Privacy policy

When you join. Your email address, a password, a username and a display name. Your password is stored as a one-way hash, so we can't read it. Your username is public and is part of your closet's web address.

Your profile. Anything you add: avatar, bio, location, favorite genres, banner, mood line, profile song and similar touches. These are public. If you give us your birth year, it stays private and is used only to award the "older than you" mark.

What you post. Photos, item titles, notes, sizes, condition, prices, acquisition stories, posts, comments, wall posts, hashtags, mentions, likes and follows. Most of this is public by design. See "Who can see what" below.

Photo metadata. Phone and camera photos often carry hidden data called EXIF. When you upload, our server reads the date the photo was taken, its GPS location if present, and the camera model. We store the date and the camera with the photo. Since 9 October 2026 we don't store the GPS location. We then strip all metadata from every file the site serves, and we delete the original upload. See "Photos and location" below.

Messages. Direct messages between members are stored so the conversation works. They are not public.

Invites and the waitlist. MerchVice launches by invitation. If you join the waitlist, we store your email address, where on the site you joined it, and when, so we can invite you later. If you join through someone's invite link, we record who invited you. Referral counts may appear as marks on the inviter's profile.

Band claims. If you claim a band page, we store your claim, the evidence you submit, a contact email, and our decision.

Reports and moderation. If you report something, we store the report and your note. If something you posted is reviewed, we keep a record of the review and its outcome.

Technical data. Our servers see your IP address and basic request details such as browser type and the page requested. We use IP addresses to limit abuse, for example too many sign-in attempts in a minute. Server logs are kept for a short period for security and debugging.

Page speed. On about one page load in ten, your browser sends us three timing numbers: how long the page's main content took to show, how quickly it answered a tap, and how much it shifted while loading. With them come the kind of page (for example "a band page", never its address) and whether the screen is phone-sized. Nothing in them names you or your account, and we don't keep your IP address with them. We keep these numbers for 30 days, to find the pages that are slow on real phones.

The tag dater and Shirt ID. These tools read photos of a shirt for anyone, signed in or not. See "The tag dater and Shirt ID" below.

We don't collect payment card numbers. Payments go through Stripe, which handles card data directly.

• To run your account, sign you in and keep you signed in.
• To show your closet, posts and profile to the people you've chosen to share them with.
• To build feeds, notifications and the weekly digest from the members, bands and tags you follow.
• To send email you need, such as verification, password resets, and messages or replies you've asked to hear about. You can turn off social and digest email in settings, and every digest has a one-click unsubscribe.
• To keep the community safe: rate limits, spam checks, reports and review.
• To fix bugs and understand what's working, using our own database, not third-party analytics.

Our feeds are chronological. We don't build an advertising profile of you, and we don't rank you.

Public. Your username, display name, profile, closet items, posts, comments, likes and follows are public. When the site is open to everyone, anyone on the web can see them, and search engines may index public pages.

During the gated launch. While MerchVice is in teaser or invite mode, content pages are visible only to members and invited visitors, and we tell search engines not to index them.

Not public. Your email address, password, direct messages, private birth year, photo GPS when location is off, and your settings.

Suggestive content. Posts marked suggestive are hidden from visitors and from members who haven't switched them on. They are never listed for search engines.

Blocks. If you block someone, they can't message you, comment on your things or mention you. Blocking does not hide your public items from them.

Your photos are resized into a few web sizes. Every served copy has its metadata removed. The original upload is deleted after processing.

We keep the date taken and the camera as private fields on the photo. They help with things like pre-filling the date of a show and, later, provenance.

Since 9 October 2026 we don't store a photo's GPS location. For the first photo of a booth shot, our server uses it once, to suggest the show: it looks for venues near where you took it, MerchVice's own first, then asks MusicBrainz for places near that point rounded to about 100 meters. Then the location is dropped. For every other photo it isn't used at all. Photos uploaded before 9 October 2026 may still have their GPS location stored as a private field until we finish clearing it, and we never send it to anyone's browser unless you turned location on.

Location shows only when you choose. It is off by default for closet items and on by default for booth shots, since a booth shot is about a place and a show. You can change it per item or post. When location is off, we don't send it to anyone's browser.

We never use photo GPS for band stats, and we never put location or EXIF in data meant for search engines.

The tag dater (merchvice.com/tools/tag-dater) reads up to three photos of one shirt: its tag, and if you add them, the stitching and the back print. Shirt ID ("What shirt is this?") reads one photo of a shirt's front, and How was it printed?, when we switch it on, reads one close photo of a print. They work the same way for visitors who aren't signed in and for members.

• Who says yes. A visitor ticks "Let AI read these photos" each time, and nothing is sent without the tick. A member is covered by their answer to "Let AI suggest details from your photo?", the same answer that covers suggestions in the composer: until they say Yes, nothing is sent.
• What is sent. Our server shrinks each photo to at most 1024 pixels and removes its metadata, GPS included. It then sends the photos, with our instructions, through OpenRouter's API to DeepSeek's models, which read them. Your name, email and account are not sent. Every request asks for providers that do not collect or train on the data.
• What we keep. The photos stay in our server's memory while they're read. We don't write them to storage, to disk or to our logs, and they're gone once the answer comes back, unless you make a share link (below). Shirt ID also makes a picture fingerprint of the photo on our own server, compares it once with photos on MerchVice, and drops it. For each read we keep a usage record: the tool, the model, the size of the request and the answer, the cost, how long it took and whether it worked, and for a member, their account. These records have no set end date. When a member deletes their account, their account is taken off them.
• Share links. Under a tag dater result, "Share this result" makes a public link at merchvice.com/d/ followed by a random code that can't be guessed. The link shows the likely range and the tag maker, never your name or account. Only if you tick "Make this shareable" do we keep the tag photo with it: re-encoded on our server with its metadata, GPS included, removed. The link and its photo are deleted after 90 days, or sooner if we take it down.
• Was this right? Under a result you can answer yes or no, and with a no, the year you think it is. We keep the answer with what the dater showed (the range, the maker, the tag's printed details and the rules it used) to make the dater better. Not your photos, your name, your account or your IP address.
• What OpenRouter and DeepSeek keep. How long they hold a request is up to their own terms; we can't see or set it. What we control is the no-collection setting every request carries, and our client refuses to send a request without it.
• The bot check. Before a visitor's read, Cloudflare Turnstile checks that the visitor isn't a bot. Its widget loads from Cloudflare in your browser and sends Cloudflare signals about your browser and device. Our server then sends Cloudflare the widget's answer and your IP address to confirm it. Members aren't checked.
• Daily limits. We count reads by IP address or account to apply daily limits. Those counts are deleted after about a day.

When a seller uses "Date it from the tag" on a listing, the dater reads the tag photo already on that listing, and the range it finds is saved on the listing.

We use a small number of service providers. They process data for us under their own terms and security practices.

• Railway: Hosting, our Postgres database, and photo storage. Where: United States.
• Resend: Sending email. Where: United States.
• Cloudflare: Every visit to merchvice.com passes through Cloudflare's network on its way to our servers, and Cloudflare Turnstile runs the bot check on the tag dater and Shirt ID for visitors who aren't signed in. Where: United States and other countries where Cloudflare operates.
• Stripe: Payments and seller payouts, for the invited group that can buy and sell today. Where: United States and other countries where Stripe operates.
• OpenRouter, routing to DeepSeek: Suggestions in the composer and photo descriptions, only for members who said Yes. We ask before the first time: nothing you made is sent until you agree, and Not now sends nothing. Once you agree, a copy of the photo you upload, with its location and other photo details already stripped, is sent through OpenRouter's API to DeepSeek's deepseek-v4.1-flash models. Your name, email and messages are not sent. Every request asks for providers that do not collect or train on the data, and we never train on your content. You can change your answer in Settings at any time. See How we use AI. Photos for the tag dater and Shirt ID go the same way, for members who said Yes and for visitors who tick the box each time (see "The tag dater and Shirt ID").

We look up band names against MusicBrainz, a public music database. Those lookups contain the band name typed, not your personal data. For the first photo of a booth shot, we also ask MusicBrainz for places near where it was taken, rounded to about 100 meters (see "Photos and location").

When you add an allowed embed, like a Spotify, Bandcamp or Apple Music player, that service loads in a frame on the page and its own privacy policy applies to it.

When you search for a profile song, our server sends the words you typed to Apple's iTunes Search API, and nothing about you. The cover art in the results loads from Apple in your browser.

Automated help with moderation. An image check runs on our own server at upload to flag possible nudity; it sends nothing to anyone. When we switch it on, we also use an AI service to suggest how to sort reports, spot spam, flag abusive tags and spot duplicate band pages. This is for safety, not suggestions, so it does not depend on your AI choice: it may send the reported post, message, profile or tag, the reporter's note, and a new member's posts through OpenRouter, under the same no-collection and no-training rules. It is off until an admin turns it on. These tools only suggest. A person makes every decision to remove content or suspend an account.

We share data otherwise only when the law requires it, to protect people from harm, to enforce our terms, or if MerchVice is sold or merged, in which case this policy follows the data.

We don't sell personal data. We don't share it for cross-context behavioral advertising either.

We keep cookies to what the site needs. Every cookie MerchVice sets is our own, none is for advertising or tracking, and none asks for your consent. Here is each one, what it does and how long it lasts:

• Session (better-auth.session_token): keeps you signed in. It lasts 7 days and renews as you use the site. Signing out ends it.
• Session check (better-auth.session_data): a short copy of your session, so pages load without looking it up each time. It lasts 1 minute.
• Sign-in with a provider (better-auth.state): set when you sign in, join or connect an account with Google, Apple, Facebook or Spotify, to check that the answer coming back is for this browser. It lasts 5 minutes.
• Remembered browser (mv_device): a coded note, never your email or your account's id, that this browser has signed in to your account before, so someone typing wrong passwords for you from elsewhere can never lock you out here. It lasts up to 400 days. Resetting your password or signing out everywhere makes every copy useless.
• Joined here (mv_join): for up to a week after you join, lets the link we email you sign in only the browser you joined from.
• Invite (mv_invite): remembers an invite link for up to 30 days so you can finish joining.
• Where you were going (mv_return): if you opened a shared item before the site let you in, remembers that item's page for up to 30 days, so you land there once you've joined.
• Where you came from (mv_from): if you arrive on a band, item, show or member page, the tag dater or an invite link before you join, keeps a note of that page for up to 7 days, so your first steps start there. It's deleted once you're past your first steps, or when you sign out.
• I have this too (mv_have): remembers the item you tapped "I have this too" on while you join, for up to 7 days. It's deleted when the composer opens with it, or when you sign out.
• Pressed before joining (mv.intent): if you pressed follow, like or watch before joining or signing in, this ties what you pressed to this browser session, so we can offer to finish it once you're back. It ends when you close the browser. What you pressed is kept in your browser's local storage for up to a day.
• Shuffle (mv_seed): keeps archive rows steady while you page through them. It lasts 30 minutes.
• Hidden home rows (mv_hidden_rows): if you hide a row on the home page while signed out, remembers it for 30 days. A member's choice is saved on their account instead.
• Not now on a house ad (mv_house_ad_hidden): if you choose Not now on one of MerchVice's own promotions while signed out, hides it for 30 days. A member's choice is saved on their account instead.
• Industry pages (mv_industry, mv_industry_role and mv_industry_for): set only on the industry pages (merchvice.com/industry), which open from a private link Ed shares. They remember the link, the path you picked there, and the name the link was shared with, for 180 days.
• Admin preview (mv_promo_preview): set only in an admin's browser when they preview promotion slots. It lasts a year or until they turn the preview off.

On the live site, the three sign-in cookies' names start with "__Secure-". Your light or dark theme choice is saved in your browser's local storage, not a cookie. Rate limiting uses your IP address, not a cookie.

No advertising cookies. No third-party trackers. Some services we load follow their own policies and may set their own cookies: Cloudflare's bot check on the tag dater and Shirt ID, Stripe's checkout on the checkout page, and embeds you choose to load.

We keep your data while your account exists.

When you delete an item, it disappears from the site right away. We keep the record and its photos for a while so a mistake can be undone and so moderation history stays intact.

When you delete your account, it happens right away. We sign you out everywhere and delete your sign-in, your profile, and your closet, posts, comments, likes and follows, with every stored size of every photo you added to them. The messages you sent read "Message deleted" for the other person. Some things stay:

• Your marks' places in line, with nothing that names you, so other members' numbers never move and yours is never given to anyone.
• Reports and moderation decisions, with your name, account and words taken off.
• Anything under review or on legal hold. If someone reported something you posted and a moderator hasn't decided yet, or we've placed a legal hold on it, that item, its photos and the report stay, hidden from everyone but our moderators, until the review or the hold ends. A report that a post harms a child places a hold on its own, and so does our removing material because it harms a child. We keep that material for at least one year from the report or removal, as US law asks of services that report it, and until one of our admins confirms the matter is closed. Then it's deleted.
• Copyright takedown notices and counter-notices, kept whole for three years after the decision as legal records. Your account is no longer linked to them, but a counter-notice you sent still carries the name and contact details you gave in it.
• A scrambled copy of your email address (a keyed hash: we can check whether a new sign-up uses the same address, but can't read the address back). We keep it to enforce a ban or suspension, and to carry over strikes, if someone joins again with that address, for three years or until a suspension ends if that's later, and so we don't email the address in the meantime. Joining again with it ends the email block.
• Photos you added to a band's page as its manager (a band photo, banner or lineup photo), or a photo of yours on a tag page. They stay on the band's or the tag's page, because they belong to that page, not your closet. Ask us at hello@merchvice.com and we'll take any of them down.

Records of completed sales for tax and accounting, and anything else we must keep by law, stay too. Backups roll off within 30 days.

We keep your waitlist email until you ask us to remove it at hello@merchvice.com, or until you delete a MerchVice account that uses the same address. Being invited, or joining, doesn't remove it on its own. The one exception: if you were added to the list because your invite run filled before you verified your account, your place comes off when we let you in.

• See and edit. You can view and edit your profile and everything you've posted.
• Delete content. You can delete any item, post or comment you made.
• Delete your account. In Settings, under Your account, choose Delete your account. You confirm with your password, or by signing in again with Google or Apple if that's how you sign in. You don't have to sign in: at merchvice.com/delete-account, enter your account's email and we send that address a link that works once, for 30 minutes. It opens a page that offers you a copy of your data, then deletes the account when you confirm. We answer the same whether or not the email has an account, so the page never tells anyone who is a member. Or email hello@merchvice.com from your account's address and we'll delete it within 30 days.
• Get a copy. In Settings, under Your account, choose Download your data. We build one JSON file of everything you've added, with the messages you sent and the ones sent to you, and email you when it's ready; the download link works for 7 days while you're signed in, or through your delete link while it works.
• Email. Change what we email you about in settings, or unsubscribe from the digest in one click.
• Location. Turn photo location on or off per item.

Depending on where you live, such as California or the EU and UK, you may have further rights, including correction, restriction and objection. Ask at hello@merchvice.com and we'll answer within the time the law allows. You can also complain to your local data protection authority.

MerchVice is run from the US, and your data is stored in the US. If you join from elsewhere, your data is transferred to the US.

MerchVice is for people 13 and older, or 16 and older where local law requires it. We don't knowingly collect data from younger children. If you think a child under that age has an account, tell us at hello@merchvice.com and we'll delete it.

Passwords are hashed. Connections use HTTPS. Uploads go through signed, short-lived links. Served photos carry no metadata. Access to production systems is limited to the people who run MerchVice.

No system is perfect. If we learn of a breach that affects you, we'll tell you as the law requires.

We'll update this policy as MerchVice grows, especially when selling and trading arrive. We'll change the effective date at the top, and for meaningful changes we'll tell members by email or on the site before they take effect.

MerchVice, Ed Crotty hello@merchvice.com