Privacy Policy
Effective date: November 11, 2026. Contact: support@birchlocal.app, 14 Plains Road, Ipswich, MA 01938.
1. Who we are and the short version
Birch Local LLC ("Birch", "we") runs birchlocal.app, a marketplace where people in Massachusetts and the New Hampshire Seacoast book neighbors for everyday help. This policy explains what personal information we collect, why, who we share it with and the choices you have.
The short version:
- We collect what we need to run bookings: your name, contact details, town, the job address, messages and booking history.
- Card numbers go straight to Stripe, our payment partner. We never see or store them.
- Your exact address is shown to a provider only after they accept your request. Phone numbers are never shown to other members.
- We do not sell your personal information, and we do not share it for targeted advertising.
- You can download a copy of your data or delete your account at any time from Account settings.
2. What we collect and why
| Information | Where it comes from | Why we use it |
|---|---|---|
| Name, email, mobile number (optional), town, password (stored only as a secure hash) | You, at sign-up | Your account, sign-in, notices about bookings |
| Profile photo, "about you" details, notification preferences | You | Your member page and how we contact you |
| Booking details: date, time, job address, notes, hours, prices, status | You and the provider | Arranging and completing the job; receipts; resolving problems |
| Payment details: card brand, last 4 digits, expiry, Stripe references | Stripe | Charging for bookings and gift cards, refunds. Full card numbers stay with Stripe |
| Messages, reviews, problem reports, support tickets, forum posts and ideas | You | Running the service, safety, support and moderation |
| Provider details: bio, services, prices, photos, towns served, referrer | Providers | Showing your listing and vetting you |
| Provider identity and bank details (legal name, date of birth, last 4 of SSN, address, bank account) | Stripe collects these directly | Verifying identity and paying out. Birch sees only the status (for example, "payouts set up") |
| Background check results (only if that program is enabled) | Checkr, with your consent | Showing the Background Checked badge |
| Gift card recipients' name and email | The buyer | Delivering the gift card |
| Invite codes and who invited whom | You | Giving invite credit |
| Device and browser details you choose to attach to a support ticket | You | Fixing the problem you reported |
| Usage data: pages viewed, clicks on key buttons, approximate location from IP, device type, and which version of the site you were shown | Google Analytics cookies | Understanding which pages help people and improving the site |
| Security data: sign-in times, IP address, failed sign-in attempts | Our servers | Keeping accounts secure and preventing abuse |
We do not collect information about anyone under 18 on purpose.
3. Who we share it with
Other members see only what a booking needs. Profiles show a first name and last initial, town, photo, bio, services, prices, badges and reviews. A provider sees a customer's job address only after accepting their request. Phone numbers and email addresses are never shown to other members.
Service providers process information for us, under contracts that limit how they use it:
| Service | What it does for Birch | What it receives |
|---|---|---|
| Stripe | Card payments, refunds, provider identity checks and payouts, tax forms | Payment details, names, emails, booking amounts; provider identity and bank details |
| Resend | Sends account and booking emails | Email address, name, message content |
| Twilio | Sends text messages (when switched on) | Mobile number, message content |
| Google Analytics | Measures how the site is used | Cookie ID, pages, clicks, device and approximate location |
| Cloudflare and Render | Network protection and hosting of the site and its database | All data passes through or is stored on their systems |
| OpenStreetMap / Photon (komoot) | Suggests addresses as you type; draws maps | The address text you type; map tile requests |
| Checkr (only if enabled) | Background checks for providers who request one | Information the provider gives Checkr directly |
Other reasons we may share information: to comply with the law or valid legal requests; to protect the safety, rights or property of members, the public or Birch; or as part of a merger, sale or transfer of the business, in which case this policy continues to apply.
We do not sell personal information and do not share it for cross-context behavioral advertising. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Mobile numbers and text consent are shared only with Twilio, to deliver the texts you asked for.
4. Cookies, retention and security
Cookies and similar storage
- Sign-in cookie (
sid): keeps you signed in. Without "remember me" it ends when you close the browser (and after 12 hours at most); with it, after 15 days on a computer or 30 days on a phone. Required for the site to work. - Site version cookie (
bdv): remembers which version of the site's design you were shown, so it stays the same on every visit, for 120 days. It is used only to compare the versions. - **Google Analytics cookies (
_ga,_ga_*):** measure visits and clicks. You can block them in your browser settings or with Google's opt-out add-on; the site still works. - Browser storage: remembers small preferences (for example, where to return after you sign in).
How long we keep information
- Account and profile information: while your account is open.
- When you delete your account, we erase your name, contact details, photo, profile, messages and addresses. We keep booking dates and amounts as financial records for 7 years, star ratings without your name, and messages other members wrote to you.
- Security logs: 90 days. Stripe keeps payment and payout records under its own policy.
Security
The site uses HTTPS everywhere. Passwords are stored only as salted hashes, accounts lock after repeated wrong passwords, sign-in sessions expire, and only authorized Birch team members can view member records. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you as the law requires.
5. Your choices and rights
- Download your data: Account settings → Download my data gives you a copy of everything we hold about you.
- Correct it: edit your details in Account settings, or ask us.
- Delete it: Account settings → Delete my account erases your personal data as described in section 4.
- Notifications: choose which emails and texts you get in Account settings. Security and password emails are always sent. Every marketing email has a one-click unsubscribe link.
- Texts: reply STOP to any text to stop them.
- Ask us: email support@birchlocal.app for anything you cannot do yourself. We answer within 30 days and may need to confirm it is you.
We will honor the privacy rights given by the law of your state, and will not treat you differently for using them.
Children. Birch is for adults 18 and over. If you believe a child has given us information, contact us and we will delete it.
Changes to this policy. We will post changes here with a new effective date. For material changes we will email members or show a notice on the site before they take effect.
Contact: support@birchlocal.app · Birch Local LLC, 14 Plains Road, Ipswich, MA 01938