Data Retention & Deletion

PaperCrane is a marketplace where real money changes hands, which means some records legally and practically cannot be erased on request: your counterparties' receipts reference them, and financial regulations require us to keep them. When you close your account we remove you from the platform — your identity, your contact details, your addresses — while the transaction records themselves remain. This page spells out exactly which is which.

We keep your account details, listings, orders, messages, and Crane Credit history for as long as your account exists — that continuity is the product. Usage data (pages viewed, searches, app events, including IP address and device information) is kept and used for the purposes in our Privacy Policy: improving the marketplace and detecting fraud and abuse. We keep usage data while it stays useful for those purposes rather than on a fixed calendar.

You can close your account yourself from Settings → Delete account, on web or in the app. Three things have to be finished first: orders you are shipping must be delivered or refunded, any dispute you are part of must be resolved, and any balance you owe the platform must settle. We cannot erase a seller mid-shipment or either party mid-dispute — closure is blocked until those finish, then available immediately.

Closure is immediate and permanent. There is no undo and no grace period: a closed account cannot be reopened. We remove your display name (it becomes “Deleted account”), release your username for others to register, and delete your bio, specialties, shipping addresses, saved signup-device identifier, and push notification token. Your profile photo and banner are removed from your profile, though the underlying image files are not immediately erased from storage. Your email address on the account is replaced with a non-functioning placeholder so new account email cannot reach you, your password is replaced with a random value, sign-in is permanently disabled, active sessions are ended, and anything you still had for sale is taken down.

Order records, payment and payout history, the platform ledger, and Crane Credit records are kept: they are financial records that your counterparties' receipts and our regulatory obligations (tax, accounting, anti-fraud) depend on. Order records are the exception to anonymization — each one carries a frozen shipping snapshot with the name, street address, and phone number used at the time, because it is the shipping record for a real parcel and the counterparty's receipt. Messages you sent remain visible to the people you sent them to — a conversation is the other person's record too — attributed to “Deleted account” rather than to you, and the same is true of reviews you wrote. Listings that were part of completed orders are archived rather than deleted, because buyers' order history references them.

A few other records survive closure. If you sold on PaperCrane, we keep the reference to your saved card (brand and last four digits) and our payment processor's account identifiers, so that a late carrier adjustment on an order you already shipped can still be settled. If you applied to sell, we keep your application and our notes on it. Copies of emails we already sent or queued keep the address they were sent to, and if your address is on our do-not-email suppression list it stays there — that list only works if it is permanent. Records of what you did on the platform — saved searches, notification history, onboarding answers, usage events — are not deleted; after closure they are keyed to an internal account id rather than to your name or contact details. And we keep a minimal record of the closure itself, including which username was released, so we can answer disputes about released handles.

Payment and identity data lives with Stripe, which processes payments and seller verification under its own privacy policy and retention obligations — card numbers never touch PaperCrane's servers, and tax records like 1099-Ks are Stripe's to keep as law requires. Shipping labels are purchased through our postage provider, which keeps address data on labels per carrier requirements. Emails are sent through our email delivery provider; addresses that hard-bounce are kept on a suppression list so we stop emailing them, which is a retention in service of not contacting you.

Records used to prevent fraud and abuse — event logs with IP addresses and device identifiers, and enforcement history on accounts closed for violations — are kept after closure. This is deliberate: fraud prevention only works if closing an account does not wipe the trail, and an account closed for counterfeit sales or fraud stays closed for the person behind it, which requires remembering who that was.

If you want to know what we hold about you, or believe something should have been removed and was not, write to us through the contact page and a human will answer.