1. Introduction

The Knew York Times (“we,” “us,” or “our”) operates the kytimes.ai platform (“Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By using the Service, you consent to the practices described herein.

2. Information We Collect

Account Information

When you create an account we collect your name, email address, and profile information. If you sign in via Google OAuth or Apple Sign In, we receive the profile data those providers share (typically name, email, and profile picture).

Payment Information

Payments are processed by Stripe. When you place a bid or make a purchase, Stripe collects your payment card details directly. We do not store your full card number on our servers. We receive limited transaction information from Stripe, such as the last four digits of your card, card brand, and billing address, to display on your receipts and for fraud prevention.

Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, timestamps, browser type, device information, IP address, and referring URLs. This data is collected through Vercel Analytics and standard server logs.

User-Submitted Content

We store content you submit to the Service, such as book listings, descriptions, author biographies, and cover images.

3. How We Use Your Information

We use the information we collect to:

• Operate, maintain, and improve the Service.
• Process bids, payments, and refunds.
• Create and manage your account, and authenticate your identity.
• Send transactional emails (bid confirmations, payment receipts, account notifications) via Resend.
• Analyze usage trends and measure the effectiveness of features via Vercel Analytics.
• Detect, prevent, and address fraud, abuse, and technical issues.
• Comply with legal obligations.

4. Third-Party Services

We rely on the following third-party services to operate the platform. Each has its own privacy policy governing the data it processes:

• Stripe — payment processing and billing.
• Google OAuth — optional account authentication.
• Apple Sign In — optional account authentication.
• Resend — transactional email delivery.
• Vercel Analytics — privacy-friendly website analytics.
• Open Library API — book metadata and cover images.

We do not sell your personal information to any third party.

5. Cookies and Tracking

We use cookies and similar technologies for the following purposes:

• Essential cookies — required for authentication, session management, and security. These cannot be disabled.
• Analytics cookies — used by Vercel Analytics to understand how visitors interact with the Service. These are privacy-friendly and do not track users across sites.

You can control cookie preferences through your browser settings. Disabling essential cookies may impair your ability to use the Service.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, regulatory, or fraud-prevention purposes. Aggregated, anonymized data that cannot be used to identify you may be retained indefinitely for analytics purposes.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your personal data, subject to legal retention requirements.
• Data Portability — request an export of your data in a commonly used, machine-readable format.
• Withdraw Consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at contact@kytimes.ai. We will respond within 30 days.

8. Children's Privacy

The Service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us at contact@kytimes.ai.

9. Data Security

We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Effective date” at the top of this page and, where appropriate, notify you via email or an in-app notice. We encourage you to review this page periodically for the latest information on our privacy practices.

11. Contact Information

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at contact@kytimes.ai.