Shack Privacy Policy

1.1 Controller

Shack AG ("Shack", "we", "us") operates the Shack app, the marketplace in it and the Shack chat assistant (together the "Services"). For anything about your data, write to crew@shack.xyz with the subject "Privacy".

1.2 Representatives in the EU and the UK

EU representative under Article 27 GDPR: Europe Services, SE (https://gdprrepresentative.com), Na Cecelicce 425/4, Smichov, 150 00 Praha 5, Czech Republic. Data subjects may contact the representative at shack.xyz@gdprrepresentative.com regarding the processing of their personal data. Appointment verifiable at: https://gdprrepresentative.com/verify.php?code=R27-7A8C-68BE

UK representative under Article 27 of the UK GDPR: REP27 LTD (company number 17385889, https://rep27.com), Unit 82a James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom. Data subjects in the United Kingdom may contact the representative at shack.xyz@gdprrepresentative.com. Appointment verifiable at: https://gdprrepresentative.com/verify.php?code=UK27-7A8C-68BE

You can contact our representatives instead of us about any data protection matter.

1.3 Scope

This policy covers the Shack app for iOS, the chat assistant on WhatsApp, iMessage, SMS and RCS, the Shack login page with the connector for AI agents (login.shack.xyz), and your contact with our support. It does not cover services of other companies you reach through Shack, such as Apple, Google, WhatsApp, PayPal, TWINT, banks, crypto wallets, websites you import listings from or AI apps you connect to Shack (section 2.16).

The Shack Token ($SHACK) is issued by the Shack Association, a separate Swiss non-profit association. It does not operate the app, and Shack AG does not share your app data with it.

2.1 Account and sign-in

Data: email address, name, username, profile picture or avatar, language and locale, app version, a user ID, the account creation date, and which versions of our Terms and this policy you accepted and when. Optional: social media handles, website, postal address, shipping regions and payment details for buyers (section 2.5). Settings such as favourites, blocked users, follows, referral codes and notification preferences.

Sign-in: with Sign in with Apple (Apple gives us your name and email, or a private relay address), with Google Sign-In (name, email and profile picture) or with your phone number. Google Firebase Authentication handles sign-in.

Private profile: your email address, your name, postal address and phone number, your payment details, devices, favourites, blocked users and the settings of your contact offer are kept in a private part of your profile that only you and our servers can read. Other users see only a shortened name (your first name and the initial of your last name), which payment methods you accept (without the details) and whether you offer contact before a sale. Your full name, address, contact details and payment details go only to the other party of an order (section 2.4).

Basis: contract. Records of accepted Terms: contract and legal obligation.

2.2 Phone verification and fraud prevention

To bid, receive welcome coins and use the chat assistant, you verify your phone number. We store the number and the time of verification. Google Firebase sends the code by SMS and checks the request with a silent push message or reCAPTCHA. We send codes only to countries where Shack is available.

We use the number to tie one account to one person, to prevent fraud (for example welcome coins are given once per number), and to recognise you in the chat assistant.

While your account exists, we keep a list of keyed one-way codes (HMAC) of every phone number your account has verified and of your Apple and Google sign-in IDs. The codes do not reveal the number or the ID. We use them when you sign up or delete your account (section 6), so that welcome and referral coins go once per person and a ban cannot be avoided with a new account.

Basis: contract; legitimate interest in preventing fraud.

2.3 Listings and AI help

Data: photos, title, description, keywords, category, start price, size, condition, shipping options and costs, the listing's location and history (views, likes, bids). When you upload a photo, the app re-encodes it, which removes location data and other metadata stored in the image.

Location of a listing: we place the listing in a grid of about 2 km and show the centre of that grid cell, at most about 1.4 km from your address. This applies in the app, our database and the search index. Your exact address stays private. It is shared only with the buyer after a sale.

AI help: we send your photos, text and keywords to Google's Gemini models (Vertex AI), which suggest a title, description, keywords, size and shipping cost, and translate titles and keywords into other languages. If you import a listing from a web address, we fetch that page and send its content to Gemini. AI also checks photos and text against our content rules for users aged 13 and over and checks whether a photo looks self-taken (section 7). On request, unlocked with 4 coins, Gemini creates an AI comic image from your listing photo. It carries a visible "AI-generated" badge in the app and a marking in its metadata.

AI videos: on request, Shack makes a short video of your listing with AI. To make it, we send the listing photos, title, description and other listing details (such as category, keywords, condition and price) to Google's Gemini and Veo models (Vertex AI). Veo makes the video in the USA. Gemini also compares the finished video with your photos and shows you a hint if it may show a different item. You watch the video and decide whether to publish it. A published video is shown with your listing and when it is shared, labelled as AI-generated, visibly and in the file. A video may show adults, also adults from your photos. It never shows children. A video the comparison flags is kept for 1 year to improve the quality of AI videos.

Basis: contract. Content checks and keeping flagged videos: legitimate interest in a safe marketplace and in reliable AI videos.

2.4 Bids, orders, ratings and contact details

Bids: amount, your maximum bid if set, time and account. Other users see the bid history (up to the last 20 bids) with a shortened form of each bidder's username (for example the first two characters and the last character), the time and the prices that were visible at the time. The app does not show your maximum bid to others.

Orders: winner, seller, item, final price, shipping or pickup address, tracking number and the time of each step (for example paid, shipped, delivered).

Ratings: after a sale, buyer and seller rate each other. Ratings appear on profiles.

After a sale: buyer and seller see each other's name, postal address, phone number and email, and the seller's payment details, so they can pay, ship or arrange pickup. Our Terms forbid any other use of these details.

Contact before a sale: a seller can offer to be contacted before a sale. Other users then see that the seller offers this. Signed-in users can unlock the phone number or email address the seller gave for this, free of charge or with coins as shown in the app, and message the seller directly. We store who unlocked access to whose contact details.

Basis: contract (with you, and to enable the sale between users). Ratings also: legitimate interest in trust between users.

2.5 Payment details, coins, chests and avatars

Payment details for buyers: sellers can store a crypto wallet address (BTC, SOL, DOGE, USDC), a PayPal handle, a TWINT phone number or an IBAN. We show them only to the buyer of your item. Other users see only which payment methods you accept. We never handle payments between users. Blockchain transactions are public and permanent. Once someone knows that an address is yours, they can link its transactions to you.

Coin purchases: you buy coins through Apple's In-App Purchase. We never see your card or bank details. Apple and RevenueCat give us a purchase record: product, price, currency, date, transaction ID and your user ID.

Coins and items: your coin balance and coin transactions (purchases, welcome and referral coins, and coins used to unlock boosts, badges, AI comics, chests, avatar items, contact access or social media ad requests), your avatar, the items you got and when you opened free chests. Rare finds may appear in the public live feed and your rank on the leaderboard.

Social media ad requests: if you unlock a social media ad for a listing with coins, our team uses the listing's photos and text to create an ad on Meta platforms (Facebook, Instagram) or TikTok. Only the listing content is used.

Basis: contract. Accounting records of purchases: legal obligation.

2.6 Age and parental consent

Data: your confirmation that your parents agree (asked once before the first bid or listing if you are under 18), and whether you are at least 18. To check this before your first bid, listing or coin purchase, or when you first open the token screen, the app uses the age range that Apple shares through its Declared Age Range feature on supported devices, or asks you. We store only the result, not your date of birth.

Basis: legal obligation; legitimate interest in protecting minors.

2.7 Location

Device location: if you allow it, the app uses your location while you use it to show auctions near you. We send it with your search to our search backend and to Algolia. We do not track your location in the background. You can turn it off in iOS settings.

Addresses: Apple's map services suggest addresses and convert them into coordinates, which we use for distances and the approximate listing location.

The app accesses the camera or photo library only when you take or pick a photo. With the iOS photo picker, it receives only the photos you select. It does not access your contacts or your microphone.

Basis: contract (showing auctions near you, which you choose by allowing location). The app reads your device location only with your iOS permission, which you can withdraw at any time in iOS settings.

2.8 Community, activity feed and moderation

You can join public and private groups, start discussions, ask and answer questions on listings, comment, like and follow. We store what you post, when and where. Public content is visible to all users, private group content to the group's members. People who follow you see your activity in their feed, such as new listings and bids.

Automated checks: AI and keyword filters check listings when they are published or changed, and comments, discussion messages, usernames, profile photos, profile links and search terms, against our content rules. If the check of a listing is unsure or fails, the listing stays online and our team reviews it.

Reports: when you report a listing, profile, comment or message, we store your user ID, the reported content with a snapshot of it, the reason you chose, your note and the time, and add the report to our review queue.

Moderation log: for each decision we record the measure, the reason, the rule of our Terms or the law concerned, whether the decision was automated or made by a person, the facts, the time, the reports it is based on and what is needed to undo it. The person affected receives a statement of reasons in the app, and reporters are told the outcome.

Appeals and blocks: when you appeal a decision, we store your appeal, the decision it concerns and our answer. When you block someone, we store the block in your private profile.

Basis: contract. Moderation: legitimate interest in a safe marketplace; legal obligation where the Digital Services Act applies.

2.9 Chat assistant

"Shack" is an AI assistant you can write to on WhatsApp or by iMessage, SMS or RCS. You are talking to an AI, not a person. It recognises you by your verified phone number. It turns photos into listing drafts, transcribes voice notes, searches auctions, prepares bids (you confirm each with a button within 5 minutes) and answers questions about your account.

We process: your phone number, your messages, photos and voice notes (audio is sent to Gemini for transcription), and message metadata (sender, type, time, message ID, delivery status). The text of incoming messages is deleted from our log after processing. We also keep:

• memory: the last 20 turns and up to 20 short notes about your preferences, without sensitive information such as health, religion, political views or sexual orientation;
• search history: your last 50 searches, shared between app and assistant;
• feedback: reports when you tell the assistant something did not work.

"Forget me": write "forget" (or "vergessen") and confirm with the button. We then delete the assistant's memory. Search history and feedback stay until you delete your account.

Channels: WhatsApp messages go through Meta's WhatsApp Business Platform. iMessage, SMS and RCS go through our provider Linq (USA), Apple and your carrier.

Messages we start: when you verify your phone number, the app shows the switch "Use Shack on WhatsApp too". It is off unless you switch it on. If you switch it on, we store the time and send you a welcome message on WhatsApp. We send messages you did not request in the chat only with this consent. Write "STOP" in the chat at any time to stop them, or block the number. We then put your number on our list of numbers that wrote "STOP", as a one-way code formed with a secret key (HMAC). The code does not reveal the number, and the list holds no phone numbers in clear text. Before we start a chat, we form the code of the number and check the list. The code stays on the list also after you delete your account, so that we never start a chat with you again. If you write to the assistant yourself, it still answers.

Basis: contract. Messages we start: consent. "STOP" list: legal obligation and legitimate interest in respecting your objection. Feedback: legitimate interest in improving the assistant.

2.10 Search and demand trends

When you search, we send your search terms, filters and, if allowed, your location to Algolia. Gemini helps interpret search requests and checks search terms against our content rules. Public profiles (username, avatar, ratings) are searchable. We combine searches into anonymous statistics that Shack shows publicly as "Demand". They contain no personal data.

Basis: contract. Demand statistics: legitimate interest in showing market trends.

2.11 Analytics, crash reports and performance

Firebase Analytics records how the app is used, for example which screens and features are opened, with device type, operating system, app version, country and a random app instance ID. We do not send your user ID or the iOS vendor ID, and ad personalisation signals are off. Analytics data is not linked to your account.

• EU/EEA and UK: Analytics runs only if you agree in the dialog the app shows. You can change your choice in Settings at any time. If you are under 16 (or the lower age of digital consent in your country), only a parent may agree for you. Basis: consent.
• Elsewhere: Analytics is on by default. You can turn it off in Settings. Basis: legitimate interest in understanding and improving Shack.

Crashlytics sends us crash reports (device type, operating system, app version, app state at the crash) without your user ID. Performance Monitoring measures load times and network speed without your user ID. We count how often listings are shown, in total, without recording who saw them. Basis: legitimate interest in a stable, working app.

No advertising tracking. The app contains no advertising or tracking SDKs and does not use the iOS advertising identifier. If you share a listing to Instagram Stories, iOS hands the image to Instagram. No SDK is involved.

2.12 Push notifications, support and security

Push notifications: if you allow them, we store a push token and a device ID and send notifications through Apple and Firebase Cloud Messaging about your auctions, bids, orders and messages. Basis: contract. The app sends them only with your iOS permission, which you can turn off at any time in iOS settings.

Support: when you contact us, we process your contact details, your message and the account and order data needed to help. Basis: contract; legitimate interest.

App security: the app proves to our servers that it is a genuine copy of Shack (Firebase App Check with Apple App Attest or DeviceCheck). Our servers log technical data such as IP address, time and request, and we keep audit logs of access to data. Basis: legitimate interest in security.

2.13 Identity verification (past)

Until 27 October 2026, Shack offered identity verification through Footprint (USA). It is no longer offered. We are deleting the results of past verifications at Footprint and the verification records in our database.

2.14 Token screen

The app has an information screen about the Shack Token with price chart, holders and trades from public sources (GeckoTerminal, DexScreener, Solana RPC, Helius). The app sends them no account data. They see your IP address when the screen loads, like any website. Buttons open Jupiter, Phantom or Solflare under their own terms. The screen is not shown to users under 18 or in countries where it is restricted.

2.15 Other sources, legal claims and general points

We receive data from Apple and Google (sign-in), Apple and RevenueCat (purchases), other users (ratings, reports, mentions, sales), websites you import listings from, Meta and Linq (assistant messages), and AI agents you connect (your requests and photos, section 2.16).

We also use data where needed to comply with the law, answer authorities, enforce our Terms and defend legal claims (legal obligation; legitimate interest).

Legitimate interests are a safe and trustworthy marketplace, fraud prevention, a stable and secure app, understanding how Shack is used, and defending our rights. You can object to such processing (section 10). Consent can be withdrawn at any time for the future, in the app, in iOS settings or by writing to us. Storage on your device: we read or store information on your device without asking only where it is strictly necessary for a feature you use (sign-in, push token, app security, caching, crash reports). Analytics in the EU/EEA needs your consent.

2.16 AI agents (connectors)

You can connect an AI app of another company, such as Claude (Anthropic), ChatGPT (OpenAI) or Grok (xAI), or another app that supports the Model Context Protocol (MCP), to your Shack account. We call such an app an "agent". Connecting is optional and starts only from your AI app: you add Shack there, sign in on our login page (login.shack.xyz) with the same Apple or Google account as in the Shack app, and choose which permissions to give. The page shows which app is asking and whether we could verify it.

What an agent can do for you:

• Search running auctions on Shack. It sees what everyone sees: title, current price, number of bids, end time, approximate place, the first photo and the link. No permission is needed for this.
• "See your auctions and drafts": list and view your own listings and drafts: title, status, start and current price, currency, number of bids, end time, duration, category, condition, delivery options, number of photos, a link to the first photo and the listing link.
• "Create and edit auction drafts": turn photos into a private draft, and change a draft's title, start price, condition and delivery options. The agent sends us the photos, gives us a web address we download them from, or shows you a link to our login page where you upload them yourself. As with drafts in the app, Google's Gemini models check the photos and suggest title, keywords, category, start price and duration (sections 2.3 and 7). At most 40 drafts per day.
• "Publish drafts": make a draft a live auction. This permission is off unless you tick it.

An agent cannot bid, buy, write to other users, or see your orders, address, contact details, payment details, coins or other users' data beyond public listings. To create and publish drafts, our servers use your profile (for example country, language, currency and whether your seller details are complete). We do not send it to the agent. If details are missing, we tell the agent which ones, not their content. A listing created through an agent records which agent created it.

What the AI provider receives: the provider of your AI app receives your requests to Shack, everything our tools return as listed above, and anything you share with it in its app. It processes this data under its own terms and privacy policy as an independent controller, not on our behalf. What it stores, for how long and where depends on that provider and your settings there. We send the data because you ask us to (section 4).

What we store:

• the connection: your user ID, the name and web address of the app, whether we verified it, the permissions you gave, when you connected and when the agent last used it;
• tokens: access tokens, refresh tokens and one-time sign-in codes, only as one-way codes (SHA-256 hashes), with your user ID, the connection and the permissions;
• the app's registration: its name, return addresses and logo address, without data about you;
• upload links and photos you upload through them, until they become a draft or the link expires;
• counters for rate limits, under a one-way code of the IP address, user ID or connection, and the daily count of drafts;
• server logs of connections, drafts, publications and errors, with connection ID, app name and listing ID, and of each request with IP address and time.

Disconnecting: sign in on login.shack.xyz to see your connected agents and disconnect any of them. This deletes the connection, its tokens and any photos uploaded for it at once. If you remove Shack in your AI app, the app may also revoke its access. Otherwise its tokens expire (section 5). You can also write to crew@shack.xyz. Drafts and listings the agent created stay in your account. You manage them in the app. Data the provider already received stays with the provider. You can delete it there.

Basis: contract (you ask us to act for you through the agent). Logs and rate limits: legitimate interest in security and preventing abuse.

3.1 Other users

• Everyone on Shack: your public profile (username, picture or avatar, a shortened name, ratings, member since, which payment methods you accept and whether you offer contact before a sale), listings with their approximate location, public posts, bids with your username, live feed finds and leaderboard rank.
• Your followers: your activity in their feed.
• Members of a private group: what you post there.
• The other party of an order: your full name, address, phone number, email and, if you are the seller, your stored payment details. Only the buyer and the seller of that order receive these details.
• Users who unlock your contact offer: the phone number or email address you gave for contact before a sale.

3.2 Service providers (processors)

They process data only on our behalf and under a contract.

3.3 Independent recipients

These process data under their own responsibility: Apple (Sign in with Apple, In-App Purchase, Declared Age Range, App Attest, DeviceCheck, Apple Maps, push delivery, iMessage); Google (Google Sign-In, reCAPTCHA); Meta (WhatsApp itself; ad platforms for listing ads you request); providers of AI agents you connect, such as Anthropic (Claude), OpenAI (ChatGPT) and xAI (Grok), for the data your agent requests (section 2.16); TikTok (ad platform for listing ads you request); mobile carriers (SMS); your trading partners; professional advisers bound to confidentiality; authorities and courts where the law requires it or to protect rights and safety; and a buyer or successor of our business, after we tell you.

3.4 No sale, no sharing for advertising

We do not sell your personal data and do not share it for cross-context behavioural advertising or targeted advertising.