Privacy Policy

YList is a classified ads board. We collect the minimum needed to run it: your account details, the ads you post, messages you send to other users, and resumes you build. We never sell your data. Your email address is never shown to other users. We keep dormant accounts for 2 years, then delete them. If you have questions, contact us.

Account information. When you sign up we collect your email address, display name, and password (or your Google account identity if you sign in with Google). You must be 18 or older to post; we do not knowingly collect information from anyone under 18.

Your ads. Everything you put in a listing: title, description, price, category, municipality, photos, and any contact details you choose to include (phone number, organizer email). Free ads are marked “Free” — we never publish your payment details.

Messages. When you use the on-site message board to contact another user about an ad, we store the messages in both parties’ inboxes. For dispute resolution, administrators can read message threads, but no other user ever sees them. We never display your email address on the site or to other users — not even in the inbox. (Jobs and Gigs ads intentionally use direct email contact instead; see below.)

Resumes. The resume builder is the most sensitive part of the site. Your resume data is private to your account, visible to nobody else — not other users, not the public. The builder produces a PDF on your device; YList never sends or transmits your resume anywhere.

AI processing. Two optional features send text to our AI provider (Anthropic):

• Resume writing help (“Polish my writing”) sends the text you choose to polish for grammar and clarity corrections. Limited to 10 checks per day, signed-in users only. We never add or invent facts about you.
• Job/Gig posting assist sends text you paste or drop in (5 MB limit; extracted in memory, never stored) so it can fill in the title, description, pay, phone, and email fields for you to review.

In both cases the AI provider processes the text only to perform the task; nothing is stored by us from these calls.

Location detection. When you first visit YList, we estimate your area from your IP address so the board opens on your part of the world. That estimate is used only to pick the starting place: a place you save always wins, and picking a place yourself overrides the guess. If we can’t tell where you are — for example, you’re using a VPN — we ask you to pick a place instead. That estimate happens only on your first visit. After that, your saved place (or the place you pick) is what the board uses — we don’t keep estimating your location on every visit.

Usage and analytics. We collect standard site analytics (pages visited, referrers, approximate location) via Vercel Analytics to understand how the site is used. Cloudflare Turnstile is used on sign-in pages to block bots.

• To run the site: show your ads, route your messages, and operate your account.
• To keep the board safe: user flagging (5 flags hide an ad pending human review), strike counting on upheld violations (3 strikes = suspension), and dispute review by admins.
• To contact you: service messages about your account and, once set up, notifications about new messages on the board.
• We do not sell personal data. We do not use your data for third-party advertising.

Anonymous visitors see only what’s public: ad content, photos, prices, and “Message seller” buttons. No emails, no accounts.

Signed-in users see the same public content, plus their own account and inbox. They never see your email address.

Administrators (the YList team) can see the contact details you provided and read message threads, solely to investigate flags, disputes, and abuse.

Jobs and Gigs exception: by design, job and gig posters show their own contact email so applicants can email resumes directly from their own email client. Applications never pass through YList — the bulletin board, not the post office. This is the one place a poster’s email is visible, because it’s a business hiring, not a private seller.

Ads expire automatically (30 days; event ads expire the day after the event) and photos are cleaned up after a 7-day grace period.

Dormant accounts: if you don’t sign in for 2 years, we consider the account abandoned. About 30 days before we act, we send a warning to the email on your account. If you sign in, the clock resets. If you don’t, we delete the account and everything in it: profile, ads, photos, and resumes.

Suspended accounts: we keep a minimal record (account identifier and the reason for suspension) so a banned user can’t return under the same email. Everything else is deleted on the same schedule.

You can edit or delete your ads at any time (My Ads). Deleting your account removes your ads with it. To request a copy of your data or ask questions, contact us.

Accounts require email verification; sign-in is protected by bot checks. One-time setup tokens are used for deployments and deleted immediately. No system is perfect, but we keep collection minimal so there’s less to lose.

We’ll update this page when the policy changes and note the new effective date. Material changes will be announced on the site.