Privacy Policy
1. Introduction
This Privacy Policy describes how Proximate LLC, a Georgia limited liability company (“Proximate,” “we,” “us,” or “our”), collects, uses, shares, and protects information about you when you use the Proximate mobile application, website, and related services (collectively, the “Platform”).
This Privacy Policy is incorporated into and forms part of the Proximate Platform Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service. By using the Platform, you acknowledge that you have read and understood this Privacy Policy.
Proximate is a peer-to-peer local marketplace that facilitates in-person exchanges between Users. Because the Platform involves arranging physical meetings and processing payments, it necessarily collects certain categories of sensitive information, including location data and payment-related information. This Privacy Policy explains what we collect, why, and the choices available to you.
2. Information We Collect
We collect the following categories of information. For California residents, each row is annotated with the corresponding statutory category under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA,” codified at Cal. Civ. Code § 1798.140).
| Category | Examples | CCPA Category §1798.140(v) |
|---|---|---|
| Account Information | Name, email address, password (stored in hashed form), phone number, date of birth, city, and state provided at registration. | Identifiers; Personal information under Cal. Civ. Code §1798.80(e); Protected classification (age) |
| Profile Information | Profile photo and other details you choose to add to your profile. | Identifiers; Commercial information |
| Listing Information | Item descriptions, prices, categories, conditions, photographs, and listing locations you provide as a seller. | Commercial information |
| Communications | Messages exchanged between buyers and sellers through the Platform’s messaging feature, and communications with Proximate support. | Commercial information; Electronic activity information |
| Location Information (Sensitive PI) | Approximate or precise location data shared during the pre-arrival check-in process, agreed meeting locations, and GPS-based location used to verify presence at a meeting location. Location data is collected in connection with specific transactions and the Trust Process. | Geolocation data; Sensitive Personal Information under §1798.140(ae) (precise geolocation) |
| Transaction Information | Records of transactions you participate in, including agreed prices, item conditions, timestamps, payment method, and the bilateral Transaction Record generated by the Proximity Confirmation. | Commercial information; Financial information |
| Behavioral / Reliability Data | Data about your activity on the Platform used to calculate your Reliability Score, including meet agreement confirmation rates, check-in completion rates, Proximity Confirmation completion rates, no-show rates, and item condition dispute rates. | Inferences drawn from other personal information |
| Reviews | Reviews you submit about other Users and reviews other Users submit about you following completed transactions. | Commercial information |
| Payment Information | For electronic transactions, payment-related information is collected and processed by our payment processor, Stripe. Proximate does not collect or store full payment card numbers or bank account numbers. Proximate stores limited references, such as a Stripe account identifier and payout-enablement status. | Financial information (collected by Stripe, not by Proximate) |
| Device and Usage Information | Technical information such as device type, operating system, app version, IP address at registration, device attestation identifiers (Apple DeviceCheck and App Attest), and information about how you interact with the Platform. | Identifiers; Internet or other electronic network activity; Device identifiers |
| Safety and Incident Information | Reports you file against other Users or listings, safety-cancellation events, dispute statements, and moderator review records. | Commercial information; Inferences |
2.1 Sources of Information
We collect the categories of personal information described above from the following sources:
Directly from you — when you register, edit your profile, create listings, message other Users, agree to a Meet, check in, complete a Proximity Confirmation, submit reviews or reports, or exercise the privacy rights described in Section 9.
Automatically from your device — device information, IP address, and (with your permission) location data provided through your device’s operating system.
From other Users — reviews written about you, reports filed against you, and behavioral signals generated by other Users’ interactions with your listings or messages.
From service providers — Stripe returns account status, payout enablement, and transaction outcomes to Proximate in connection with payments; Apple returns DeviceCheck and App Attest verification results.
3. How We Use Your Information (Business Purposes)
Under CCPA/CPRA §1798.140(e), we use the categories of personal information listed in Section 2 for the following business purposes:
To provide, operate, and maintain the Platform and its features, including the Trust Process, the Proximity Confirmation, and the Reliability Score;
To facilitate connections and communications between buyers and sellers;
To verify presence at agreed meeting locations as part of the Trust Process;
To calculate and display Reliability Scores and reviews;
To process electronic payments and settle funds to sellers, through our payment processor;
To generate, store, and make available the bilateral Transaction Record for each completed transaction;
To detect, investigate, and prevent fraud, abuse, harassment, safety incidents, and violations of our Terms of Service;
To respond to your requests, including privacy-rights requests, and to provide customer support;
To comply with legal obligations (including tax, accounting, and lawful process) and to enforce our agreements; and
To improve and develop the Platform, including through analysis of aggregated or de-identified data.
We do not use personal information for purposes materially different from those disclosed above without providing notice and, where required, obtaining your consent.
4. Location Information — Special Notice
Because the Platform facilitates in-person meetings, location information is central to several of its features. Precise geolocation is treated as “Sensitive Personal Information” under CCPA/CPRA §1798.140(ae), and its handling is limited to the purposes disclosed in Section 3.
Location data is collected in connection with specific transactions — for example, when you choose to check in before a meeting or when your presence at an agreed location is verified — and not for continuous background tracking outside of these features.
Approximate or precise location shared during check-in may be visible to the other party to your transaction, so that both parties can coordinate the meeting. This is described to you at the time you choose to share it.
Agreed meeting locations are stored as part of the transaction record for that meeting.
You can control location sharing through your device’s operating system permissions. Disabling location access may limit your ability to use certain features of the Trust Process, including check-in and presence verification.
We do not use precise geolocation for any purpose other than those disclosed in Section 3, and we do not sell or share precise geolocation for cross-context behavioral advertising.
5. How We Share Your Information
We share information in the following circumstances:
5.1 With Other Users
Certain information is shared with other Users as a necessary part of how the Platform works. This includes your name or display name, profile photo, Reliability Score, reviews, listing information, messages you send, and — during an active transaction — location information you choose to share during check-in. You should not include information in your profile, listings, or messages that you do not wish to be visible to other Users.
5.2 With Stripe (Payment Processing)
Electronic payments on the Platform are processed by Stripe, Inc. and its affiliates (“Stripe”). When you make or receive an electronic payment, certain information — which may include your name, email, payment or bank account details, and transaction information — is collected and processed directly by Stripe in its role as payment processor. Stripe’s handling of your information is governed by Stripe’s own Privacy Policy, available at:
Sellers who receive electronic payouts establish a connected account relationship with Stripe and complete identity verification required by Stripe and applicable law. We encourage you to review Stripe’s Privacy Policy to understand how Stripe processes your information.
5.3 With Service Providers
We may share information with third-party service providers who perform services on our behalf, such as cloud hosting, infrastructure, edge security (Cloudflare), device attestation (Apple DeviceCheck and App Attest), analytics, and customer support tools. These providers are contractually permitted to use your information only as necessary to provide services to us and are prohibited from using it for their own purposes.
5.4 For Legal and Safety Reasons
We may disclose information where we believe in good faith that disclosure is necessary to comply with a legal obligation, respond to lawful requests from public authorities, enforce our Terms of Service, protect the rights, property, or safety of Proximate, our Users, or others, or detect and prevent fraud or security issues. This may include providing Transaction Records or related information to law enforcement in connection with an investigation.
5.5 Business Transfers
If Proximate is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to the commitments made in this Privacy Policy.
5.6 Aggregated or De-Identified Data
We may create and use aggregated or de-identified data — information that does not identify any individual — for purposes such as analytics, research, and the development of market insights. We do not attempt to re-identify de-identified data.
5.7 We Do Not Sell or Share Personal Information
Proximate does not sell personal information as defined by CCPA/CPRA §1798.140(ad), and Proximate does not share personal information for cross-context behavioral advertising as defined by §1798.140(ah). We have not sold or shared personal information in the twelve (12) months preceding the effective date of this Privacy Policy. If this ever changes, we will update this Privacy Policy, provide notice, and honor any opt-out you have previously recorded (see Section 9.3).
6. Data Retention
We retain each category of personal information only for as long as necessary to fulfill the business purposes described in Section 3, subject to the exceptions permitted by CCPA/CPRA §1798.105(d). The following table summarizes our retention approach:
| Category | Retention Period |
|---|---|
| Account Information, Profile Information | For as long as your account is active. Scrubbed upon exercise of the right to delete (Section 9.2), subject to exceptions below. |
| Listing Information | While the listing is active. Delisted or deleted listings are removed from the marketplace but may be referenced in Transaction Records tied to completed deals. |
| Communications (messages) | For the lifetime of the conversation between the two Users. Messages you sent remain visible to the other party after your account is deleted, appearing as authored by a “Deleted User.” |
| Location Information | Retained as part of the corresponding Transaction Record for the retention period applicable to that record. Not retained separately. |
| Transaction Information, Transaction Records | Retained for the period required by applicable tax, accounting, and dispute-resolution obligations (currently, no less than seven (7) years from completion for records supporting financial transactions). |
| Behavioral / Reliability Data | Retained for the life of the account; certain immutable audit rows survive account deletion as permitted by §1798.105(d)(2) (fraud prevention). |
| Reviews | Retained for the life of the reviewer’s and the reviewee’s accounts and referenced in aggregate reputation calculations. |
| Payment Information | Stripe determines its own retention period for payment credentials it holds; Proximate retains only the Stripe account and customer identifiers for as long as the associated account is active. |
| Device and Usage Information | IP address at registration and device attestation identifiers are retained for the life of the account for fraud-prevention and dispute-resolution purposes; usage logs are retained for a rolling operational window (currently 90 days) except where preserved for an active investigation. |
| Safety and Incident Information | Immutable audit records (reports, disputes, safety cancellations, privacy actions) are retained indefinitely under §1798.105(d)(2) for fraud prevention, safety, and legal-obligation purposes. |
7. How We Protect Your Information
We implement reasonable administrative, technical, and physical safeguards designed to protect your information, including storing passwords in hashed form, delegating payment credential storage to Stripe, restricting access to personal information on a least-privilege basis, using cryptographic device attestation to prevent account fraud, and maintaining tamper-evident hash-chained audit logs for sensitive actions. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.
8. Your Privacy Rights (General)
Depending on where you live and the laws that apply to you, you may have some or all of the following rights with respect to your personal information:
The right to access the personal information we hold about you;
The right to request correction of inaccurate personal information;
The right to request deletion of your personal information, subject to certain exceptions, including information we are required or permitted to retain;
The right to opt out of certain uses or sharing of your personal information;
The right to data portability, where applicable; and
The right to be free from discrimination for exercising your privacy rights.
California residents have additional rights described in Section 9.
9. California Residents — Your CCPA/CPRA Rights
If you are a California resident, you have the following rights under CCPA/CPRA. Where the law provides a self-service in-app mechanism as the preferred fulfillment path, that mechanism is described below. Where an in-app option is not yet available for a particular right, contact [email protected] and we will fulfill the request as described in Section 9.5.
9.1 Right to Know (§1798.100 – §1798.115)
You have the right to know what categories of personal information Proximate has collected about you, the sources of that information, the business purposes for which it is used, and the categories of third parties with whom it has been shared. Sections 2, 2.1, 3, and 5 of this Privacy Policy provide this disclosure at the categorical level.
Self-service: In the Proximate mobile app, open Profile → Download my data. Proximate will build a JSON export containing your profile, listings, conversations, messages you sent, transactions, reviews, reports you have filed, reports filed against you (in aggregate, with reporter identity withheld under §1798.145(a)(4)), reliability disputes, and your prior privacy-actions history. Security credentials (password hash, device attestation keys) are withheld under §1798.145(a)(2).
9.2 Right to Delete (§1798.105)
You have the right to request deletion of the personal information Proximate has collected about you, subject to the exceptions in §1798.105(d), which permit us to retain information necessary to complete transactions, detect and prevent fraud and security incidents, comply with legal obligations, and preserve the integrity of records supporting active or completed disputes.
Self-service: In the Proximate mobile app, open Profile → Delete my account. Upon confirmation, Proximate will scrub the personal information on your profile row (name, email, phone, date of birth, address, IP, device identifiers, Stripe references, profile and card photos) and delete your active listings. Audit rows required to be retained under §1798.105(d) (Transaction Records, transaction events, reports, reliability disputes, cash-safety reports, and the privacy-action log) will be preserved. Messages you sent to other Users are not deleted, because doing so would rewrite the other party’s conversation history; they instead appear as authored by “Deleted User.” The action is irreversible.
9.3 Right to Opt Out of Sale or Sharing (§1798.120)
Proximate does not currently sell or share personal information as those terms are defined by CCPA/CPRA (see Section 5.7). The right-to-opt-out toggle exists as a preference record so that if we ever contemplate such an activity in the future, we can automatically exclude anyone who has previously opted out.
Self-service: In the Proximate mobile app, open Profile → Do not sell or share my data. Toggle it to the “on” position; Proximate will record the timestamp of your opt-out.
9.4 Right to Correct (§1798.106)
You have the right to request correction of inaccurate personal information. Most fields (name, phone, city, state, profile image) can be corrected directly in the Proximate mobile app under Profile → Edit profile. For fields you cannot self-edit, contact [email protected].
9.5 How to Exercise These Rights and Response Timeline
You may exercise the rights above using the in-app self-service options where available, or by emailing [email protected]. Under CCPA/CPRA, we will confirm receipt within ten (10) business days and respond substantively within forty-five (45) calendar days. Where reasonably necessary, we may extend our response window by an additional forty-five (45) calendar days, and we will notify you of the extension.
Before fulfilling a right-to-know, right-to-delete, or right-to-correct request received by email, we may need to verify your identity to a “reasonable degree of certainty” as required by 11 CCR § 7060, by matching identifiers you provide against those we have on file for your account. Requests made through the in-app self-service options are verified automatically by your authenticated session.
9.6 Authorized Agents (§1798.140(j))
You may designate an authorized agent to exercise your CCPA/CPRA rights on your behalf. To do so, provide your agent with (i) written permission signed by you authorizing them to submit the request, and (ii) proof of your identity sufficient to verify the request. We may deny a request from an agent that does not submit proof of authorization.
9.7 Non-Discrimination (§1798.125)
Proximate will not deny you goods or services, charge you a different price, provide a different level or quality of service, or otherwise discriminate against you for exercising any of the rights described in this Section 9. We do not offer financial incentives in exchange for the collection, sale, or retention of personal information.
9.8 Right to Limit Use of Sensitive Personal Information (§1798.121)
You have the right to limit the use of your Sensitive Personal Information (which for Proximate consists of precise geolocation data) to purposes reasonably necessary to provide the services you request. Proximate’s use of precise geolocation is already limited to those purposes (check-in, presence verification, meet coordination — see Section 4). We do not use precise geolocation to infer characteristics about you, for profiling for behavioral advertising, or for any other purpose outside the Trust Process.
9.9 Requests Received in the Prior 12 Months
Because Proximate has not yet formally launched at the time of this Privacy Policy’s effective date, no CCPA/CPRA requests have been received in the twelve (12) months preceding the effective date. This section will be updated annually to reflect actual request counts under 11 CCR § 7102 once the twelve-month reporting window has accumulated data.
10. Children’s Privacy & Child Safety
The Platform is not directed to individuals under the age of 18, and we do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information. Please contact [email protected] if you believe a minor has provided us with personal information.
Zero tolerance for child sexual abuse material (CSAM) or any content that sexually exploits a minor. Uploaded images are scanned for known CSAM at our content-delivery edge and by machine-classified moderation on our servers. Any apparent CSAM is reported to the National Center for Missing & Exploited Children (NCMEC) as required by federal law (18 U.S.C. § 2258A), and the associated account is immediately suspended pending review. Evidence is preserved for the period required by law.
To report a listing or user for a child-safety concern, use the in-app Report action and select “Child safety concern.” Reports flagged under this reason are routed to a priority moderator queue and trigger immediate defensive measures on the reported account.
11. Third-Party Services and Links
The Platform may contain links to third-party websites or services, including Stripe. This Privacy Policy does not apply to those third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you use, including, with respect to payments, the Stripe Privacy Policy referenced in Section 5.2.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Where changes are material, we will provide notice through the Platform or by email prior to the changes taking effect. Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the updated Policy.
13. Contact Us
If you have questions about this Privacy Policy or our data practices, or if you wish to exercise a privacy right, you may contact us at:
Proximate LLC