only charge is a percentage fee on completed sales.
AI features
When you use the AI listing assistant or search, the text you provide (your listing notes or search query) is sent to Azure OpenAI to generate a draft or find relevant listings. It is used to serve your request, not to train models on your data.
Where your data lives, and who processes it
Chicon's backend runs on Microsoft Azure. Encrypted vault blobs, account records, and the server-readable mirrors above are stored in Azure Storage (blobs and tables); secrets are held in Azure Key Vault. We rely on a small set of third-party sub-processors to run the service:
- Microsoft Azure — hosting, storage, and email delivery (Azure Communication Services sends transactional email such as password-reset and verification links).
- Stripe — payment processing for the marketplace via Stripe Connect (buyer charges and seller payouts, plus seller identity/bank verification).
- Azure OpenAI — powers the AI listing assistant and search; receives the listing text or search query you provide.
- Microsoft and Google — only when you connect a Microsoft or Google account to sync contacts; your data flows to/from their APIs on your behalf.
- Azure Application Insights — operational telemetry (errors and performance) to keep the service healthy. We don't use third-party advertising or analytics trackers.
Tracking and selling
Chicon does not use third-party advertising trackers, and we do not sell your data.
Your rights and controls
- Export. You can export your data from Settings. (Contact us for a broader data request in the meantime.)
- Deletion. You can delete your account from Settings. Deletion removes your account record, your listings, orders, messages, files, contacts, and any server-held connected-account credentials.
Contact
Questions about this policy? Reach us at privacy@chicon.app.